Last updated: October 26, 2026

This policy explains how Formi Agência Criativa e de Tecnologia LTDA ("Formi," "we"), CNPJ 54.269.057/0001-10, processes personal data when you use our services (the "Services"): the website oformi.com.br, the app app.oformi.com.br, the portal portal.oformi.com.br, the mobile apps, the Creative Department, Formi Autopilot, Rapport, and the creative partners' Hub Space, and when you talk to us by chat, WhatsApp, email, or social media.

Formi is the controller of this data. For privacy questions and requests, including those addressed to the data protection officer (DPO), write to atendimento@oformi.com.br with the subject "Privacy."

SUMMARY

• What we process: registration and company data, request materials, data from connected social networks, payment data through the payment processors, and browsing data.
• What for: to provide and bill for the Services, provide support, maintain security, improve the product, and, with your consent, measure visits and ads.
• Who we share it with: technology providers that work for us, creative partners who work on your requests, and the platforms you connect. We do not sell data.
• Your rights: you can access, correct, delete, and port your data, among other rights, through the app or by email.

1. WHAT DATA WE COLLECT

Data you provide to us

• Account: name, email, phone number, password (stored encrypted), photo, job title, company, country, language, currency, and, when provided, gender and date of birth.
• Tax ID and addresses: CPF, CNPJ, or the equivalent document in your country, and billing and mailing addresses.
• Company: name, tax ID, website, contacts, logo, brand identity, request materials and briefs, and Autopilot and Rapport settings.
• Creative partners: photo ID (RG or CNH), CPF or CNPJ, address, portfolio, bank details, and PIX key. The ID document is kept in a private area, accessible only to the Formi team.
• Contracts: name, date and time, IP address, and the location reported by the browser at the time of signing.
• Conversations: messages and files sent through the app, the website chat, WhatsApp, email, and social media.
• AI clone and brand voice: the image and voice of the person recorded, only with that person's consent and the rights declaration made in the app.

Data collected automatically

• Technical access logs (IP address, browser, date and time), required for security.
• Cookies and similar technologies, as described in the Cookie policy. With your "Analytics" consent, the Formi pages you visit are linked to your contact record, for our customer service.

Data received from third parties

• Sign-in with Google, Facebook, or Apple: name, email, and photo.
• Connected social networks: see section 8.
• Public company data: official registries (such as the CNPJ registry in Brazil) and public information used in Formi's sales activities.

Payment data. Payments are processed by Stripe (credit card, Autopilot subscriptions, and charges outside Brazil) and by Asaas (boleto, PIX, and card in Brazil, invoices, and PIX transfers to partners). Formi does not store the card number: it stores only customer identifiers and displays the card brand and the last 4 digits retrieved from the processor.

Sensitive data. We do not ask for sensitive data. If you include it in messages or materials, it will be processed only to fulfill your request.

2. WHAT WE USE IT FOR AND ON WHAT LEGAL BASIS

• Providing the Services and performing the contract: creating the account, producing and delivering requests, publishing on social networks, replying through Rapport, billing, issuing invoices, and providing support.
• Legitimate interest: security and fraud prevention, improvement of the Services, and commercial communication with companies, always with the option to opt out.
• Consent: analytics and marketing cookies, AI clone, and brand voice. You can withdraw your consent at any time.
• Legal obligation and defense of rights: tax and accounting records, contracts, and requests from authorities.

We do not make automated decisions that produce legal effects concerning you.

3. ARTIFICIAL INTELLIGENCE

We use artificial intelligence to organize requests, produce and review content, translate, and reply to messages. The data needed for each task is sent to the providers Anthropic (Claude), OpenAI, ElevenLabs, HeyGen, and Kling AI, which process it through their commercial APIs, under their respective terms, without using it to train their models. Formi does not use your data to train AI models.

4. RAPPORT: DATA OF PEOPLE WHO INTERACT WITH THE COMPANY

When a company uses Rapport, Formi processes, on the company's behalf, the data of people who comment on, review or send messages to its social media accounts: username, name, profile photo, comments, reviews (with the rating), and messages. The company is the controller of this data, and Formi is the processor. We use this data only to reply, display the conversations and comments in Rapport, and count the results. It is stored for as long as the company uses Rapport, and the company may request its deletion at any time. People who interacted with the company may exercise their rights with the company or write to us.

5. WHO WE SHARE IT WITH

We share data only with those who need it for the Services to work:

• Infrastructure: Supabase (database and sign-in), Amazon Web Services (files), Render (servers), Vercel (websites), and GitHub (video processing).
• Communication: SendGrid (emails), Twilio (SMS and WhatsApp notifications), Whapi (customer service WhatsApp), OneSignal (notifications), and Titan (team email).
• Payments: Stripe and Asaas.
• Artificial intelligence and content: Anthropic, OpenAI, ElevenLabs, HeyGen, Kling AI, Pexels (image bank), and Storrito (stories stickers).
• Platforms you connect: Meta (Facebook, Instagram, Threads), TikTok, LinkedIn, Google (YouTube, Google Business), and X.
• Google: sign-in, addresses and maps, meeting scheduling, and, with your consent, Google Analytics and Google Ads.
• Registry lookups: public company and address data services (such as BrasilAPI, ReceitaWS, ViaCEP, and OpenStreetMap).
• Creative partners: receive the brief and materials for the requests they accept, under the confidentiality obligation of the Creative partnership agreement.
• Authorities: when required by law.

