Privacy policy

What we collect when you write to us, why we have it, who else touches it, how long we keep it, and what you can tell us to do with it.

Who we are

FORMA is a founder-led software and design studio. We work from Israel with clients in Israel, Greece, Europe and internationally. FORMA decides what happens to the personal data described on this page, and is responsible for it.

Reach us at hello@forma-ltd.com — that address goes to the founders directly. You can also find us on LinkedIn.

What we collect

• What you send us in a form. The contact form asks for your name, work email, an optional company or project name, what you want to build, and roughly when you want it. The short form on the homepage asks only for an email and one line. Your email address is the only field we genuinely need.
• What you type into the chat. The assistant on this site is a conversation, not a form. Whatever you write in it — including a name, an email, a phone number or a description of your business — is part of the message. If the conversation turns into an enquiry, the whole transcript is emailed to us.
• Which page you were on when you sent the enquiry, and which language the message was in. This is context for the reply, nothing more.
• Technical data our server sees. Like every website, ours receives your IP address, the time of the request, the page requested, and your browser’s user-agent string. Our hosting provider keeps short-lived server logs of this.
• Your IP address, briefly, to rate-limit. To stop the forms and the chat being hammered, the server counts recent requests per IP address in memory for sixty seconds and then forgets them. Nothing is written to disk.

The site counts page views — which page, roughly where from, roughly what device — using the counter run by the company that already hosts it. It sets no cookie and stores nothing on your device, it is never joined to an enquiry, and it cannot follow you anywhere else. Beyond that there are no advertising pixels and no tracking scripts, so there is no behavioural profile of you anywhere in this site. See the cookie policy for what is and is not stored in your browser.

Why we use it

• To reply to you and to carry on the conversation you started.
• To work out whether we are a fit for what you are asking for — and to say so plainly when we are not.
• To keep the site up and unabused — rate limiting, spam checks and diagnosing faults.
• To keep the business records the law requires us to keep, such as records relating to work we were engaged to do.

We do not use your enquiry to market to you. You will not be added to a mailing list because you wrote to us, and there is no newsletter to be subscribed to by accident.

On what basis

Put plainly: we handle what you send because you sent it to us and asked for an answer — those are the steps taken at your request before there is any agreement between us. We keep the site running and defended because we have a genuine interest in it working, and you have no reasonable expectation that a public website is left undefended. Where a law obliges us to retain a record, that obligation is the reason we keep it.

If you are in the EEA or the UK, those three correspond to what your law calls steps prior to a contract, legitimate interests, and legal obligation. We do not rely on consent for any of it, because none of it is marketing — which also means there is no consent for you to withdraw and no box we quietly pre-ticked.

Who else handles it

We keep the list short on purpose. There is no database, no CRM and no marketing platform behind this site: an enquiry exists as an email in our inbox and nowhere else.

• Vercel — hosts the site and runs its server code. Sees the technical request data described above, and runs the page counter.
• Resend — sends us the notification email containing your enquiry.
• ImprovMX — forwards mail addressed to our domain into the inbox we read.
• Google (Gmail) — the inbox where the founders actually read your message.
• OpenRouter, and the AI provider it routes to (currently Anthropic) — only if you use the chat widget. What you type in the chat is sent to them to generate the reply. Do not put anything in the chat you would not want processed by an AI provider; the contact form and plain email do not go anywhere near it.
• Cloudflare (Turnstile) — the invisible spam check on the contact form and the chat. Your browser loads it from Cloudflare, so they see your IP address and browser details and run a short challenge on the page; the result is a one-time token we verify on our server. It sets no cookies on this site.

These providers act on our instructions and are not free to use your enquiry for their own purposes. We do not sell personal data, we do not rent it, and we do not share it with anyone for their own marketing.

Where it goes

The providers above are based mainly in the United States and operate globally, so your enquiry is handled outside Israel and outside the European Economic Area. Where that transfer needs a legal footing — for personal data coming from the EEA or the UK — we rely on the transfer terms and standard contractual clauses in those providers’ own data-processing agreements. If you would rather your details did not leave your region, write to us on paper or by phone instead and say so.

How long we keep it

• Enquiries: up to 24 months from our last exchange, then deleted — unless we need them longer for a legal or business record, or the enquiry turned into work we did for you.
• Records of actual engagements are kept for as long as tax, accounting and limitation periods require.
• Rate-limiting counters: sixty seconds, in memory. They do not survive a restart.
• Server logs are kept for the short period our hosting provider retains them, and are used for diagnosing faults and abuse.
• An enquiry that failed to reach us by email is written into those same server logs, in full, and is kept for the same short period. This happens only when the sending service is down at the moment you press send: without it your enquiry would exist nowhere, you would see an error, and we would never know you had written. It is the copy of last resort, we read it only to answer you, and it expires with the rest of the logs rather than being filed anywhere.

What you can ask us to do

Write to hello@forma-ltd.com and you can ask us to:

• Tell you what we hold about you, and give you a copy.
• Correct it if it is wrong.
• Delete it. If your enquiry did not become work, there is rarely a reason for us to refuse.
• Stop using it — object to what we are doing with it, or ask us to restrict it while a disagreement is sorted out.

We answer these ourselves, without a ticket queue, and we will not ask you to prove a legal right before we help. Depending on where you live these may be enforceable rights rather than courtesies; either way the answer is the same. If you think we have handled your data badly, tell us first — and if that gets you nowhere, you can complain to your data protection authority (in Israel, the Privacy Protection Authority; in the EEA or the UK, your national regulator).

How we look after it

• The site is served over HTTPS and submissions are validated and length-capped on the server, not just in your browser.
• There is no database to breach. Enquiries are not stored by the website at all — they are sent as email and read in an inbox.
• Only the founders read them. There is no shared support desk, no offshore team and no account-management layer.

No system is perfectly secure, and we will not pretend otherwise. If something goes wrong in a way that affects you, we will tell you rather than hope you do not notice.

Changes

If we add a tool that changes any of the above — analytics, a database, a CRM — this page is updated before that tool goes live, not after. The date at the bottom tells you when it was last reviewed.