FormFitter Privacy Policy

Web Service | FormFitter LLC

This Privacy Policy explains how FormFitter LLC (“FormFitter,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects personal information when you use formfitter, including the formfitter website, web application, account, subscriptions, and related online services that link to this Policy (collectively, the “Service”).

FormFitter LLC is responsible for the personal information described in this Policy. The Service is operated from the United States and is hosted primarily through Amazon Web Services in the us-east-1 region, subject to the processing locations of our other service providers.

1. Scope

This Policy applies to the web Service only. It does not cover third-party websites or services that have their own privacy policies, including Google and Stripe.

2. Personal Information We Collect

2.1 Account and profile information

When you create an account with an e-mail address, we collect your e-mail address, password hash, account identifier, verification status, and security information. You may optionally provide a first and last name. We do not need your legal name for ordinary use unless a feature clearly states otherwise.

2.2 Google Sign-In information

If you use Google Sign-In, we receive information needed to authenticate you and create or connect your formfitter account, such as your Google account identifier, e-mail address, and basic profile information that you authorize Google to provide. We do not receive your Google password.

2.3 Avatar and body-configuration information

We collect the measurements, proportions, and other body parameters you enter or select to configure an avatar, together with avatar settings and generated configuration data. We use this information to provide avatar and fit-preview functionality. We do not use these data to identify you biometrically.

2.4 Projects and User Content

We collect and process projects, uploaded 3D assets, models, textures, images, notes, project metadata, saved positions, exports, and other materials you submit or create through the Service.

2.5 Subscription and transaction information

If you purchase a subscription, Stripe processes your payment information. We receive information such as your plan, price, billing interval, subscription status, renewal and cancellation dates, transaction identifiers, invoices, and limited billing details that Stripe makes available. We generally do not receive or store your full payment-card number or card security code.

2.6 Technical and usage information

We automatically collect information needed to operate, secure, and understand the Service, such as IP address, browser type, operating system, device type, session identifiers, access times, pages or features used, referring information, cookie and similar-technology data, performance information, error reports, and security events. If analytics is enabled, Google Analytics may also process a randomly assigned analytics identifier, page views, interaction events, referral and campaign information, general device and browser information, and approximate location derived from network information. We configure analytics not to receive names, e-mail addresses, uploaded content, body parameters, or other direct identifiers.

2.7 Communications and support

We collect information you provide when you contact support, submit a privacy request, respond to a survey, report a problem, or send feedback.

3. How We Collect Information

We collect information:

• directly from you, including during registration, avatar configuration, project creation, subscription purchase, and support;

• automatically when you use the Service, through logs, cookies, and similar technologies;

• from Google when you choose Google Sign-In;

• from Stripe when you purchase or manage a subscription;

• from Google Analytics when analytics is enabled, subject to the consent or choice mechanisms described below; and

• from security, fraud-prevention, hosting, and operational service providers where necessary to protect or operate the Service.

4. How We Use Personal Information

We use personal information to:

• create, authenticate, maintain, and secure accounts;

• provide avatar configuration, fit previews, project storage, rendering, and other requested features;

• process subscriptions, provide paid access, send invoices and billing notices, and manage cancellations;

• respond to support, privacy, and legal requests;

• communicate about security, service changes, subscriptions, and policy updates;

• monitor performance, diagnose errors, prevent fraud and abuse, and protect users and the Service;

• measure and analyze service usage, traffic sources, feature interaction, and performance, including through Google Analytics when enabled, to improve functionality and user experience;

• enforce our Terms of Service and protect rights, safety, and property; and

• comply with legal, tax, accounting, regulatory, and dispute-resolution obligations.

We do not use private project files, avatars, or uploaded assets for advertising. We will not use them for a materially different purpose without updating our disclosures and obtaining any consent required by law.

