Privacy Policy

FamiForm is operated by Efren Jan Web Solutions, an establishment registered in the United Arab Emirates. It is the controller of personal information processed to provide the service. Privacy requests may be sent to support@famiform.com.

This policy applies globally to famiform.com, FamiForm accounts, workspaces, applications, and related support communications. The operator’s UAE location does not restrict where people may use FamiForm or reduce privacy rights provided by the laws that apply to them.

• Account information: email address, authentication records, confirmation status, account identifiers, and—when you continue from a public FamiForm page—an allow-listed signup-source category and public Field Pack identifier. The identifier can remain for aggregate acquisition reporting after the pack has opened; selected field values are never part of it. We do not save an arbitrary referring URL in this account metadata.
• Workspace information: workspace name, roles, invitations, linked accounts, person-level grants, and member usage totals.
• Saved personal information: names, relationships, addresses, dates, identifiers, notes, custom labels and values, handwritten-signature drawing data, and other fields you choose to save.
• Documents: uploaded images or PDFs, file metadata, document type, recognized text, and fields reviewed and saved by a user.
• Billing information: Paddle customer, transaction, price, and subscription identifiers and status. FamiForm does not receive or store full payment-card numbers.
• Technical and support information: security logs, request details, device or browser information made available by infrastructure providers, support messages, and error details.
• Feature records: field-review timestamps and value fingerprints, bounded field-only version history, reminders and notification preferences, reusable field groups, reusable Field Pack templates containing labels and types but no values, PDF field-reference and visual-layout mappings, requested field names, metadata for expiring share links, minimal Quick Sign records, and recipient-signing records such as recipient name and email, order, status, delivery and signing times, typed signing name, consent version, coarse country, and a one-way IP digest.
• Operational records: allow-listed security actions, daily aggregate feature counts, and one-way email-address digests used to prevent repeat delivery to suppressed addresses. These records do not contain document contents or saved field values.

• Authenticate users and provide private workspaces.
• Store, organize, search, display, copy, export, and delete user-selected fields and documents.
• Recognize document text, suggest a matching person, and present results for review.
• Deliver invitations, expiry reminders, service messages, billing, and account support.
• Apply plan limits, process subscriptions, prevent abuse, investigate security incidents, and maintain reliability.
• Continue the Field Pack you selected through account confirmation and understand aggregate signup sources without storing an arbitrary referring URL.
• Meet legal obligations and establish, exercise, or defend legal rights.

Depending on the context and applicable law, we rely on performance of our contract, your consent or instructions, legitimate interests in operating and securing FamiForm, and compliance with legal obligations.

A workspace may contain information about relatives, children, employees, or other people who do not have a FamiForm account. The account holder who adds that information is responsible for having an appropriate legal basis, permission, or authority to do so and for responding to that person’s requests.

Inviting a person to link an account does not automatically give them access to every workspace record. Workspace managers assign person-level permissions and separate source-file download permissions.

Free OCR: the default OCR process runs in your browser. The OCR engine does not need the document to be sent to an external OCR service. If you save the result, the selected source file and reviewed fields are stored with FamiForm’s infrastructure.

Optional enhanced scan: you can explicitly choose to send one prepared document page and, when available, up to 3,000 characters read locally from that page to a processing service for a stronger field suggestion. This feature is separately labeled, capped to a small free daily service budget, and FamiForm does not save the prepared page or accompanying text as a source file as part of the scan. Review suggestions before saving.

Recognition is optional and results are shown for human review before saving. Original files are not uploaded unless you expressly choose to keep them in private storage. A mobile-camera handoff uses a private, one-time link and temporary storage only long enough to deliver one image to your open desktop import; it is removed when canceled or saved, becomes inaccessible at expiry, and is deleted by scheduled cleanup. FamiForm does not train an artificial-intelligence model on your fields, document contents, or source files.

Handwritten signatures: when you choose to draw and save a signature, FamiForm stores the drawing as normalized stroke coordinates inside the selected information set. The browser renders those coordinates and can prepare a transparent PNG for an explicit copy or download action. FamiForm does not use the drawing to verify identity or infer biometric characteristics.

PDF preparation and Quick Sign: when you fill, visually prepare, or Quick Sign a PDF, FamiForm downloads the authorized source to your browser and creates the completed copy locally. Reusable layouts store bounded coordinates and scoped field references, not field values, typed custom text, signature strokes, or PDF contents. An optional placement suggestion sends one rendered page only after a separate explicit choice, under the same bounded free-use protection as enhanced scanning; it is not retained as a source file. A completed PDF is uploaded only when you explicitly choose to save it privately. We retain a minimal signing record only when a signature is applied, to provide your private signing history; you can export or delete that record.

Recipient signature requests: when you choose this workflow, the prepared PDF is stored privately while FamiForm emails a one-time, expiring link to each recipient in order. Opening the current emailed link confirms possession of that inbox; it is not independent identity verification. We record the recipient’s typed name, consent version, status, relevant times, coarse country when available, and a one-way IP digest. The visual signature is embedded into the completed private PDF, while the reusable stroke data and raw IP address are not retained as separate records.

We disclose only the information reasonably needed for these providers to perform services for FamiForm:

• Supabase: authentication, database, and private file storage.
• Cloudflare: hosting, content delivery, network security, and request processing.
• Optional AI processing: one prepared document page and up to 3,000 characters read locally from it only when you explicitly select an enhanced scan.
• Paddle: checkout, subscriptions, tax handling, transaction support, and billing records.
• Mailjet (Sinch Email): account, invitation, reminder, and other service email when configured.

