Privacy

Company: Forma Group ("Forma," "we," "our," or "us")

This Privacy Policy explains how we collect, use, and share information when you use Forma's products and services, including mobile apps, web apps, websites, events, and programs (collectively, the "Services").

When you create an account, you are asked to review and accept this Privacy Policy before you can use the Services. Where a Service needs access to your location, camera, photos, microphone, or calendar, the app requests your permission through your device's operating system first, and before any of that data leaves your device. You can withdraw any of these permissions at any time in your device settings.

Not every Service collects everything listed in Part I. Part I describes the widest set across all of Forma. Part II says what each Service actually collects, and that is the part that applies to you. In particular, Forma Society collects no phone number, no payment details, no audio and no calendar data, and sends nothing to an AI provider.

Part I: General Privacy Policy (applies to all Services)

Information We Collect

• Personal Information: Name and email address that you provide to create and secure your account. Depending on the Service, this may also include a phone number, payment details, and any other identifying information you choose to provide.

• Usage Information: Device details, IP address, log data, app interactions, and crash and performance diagnostics.

• Transaction Information: Purchases, registrations, and participation in events or programs, for Services that involve them.

• Communications: Support requests, feedback, or other messages you send to us.

• Content You Provide: Photos and documents you upload. For Services with voice or AI features, also the audio you submit through voice input and the messages you send to those features.

How We Use Information

• Provide, operate, and improve the Services.

• Process purchases and event registrations.

• Communicate with you about your account, services, or updates.

• Ensure security and comply with legal obligations.

• Conduct research and improve our offerings.

Data We Send to Third Parties

We send specific data to the third-party service providers listed below strictly so that they can perform a function on our behalf. Each provider processes data only on our behalf, under contract, and is not permitted to use it for its own purposes. We do not sell your personal information. The list identifies exactly what data is sent, to whom, why, and which Services are involved.

• Supabase (authentication and database hosting) — all Services. We send your account details and the content you create. This is used to create and secure your account and to store your data. It happens when you create or use your account, after you accept this policy at sign-up.

• Deepgram (speech-to-text) — Forma App only. We send the audio you record when you use voice input, to convert your speech to text. This happens only when you actively use voice input, after you grant the microphone permission.

• Anthropic (Claude AI) — Forma App only. We send the messages you send to AI features, your approximate location, and any images you attach, to generate event-planning and recommendation responses. This happens only when you actively use an AI feature. Anthropic processes this data solely to provide the feature, does not use it to train its models, and is contractually required to protect it to a standard equivalent to that described in this policy.

• Expo (push notifications) — Forma Society. We send a device push token so we can deliver the notifications you have turned on.

• Apple Maps and Google Maps (map display) — Forma Society. Map tiles are requested from Apple on iOS and Google on Android to draw the map on your screen.

We may also share information with:

• Service Providers and Partners: Only as needed to provide the Services you request.

• Legal Authorities: If required by law or regulation.

• Business Transfers: In the event of a merger, acquisition, or sale.

Data Security

We use reasonable technical and organizational measures to protect your data. Access rules are enforced by our database itself, not only by the apps. However, no system is 100% secure.

Data Retention

We keep your personal information only as long as necessary to provide Services, comply with legal obligations, and resolve disputes.

Your Rights

Depending on your jurisdiction, you may have rights to access, update, or delete your personal information; request a copy of your data; and restrict or object to processing. Members in the EEA and the UK have these rights under the GDPR, and members in the Cayman Islands under the Data Protection Act (2021 Revision).

To exercise these rights, contact us at info@forma.city. You may also complain to your local data protection authority.

Account and Data Deletion

You can request deletion of your account and associated personal data at any time:

• In the app: open Settings, scroll to the bottom, and tap Delete account (you will confirm by entering your account email).

• Online: visit https://www.forma.city/delete-account and follow the instructions.

• By email: contact us at support@forma.city.

Upon a verified request, we will delete your personal data within 30 days, except where we are required to retain certain information to comply with legal obligations. Data held by our processors is deleted accordingly.

Children's Privacy

Our Services are not directed to children under 18. We do not knowingly collect data from minors.