5. How We Disclose Personal Information

We may disclose personal information in the following circumstances:

5.1 Service providers

We disclose information to vendors that process it for us or provide infrastructure and operations, including Amazon Web Services for hosting and storage, Stripe for payments and subscription management, Google for authentication and Google Analytics, and providers of e-mail delivery, customer support, security, monitoring, and error reporting. These providers receive only the information reasonably necessary for their services and are subject to contractual or other obligations appropriate to their role.

5.2 Legal, safety, and rights protection

We may disclose information when we reasonably believe disclosure is necessary to comply with law or legal process; respond to valid government or regulatory requests; investigate fraud, security incidents, or abuse; enforce agreements; or protect the rights, safety, and property of users, FormFitter, or others.

5.3 Business transactions

We may disclose or transfer information in connection with a merger, financing, acquisition, bankruptcy, reorganization, sale of assets, or similar transaction, subject to appropriate protections and applicable law.

5.4 At your direction or with your consent

We may disclose information when you direct us to do so, use a feature that requires the disclosure, or provide consent for a specific purpose.

6. Sale, Sharing, and Targeted Advertising

We do not sell personal information for money. We do not share personal information for cross-context behavioral advertising, and we do not use User Content for targeted advertising. In the configuration covered by this Policy, we use Google Analytics for basic service measurement only and do not enable Google advertising features, remarketing, Google Signals, or ads personalization.

This statement assumes the Service does not use advertising pixels, data-broker integrations, or cross-site behavioral advertising tools. If those practices change, we will update this Policy and provide any legally required notice and opt-out before the change applies.

7. Cookies and Similar Technologies

7.1 Essential technologies

We use essential cookies and similar technologies for authentication, security, session management, fraud prevention, load balancing, preferences necessary to deliver the Service, and recording your cookie choices. These technologies are required for requested functions such as registration, sign-in, account security, and access to the web application. Blocking them may prevent the Service from working.

7.2 Google Analytics

With your permission where required, we use Google Analytics to understand how visitors reach and use the Service, which pages and features are used, and whether the Service performs as intended. Google Analytics uses cookies and similar technologies, including the _ga cookie, to distinguish users and sessions. Google may process analytics information on our behalf under its applicable terms and data-protection provisions.

We do not intentionally send Google Analytics names, e-mail addresses, payment-card details, uploaded assets, project content, avatar body parameters, authentication tokens, or other information that directly identifies you. The Service must be configured to prevent such information from appearing in analytics events, page titles, URLs, or custom parameters.

7.3 Your cookie choices

Essential technologies are active because they are necessary to provide and secure the Service. Non-essential analytics technologies will be activated only after consent where applicable law requires it. You may accept or reject analytics through the cookie banner. Rejecting analytics will not prevent registration, sign-in, subscription management, or use of core Service features.

You may also control cookies through browser settings. Browser controls may delete or block both essential and non-essential cookies, and blocking essential cookies may prevent parts of the Service from functioning.

Additional information about how Google collects and processes data when Google Analytics is used is available through Google’s privacy disclosures and policies.

8. Data Retention and Account Closure

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including providing the Service, maintaining security, resolving disputes, preventing fraud, complying with law, and honoring your account-closure choice.

8.1 Active accounts

Account information, avatars, projects, and uploaded assets are generally retained while your account is active.

8.2 Account closure and 180-day recovery period

When the in-product account deletion process becomes effective, we disable access and cancel future subscription renewals. We ordinarily retain eligible account data, projects, avatars, and uploaded assets in a restricted recovery state for 180 days after closure. The account is not available for ordinary use during this period.

If you have an active paid subscription and choose to keep access through the current paid period, closure becomes effective at the end of that period, and the 180-day recovery period begins then. If you choose immediate closure, access ends immediately and the 180-day recovery period begins at that time.

After the recovery period, eligible data is deleted or de-identified from active systems. Residual copies may remain in backups until they are overwritten through normal backup cycles, generally for up to 30 more days.

8.3 Records retained for other purposes

We may retain limited transaction, invoice, tax, accounting, chargeback, fraud-prevention, security, consent, dispute, and legal records for longer where reasonably necessary or required by law. We restrict the use of retained information to the applicable purpose.