We do not sell personal data.

6. INTERNATIONAL TRANSFERS

Some providers process data outside Brazil and the European Economic Area, mainly in the United States. In these cases, we use the safeguards provided for in the LGPD and the GDPR, such as standard contractual clauses and the Data Privacy Framework.

7. COOKIES

We use cookies and similar technologies as described in the Cookie policy. Analytics and marketing cookies work only with your consent.

8. CONNECTED SOCIAL NETWORKS

When you connect your company's social networks to Formi, authorization takes place on each network's official screen, and you choose which accounts, Pages, and profiles to connect.

Data we receive: the name, photo, and identifier of the account, Page, or profile; the list of Pages and professional accounts you manage, so you can choose which one to connect; access tokens, stored encrypted; metrics for the posts published by Formi; and, with Rapport, the comments and messages received, as described in section 4.

How we use it: to publish the company's approved or automatic content, show in the app the status and performance of these posts, reply to comments and messages when Rapport is turned on, and improve the company's future content. We do not use this data for advertising, and we do not sell it.

On TikTok, for posts made manually, you confirm the account, privacy, interactions, and commercial content disclosure before sending. For automatic posts, the visibility and interactions you chose for the account in Formi apply.

Retention: tokens and social network data are stored while the network is connected. When the connection is removed in Formi, tokens are deleted immediately, and the other data from that network within 30 days.

Google and YouTube data

Formi uses YouTube API Services. By connecting a YouTube channel, you agree to the YouTube Terms of Service, and the Google Privacy Policy also applies.

What we access: the channel's name, photo, and identifier; the channel's videos and their public data; the videos you schedule in Formi, which we upload to the channel; and, when Rapport is on, the comments on the channel's own videos. On Google Business, the reviews of the connected locations.

How we use it: only to publish the videos the company schedules, show the channel and video performance in the app, list comments and post the replies the company approves, and hide the comments it chooses. Reply drafts are generated by our AI processor (Anthropic), which does not train models on this data. We do not use Google data for advertising, we do not sell it, and we do not use it to develop, improve, or train generalized AI models.

Formi's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Storage and deletion: tokens are stored encrypted, and YouTube data is kept while the channel is connected; when it is disconnected, tokens are deleted immediately and the other data within 30 days. You can revoke Formi's access at any time at myaccount.google.com/permissions.

How to delete your social network data

1. Ask the Formi team to disconnect the network through the app chat or by email at atendimento@oformi.com.br. Tokens are deleted immediately, and the other data from that network within 30 days.
2. You can also remove Formi's access in each network's settings: on Facebook and Instagram, under Settings > Business integrations (Apps and websites); on Threads, under Settings > Account > Websites and apps; on TikTok, under Settings > Security and permissions > App permissions; on Google and YouTube, at myaccount.google.com/permissions.
3. To delete all of your Formi account data, use Delete account, under My account, or write to atendimento@oformi.com.br with the subject "Data deletion." We confirm the deletion within 30 days.

9. HOW LONG WE KEEP IT

• Account: while it is active. When the account is deleted, personal data is deleted or anonymized immediately.
• Tax and accounting records and contracts: for the period required by law, even after the account is deleted.
• Disconnected networks: tokens are deleted immediately; the other data, within 30 days.
• Request files: as described in the Plan terms.
• Conversations, materials, and Rapport data: while the account and the service are active, or until you request deletion.

10. SECURITY

We use encrypted connections (HTTPS), social network tokens stored encrypted, partner documents in a private area, and access restricted to the team members who need the data. No transmission or storage over the internet is 100% secure, but we work to protect your data and will notify you and the authorities in the event of a material incident, as required by law.

11. MINORS

The Services are intended for persons aged 18 or older, and we do not knowingly collect data from minors.

12. YOUR RIGHTS

Under the LGPD (Brazil) and the GDPR (European Union), as applicable to you, you may: confirm whether we process your data and access it; correct it; request its deletion, anonymization, or blocking; request its portability; find out who we share it with; object to processing based on legitimate interest; and withdraw your consent.

How to exercise them: under My account, in the app, you can view and correct your data and delete your account. Other requests, such as a copy of your data, are made by email at atendimento@oformi.com.br, with the subject "Privacy." We respond within 15 days, or within the period set by the law of your country.

You may also file a complaint with the data protection authority: in Brazil, the ANPD; in Spain, the AEPD; or the authority in your country.

13. "DO NOT TRACK"

Browsers do not yet have a single standard for the "Do Not Track" signal, so we do not respond to it. Your cookie choices are made through the cookie notice.

14. UPDATES

We may update this policy. The date at the top shows the version in effect, and material changes will be announced by email or in the app.

15. CONTACT

Formi Agência Criativa e de Tecnologia LTDA
CNPJ 54.269.057/0001-10
Rua Itapura, 1053, Vila Gomes Cardim
São Paulo – SP, CEP 03310-000, Brazil
Phone and WhatsApp: +55 11 97211-8051
Email: atendimento@oformi.com.br