International Transfers

Forma Group is incorporated in the Cayman Islands and our providers process data in other countries, including in the United States and the European Union. Where we transfer personal data out of a jurisdiction that restricts it, we rely on appropriate safeguards, including standard contractual clauses.

Changes to This Privacy Policy

We may update this Policy from time to time. Material updates will be communicated through the Services or by other means.

Part II: Product-Specific Privacy Terms

A. Forma App (Mobile App)

When you use Forma App, we collect and process the following, depending on the features you use.

• Account information: your name, email address, and phone number, used to create and secure your account (verified via one-time passcode). Collected when you sign up, after you accept this policy.

• Location: approximate or precise location, used to surface relevant events and recommendations near you. Accessed only after you grant the location permission prompt, and can be disabled at any time in your device settings.

• Camera and photos: if you set a profile photo or attach an image, we access your camera and/or the specific photos you select, only after you grant the camera/photos permission. We access only the images you pick; we do not scan your photo library.

• Microphone / audio: if you use voice input, we record audio for the duration of your request and send it to Deepgram to convert it to text. Audio is captured only after you grant the microphone permission and only while you are actively using voice input. We do not record audio in the background.

• Calendar: if you add an event to your calendar, we read and write calendar entries solely to create that event on your device, only after you grant the calendar permission. We do not store or transmit your other calendar data.

• AI features: event-planning chat and personalized recommendations use Anthropic (Claude), as described in Part I.

B. Events

• Data Collected: Registration details, ticketing information, and participation preferences.

• Sharing: With ticketing platforms, venues, and event partners.

• Purpose: To manage event access, communications, and safety.

C. Fellowship (Web App and Program)

• Data Collected: Application details, founder background, and engagement activity on the community hub.

• Sharing: Limited to program facilitators, mentors, or service providers offering perks.

• Purpose: To administer the program, connect participants, and provide resources.

D. Forma Society (Mobile App)

Forma Society is invitation-only. It collects no phone number, no payment details, no audio and no calendar data, and sends nothing to an AI provider.

What you give us

• Your email address, used to sign in. There are no passwords — we email you a one-time code.

• Your profile: name, a short bio, a profile photo and a header image if you add them.

• Where you are: the country you are from, the country and city you are based in, and optionally somewhere you are visiting and until when. These are places you type in, not places we detect.

• Your interests, chosen from a list.

• Your social handles. You mark each one public or private.

• The societies you claim, which an organiser of that society then approves or declines.

• What you write: event listings, the optional note on a wave, and the reason and detail you give when reporting someone.

What using the app creates

XP records showing what you earned and why; waves and connections; check-ins at events and places with the time; quest progress and which members you were shown as daily introductions; notifications sent to you and whether you read them; a device push token if you turn notifications on; and any blocks and reports you make.

Location

Forma Society does not track you. There is no background location, no presence and no location history.

Your declared location — the country and city you type in — is what the app uses to show you people and events nearby, and it is held at city level.

Separately, when you check in at an event or place, the app asks your device for your position at that moment so it can confirm you are there. The permission is requested in the foreground, only at that point, and you can decline. Your coordinates are used for that single distance check and are never stored — the check-in records only that it was verified.

Who can see what

Grouped by who can see it:

• Any signed-in member can see your name, photo and bio; the country you are from, the country and city you are based in, and anywhere you say you are visiting; your interests; your XP and level; the societies you belong to and who organises them; and your public social handles.

• Only members you have connected with can see your private social handles. You are connected when you and another member have both waved within seven days.

• Only you and the other person can see a wave you sent or received.

• Only you can see your check-ins, your quest progress, the itemised breakdown of your XP, and your notifications.

• Only you and Forma can see the blocks and reports you make.

These rules are enforced by the database itself, not only by the app, so they hold however the data is requested.

Photos you upload are stored at unguessable public URLs so the app can display them. Anyone with the exact link can view the image.

Retention

Records other members rely on — a connection you formed, a society membership, an event you posted — persist while they remain relevant to those members. Reports and blocks are kept as long as safety requires. Deletion is described in Part I.

Part III: Contact Us

If you have questions about this Privacy Policy, please contact us:

Forma Group Pavilion East, Cricket Square, Grand Cayman, KY1-1001, Cayman Islands info@forma.city