8.4 Privacy deletion requests

The account recovery period does not limit privacy rights available under applicable law. If you submit a verified request to delete personal information, we will respond within the legally required timeframe and delete eligible information, subject to lawful exceptions such as completing a transaction, maintaining security, preventing fraud, complying with law, or establishing or defending legal claims.

9. Your Choices and Privacy Rights

You may update certain account information in the Service, cancel a subscription through account settings or the linked Stripe customer portal, and close your account through the available deletion flow.

Depending on where you live and the law that applies to FormFitter, you may have rights to:

• request access to personal information we hold about you;

• request correction of inaccurate personal information;

• request deletion of personal information;

• request a portable copy of certain personal information;

• opt out of sale, sharing, or targeted advertising if such processing occurs;

• limit certain uses of sensitive personal information where applicable;

• appeal a denial of a privacy request where applicable; and

• receive equal service and pricing without unlawful discrimination for exercising privacy rights.

To submit a request, contact [email protected]. We may verify your identity using information already associated with your account and will request only information reasonably necessary for verification. Authorized agents may submit requests where permitted by law, subject to verification of their authority.

10. U.S. State Privacy Disclosures and California Notice at Collection

This section provides additional information for residents of U.S. states with applicable consumer privacy laws. It also serves as a California Notice at Collection to the extent the California Consumer Privacy Act applies to FormFitter.

We collect the categories below for the business purposes described. We disclose them to the service-provider categories described in Section 5. We do not knowingly sell or share these categories for cross-context behavioral advertising.

We collect personal information from the sources described in Section 3. We use sensitive personal information, including account log-in credentials, only as reasonably necessary to provide authentication, security, fraud prevention, and requested Service functions, or as otherwise permitted by law.

If applicable law requires an appeal process, you may appeal a denied request by replying to our decision or contacting [email protected] with the subject “Privacy Appeal.”

11. Google Sign-In

When you use Google Sign-In, we request only permissions reasonably necessary to authenticate you and create or connect your formfitter account. Our use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including applicable Limited Use requirements.

You may manage third-party account access through your Google Account settings. Revoking Google access may prevent Google Sign-In, but it does not automatically close or delete your formfitter account. Use the formfitter account settings or contact us to close the account or submit a privacy request.

12. Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including access controls, encryption in transit, password hashing, logging, backup protections, and security monitoring where appropriate. No system can guarantee absolute security.

You are responsible for using a strong, unique password for e-mail registration and for protecting your devices and account access. If a legally reportable security incident occurs, we will provide notices as required by applicable law.

13. International Processing

FormFitter is based in the United States, and the Service is hosted primarily in the United States. Personal information may be processed in the United States and other countries where service providers operate. Those locations may have privacy laws that differ from the laws where you live.

This Policy is drafted for a U.S.-first launch. If FormFitter intentionally offers the Service in a jurisdiction that requires additional notices, legal bases, consent mechanisms, or international-transfer safeguards, we will implement and publish the required regional terms before that launch.

14. Children’s Privacy

The Service is intended for users age 18 and older. We do not knowingly collect personal information from children under 13. If we learn that we collected personal information from a child under 13 without legally valid authorization, we will take appropriate steps to delete it. Contact [email protected] if you believe a child has provided information to us.

15. Marketing and Service Communications

You may opt out of promotional e-mails by using the unsubscribe link or contacting us. You may still receive transactional and service communications, including verification messages, security alerts, billing notices, subscription updates, policy notices, and support responses.

16. Changes to This Policy

We may update this Policy. We will post the current version at https://formfitter.net/privacy and revise the “Last Updated” date and version number. If a change materially affects how we use personal information, we will provide additional notice and obtain consent where required before the new practice applies.

17. Contact Us

FormFitter LLC

24 Metzler Street, Stirling, New Jersey 07980

Privacy e-mail: [email protected]

Support: [email protected]