Our current provider contracts and data-processing terms are available from Supabase, Cloudflare, Mailjet (Sinch), and Paddle. Their published subprocessor lists and terms may change according to those agreements.

We may also disclose information when legally required, to protect users or the service, to investigate fraud or security issues, or as part of a business reorganization with appropriate confidentiality and data-protection safeguards. We do not sell personal information, use document contents for targeted advertising, or share information for cross-context behavioral advertising.

FamiForm serves users globally. FamiForm and its providers may process information in the United Arab Emirates, the United States, the European Economic Area, and other countries where they operate. Those countries may have different data-protection laws.

Where required, we use contractual, organizational, adequacy-based, consent-based, or other lawful safeguards for international transfers. Contact us if you want more information about safeguards relevant to your information.

Workspace fields and optional source files remain in the active service until a permitted user deletes them, the workspace is deleted, or the account lifecycle requires removal. Users can delete information sets and attached source files, erase all source files while keeping reviewed fields, export account data, and request or perform eligible account deletion from Privacy & security.

• Upload authorizations: expire after 15 minutes and are removed from operational records after one day.
• Workspace invitations: expire after seven days and are removed within 30 days after acceptance or expiry.
• Daily abuse-prevention totals: retained for 90 days.
• Security activity: limited to allow-listed actions and minimal metadata, retained for 180 days.
• Aggregate feature totals: daily workspace counts with no field values or document contents, retained for approximately 400 days.
• Email suppressions: a one-way digest and delivery reason may remain while needed to honor an opt-out or avoid repeated failed delivery.
• Information-set history: limited to the ten most recent field-only versions and removed when the information set is deleted. Signature strokes are not duplicated into history, and oversized flexible-field snapshots are omitted to bound storage growth.
• Quick Sign history: minimal signing records remain until you delete the record, its linked source or completed information set is deleted, or the workspace/account is deleted. They do not contain signature strokes or PDF contents.
• Recipient signature requests: active requests expire within 30 days. One-time link tokens are stored only as hashes and are replaced when resent. Temporary intermediate PDFs are removed when a request completes, expires, is canceled, or is declined. Limited event times, coarse country, and one-way IP digests are retained for up to 30 days; the remaining request record stays with the workspace until an eligible unsigned record, source record, workspace, or account is deleted. Completed PDFs follow ordinary private document retention.
• Controlled shares: selected fields may be shared for one view, a chosen duration, a specific date and time, or until revoked. Source-document shares always require an expiry. Raw link tokens are not stored.
• Share access records: share opens and document-download attempts may retain the time, a coarse country code when provided by the network, and a one-way IP abuse-prevention digest for 30 days. We do not store raw IP addresses or precise location for this feature.
• Billing webhook idempotency records: retained for 180 days. Paddle retains transaction and tax records under its own legal obligations.
• Support and security records: retained only as reasonably required to resolve the request, investigate an incident, prevent abuse, or meet a legal obligation.

Deletion removes information from the active application. Restricted backup copies age out under the applicable provider’s backup-rotation schedule and are not restored for ordinary account recovery. Legal holds, fraud prevention, disputes, and mandatory transaction-record obligations may require limited records to be retained longer.

FamiForm uses measures designed to protect information, including encrypted transport, authenticated access, optional authenticator-app multi-factor authentication, database row-level access controls, private object storage, short-lived source-file links, hashed controlled-share and signature-request links, role-based sharing controls, recent-authentication checks for permanent deletion, and server-only secrets for privileged operations.

No system can guarantee absolute security. Use a unique password, protect your email account, review workspace membership regularly, and avoid storing information that is not needed.

Depending on applicable law, you may have rights to access, correct, receive, delete, restrict, or object to processing of personal information and to withdraw consent. You can exercise many rights directly by editing, exporting, or deleting information in FamiForm.

• EEA, United Kingdom, and similar jurisdictions: rights may include access, correction, erasure, restriction, objection, portability, withdrawal of consent, and a complaint to your supervisory authority.
• United States: depending on your state, rights may include knowing, accessing, correcting, or deleting information and opting out of certain sale, sharing, targeted advertising, or profiling. FamiForm does not sell personal information or share it for cross-context behavioral advertising.
• United Arab Emirates and other countries: you may exercise the data-subject rights available under the privacy law that applies to you.

For other requests, email support@famiform.com. We aim to acknowledge privacy requests promptly and respond within the period required by applicable law. We may need to verify your identity and authority, especially when a request concerns another person or a shared workspace. You may also have the right to complain to the data-protection authority that applies to you.

We will not discriminate against you for making a privacy request. Authorized agents may submit requests where permitted by law, subject to verification of their authority.

FamiForm accounts are for adults and are not directed to children. An authorized adult may store a child’s information for legitimate household purposes. Do not invite a child to create an account unless the use and consent comply with applicable law.

FamiForm uses essential browser storage and similar technologies for authentication, security, user preferences, and application operation. Cloudflare Web Analytics helps us understand aggregate visits to public marketing pages and site performance without analytics cookies or cross-site tracking. We do not use third-party advertising trackers. Paddle and other providers may use their own necessary technologies when you interact with their services.

Cloudflare Web Analytics is not loaded inside authenticated workspaces, authentication or checkout pages, time-limited Selected Fields pages, or mobile-upload pages, so private and one-time link paths are not sent to that analytics service.

We may update this policy as FamiForm, our providers, or applicable requirements change. We will update the effective date and provide additional notice for material changes where required.

Questions and privacy requests can be sent to support@famiform.com.