Legals
Privacy
How Forma collects, uses and protects information across its website and CMS.
Last updated
Who is responsible
DDS Studio operates this website and Forma CMS at app.formacms.co. This policy explains how we handle information across both services.
Repository owners decide what information their teams upload, who can access it and where it is published. If your information was provided by a customer using Forma, contact that repository owner about their use of it. You can also contact us for assistance with your request.
Information we process
Forma processes your name, email address, account identifier, optional profile image, authentication records, repository memberships and permissions, and the content and media you or your team provide. Repository information includes content models, drafts, published versions, locales, media metadata and integration settings. We also receive information you send when contacting support. Technical records may include request times, IP addresses, browser information, errors and security events. Password accounts use a salted password hash rather than storing the password in readable form.
Google sign-in
When you choose Google sign-in, Forma uses your Google account identifier, verified email address and name to authenticate you and manage your account. Forma does not request access to your Gmail messages, Drive files, calendars or contacts. Google access and refresh tokens are not stored as part of your Forma account.
The requested permissions are openid, email and profile. Google identity information is used for account access and security, rather than advertising. You can review or remove the connection in your Google Account. Removing it does not by itself delete your Forma account or repository content. Contact us if you also want that information removed or need help accessing your account.
Why we use it
We use this information to provide the CMS, authenticate accounts, apply repository permissions, deliver requested account messages, process your content and media, provide support and protect the service against abuse. Content you publish or share through authorized integrations is used according to the access you or your repository owner configure.
Information is also used to manage the service relationship and meet applicable obligations. Where a particular use requires your authorization, that authorization must be obtained for that use.
Content you publish or share
Published content and publicly served media can be accessed by people who have their URLs. Integrations and webhooks can send content to destinations configured by authorized repository users. Those destinations have their own handling practices.
Only publish or share information you are entitled to disclose. Do not place passwords, private integration credentials or confidential information in public content or public media. Removing content from Forma does not remove copies previously obtained by other people or services.
Service providers
Cloudflare provides hosting, storage, media processing infrastructure, security and account email delivery. Google processes sign-in information when you select Google. If payment features become available and you choose to use them, Mercado Pago processes payment information through its payment interface. Forma does not store complete card numbers or card security codes.
Providers may process information in the countries where they operate their services. This policy does not promise storage in a particular country. Contact us before providing information subject to specific storage or processing requirements.
Information may also be disclosed when required by applicable law or to investigate abuse and protect the service and its users.
Cookies and account security
The public website does not require a Forma account and does not set a Forma login cookie. The CMS uses necessary session cookies and temporary authentication data to keep you signed in and protect authentication. These account cookies are limited to the application hostname.
The website uses Cloudflare Web Analytics to understand page visits and performance. Its beacon reports usage and technical measurements to Cloudflare. This is separate from advertising tracking. Cloudflare and authentication providers may also process connection information and use necessary security cookies when their services are involved. Blocking application cookies can prevent sign-in from working. Keep credentials and integration tokens private.
Retention and your requests
Information is retained as needed to provide the service, resolve support and security matters and meet applicable recordkeeping obligations. The relevant purpose, repository status and applicable agreements affect how long particular records are needed.
Moving content or media into a recoverable deleted state is different from permanently removing it. Permanent repository deletion removes repository records and associated files through background cleanup; it is not a promise of immediate removal from every system. Recovery copies and records retained for security or legal obligations may remain for their applicable retention period.
Contact hello@ddsstudio.co to request access, correction or deletion of information, or to ask about closing an account. Where applicable, you may also withdraw authorization, object to a particular use or complain to the relevant data protection authority.
Describe the account or repository concerned and the action you need. We may need to verify your identity and authority over the repository. Do not send passwords or access tokens. Requests are handled subject to applicable rights, repository ownership and obligations requiring particular records to be retained.
Policy updates
This page identifies its latest update. We will update it when our information practices change and provide additional notice or request authorization where applicable requirements call for it.