Data Processing Addendum

For personal information about your clients, leads and team that you add to FormaOS ("Customer Data"), you are the business or controller, and FormaOS is your service provider or processor.

• Who: your clients, leads, team members and others you add.
• What: names, contact details, property addresses, project details, photos, files, messages, selections, signatures and activity records.
• Why: only to provide, secure and support FormaOS for you, and as you instruct through the app.
• How long: while your account is active, then as described in section 8.

• We process Customer Data only on your instructions, which are these terms and how you use the app.
• We don't sell or share Customer Data, use it for advertising, or combine it with data from other sources for our own purposes.
• We don't use Customer Data to train AI models, and we don't let our providers do so.
• Everyone at FormaOS with access to Customer Data is bound to keep it confidential.
• We'll tell you if we believe an instruction from you breaks the law.

We use reasonable technical and organizational measures to protect Customer Data, including encryption in transit and at rest, separation of each company's data, role-based access controls and limits on who at FormaOS can access production systems.

You allow us to use the providers on our Subprocessors page. Each is bound by written terms that protect Customer Data at least as well as this addendum. We'll update that page before adding a new one. If you object for a reasonable data protection reason, tell us and we'll work with you. If we can't resolve it, you can cancel and we'll refund any prepaid fees for the time remaining.

If one of your clients asks to see, correct or delete their information, you can usually do it directly in FormaOS. If you need more help, we'll assist. If a request comes to us, we'll pass it to you rather than answer it ourselves, unless the law requires otherwise.

If we learn of a breach affecting Customer Data, we'll notify you without undue delay, and within 72 hours where we can, with the information we have. We'll take steps to contain it and keep you updated.

You can export Customer Data at any time. When your account ends, we keep it for 30 days so you can export it, then delete it, except where the law requires us to keep it. Backups are deleted on their normal schedule.

We'll answer reasonable questions about how we protect Customer Data and give you the information you need to show you're meeting your own legal obligations. Email help@getformaos.com.

We'll comply with the privacy laws that apply to us as your service provider, including the California Consumer Privacy Act. Customer Data is stored in the United States. If you're outside the U.S. and need additional terms for international transfers, contact us.