1. Scope

This Privacy Policy applies to information collected through forml.ai (the "Site"), when you contact or otherwise interact with forml, and, where applicable, through forml's software and services (the "Services").

When a customer uses the Services and provides information to forml, including information relating to applicants, borrowers, business owners, employees, partners, or other individuals ("Customer Data"), forml generally processes that information on behalf of and pursuant to the instructions of that customer.

Our processing of Customer Data is governed by the applicable customer agreement, data processing terms, and other written instructions between forml and the customer. If those terms conflict with this Privacy Policy with respect to Customer Data, the applicable customer agreement controls.

Our customers are responsible for determining the purposes for which they collect and use Customer Data and for providing any notices and obtaining any permissions or consents required by applicable law.

2. Information We Collect

Information you provide directly. This may include your name, business email address, phone number, company, job title, correspondence with us, information submitted through the Site, and information you provide when requesting or participating in a demonstration or business discussion.

Technical and usage information. When you use our Site or Services, we may receive standard technical information such as IP address, browser and device information, timestamps, log information, authentication information, and information concerning use, performance, and security of our systems.

Customer Data. Customers may provide or permit the Services to access information needed to perform their configured workflows. Depending on the customer's use of the Services, Customer Data may include:

• identity and contact information;
• business ownership, formation, and registration information;
• financial, banking, transaction, and loan application information;
• identification documents, bank statements, tax documents, financial statements, contracts, and other files;
• credit, fraud, verification, compliance, public-record, or background information where authorized by the customer;
• communications and information contained in connected customer systems; and
• workflow results, assessments, decisions, audit records, and related information generated in providing the Services.

The categories of Customer Data processed for a particular customer depend on that customer's configuration, instructions, integrations, and use cases.

3. How We Use Information

We use information collected through the Site and our direct business interactions to:

• respond to inquiries and requests;
• schedule and conduct product demonstrations;
• communicate with customers and prospective customers;
• operate, maintain, support, and improve the Site and our business;
• authenticate users and administer accounts;
• detect, investigate, and prevent security incidents, fraud, misuse, and other harmful activity;
• comply with applicable law and enforce our agreements; and
• protect the rights, security, and property of forml, our customers, and others.

We process Customer Data only as necessary to provide, maintain, support, secure, and improve the Services for the applicable customer, as instructed or authorized by that customer, as permitted by the applicable customer agreement, or as required by law.

4. Customer Data and Financial-Institution Customers

forml operates as a technology service provider to financial institutions and other businesses.

With respect to Customer Data:

• we do not sell Customer Data;
• we do not use Customer Data for advertising or cross-context behavioral advertising;
• we do not use Customer Data for purposes unrelated to providing the Services to the applicable customer;
• we do not use one customer's Customer Data to train or improve models made available to or serving another customer; and
• access by forml personnel is limited to authorized personnel with a legitimate business need to provide, maintain, support, or secure the Services.

Where customer-specific learning or optimization is enabled, it is restricted to the applicable customer's environment and purposes.

forml does not independently establish a customer's credit policies, underwriting standards, eligibility requirements, or lending decisions and does not act as a lender or creditor. Where a customer configures the Services to perform automated assessment or decisioning, the Services execute the customer's own rules, policies, criteria, models, and instructions. The customer remains responsible for its credit policies, lending decisions, regulatory obligations, and use of outputs produced by the Services.

5. Artificial Intelligence and Model Use

forml develops and operates its own artificial intelligence, document intelligence, OCR, vision, and related models.

Customer Data is not provided to third-party generative AI providers for their independent model training or use.

By default, forml does not automatically use Customer Data to train or improve models. Any use of Customer Data for training or customer-specific optimization is opt-in only and occurs only with the applicable customer's affirmative authorization. forml does not use one customer's Customer Data to train or improve models made available to or serving another customer.

We may use service telemetry and aggregated operational metrics that do not identify a customer or individual to maintain, secure, and measure the performance of the Services.

6. How We Disclose Information

We do not sell personal information and do not disclose personal information for cross-context behavioral advertising.

Customers. Customer Data may be disclosed to or made available to the customer on whose behalf we process it.

Service providers. We may use service providers that support our infrastructure or business operations. Such providers may process information only as necessary to perform services for us and are subject to contractual confidentiality and data-protection requirements.

For Customer Data hosted by forml, our principal cloud infrastructure provider is Amazon Web Services ("AWS"). Certain customer workflows may also interact with data sources or third-party systems selected, authorized, or maintained by the customer, including credit bureaus, identity or business verification providers, government records, financial-data providers, customer CRMs, and other customer-authorized integrations.

Customer-directed integrations. We may transmit information to systems, services, or data providers at a customer's direction or through accounts maintained by that customer.

Legal and safety purposes. We may disclose information when required by applicable law, regulation, legal process, or governmental request, or when reasonably necessary to protect the rights, security, or property of forml, our customers, or others.

Corporate transactions. Information may be transferred in connection with a merger, financing, acquisition, reorganization, sale of assets, or similar corporate transaction, subject to applicable confidentiality and data-protection obligations.

At your direction. We may disclose information when you or the applicable customer instructs or authorizes us to do so.

7. Information Security

forml maintains administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of information we process.

Our security program includes, as appropriate:

• encryption of data in transit and at rest;
• controlled encryption-key management;
• logical separation of customer environments and data;
• role-based and least-privilege access controls;
• multi-factor authentication for internal systems;
• logging and monitoring of system and data access;
• vulnerability management, security testing, and third-party penetration testing;
• secure development and change-management practices;
• employee security and privacy training;
• incident-response procedures; and
• vendor risk-management controls.

Our information-security program is designed to align with the security obligations applicable to financial-services technology providers, including relevant requirements of the Gramm-Leach-Bliley Act ("GLBA") Safeguards Rule where applicable.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Security Incidents

forml maintains documented processes for identifying, investigating, responding to, and remediating security incidents.

If we determine that a security incident affects Customer Data, we will notify the applicable customer in accordance with applicable law and the applicable customer agreement and will provide information reasonably necessary for the customer to satisfy its own legal and regulatory obligations.

9. Data Retention and Deletion

We retain information collected through the Site for only as long as reasonably necessary for the purposes described in this Privacy Policy, to satisfy legal or contractual obligations, resolve disputes, and protect our systems and rights.

Customer Data is retained in accordance with the applicable customer agreement, the customer's configuration and instructions, and applicable law.

Customers may configure retention requirements appropriate to their deployment and may self-serve full deletion of their own Customer Data through the Services. Where required by the applicable agreement or customer instruction, forml will delete Customer Data or return it to the customer following termination of the Services.

Deletion from backup systems may occur according to established backup-retention and secure-deletion cycles.

10. Data Minimization and Access

We seek to process only the information reasonably necessary to provide the applicable Services.

Access to Customer Data by forml personnel is restricted according to role and legitimate business need and is subject to access controls, authentication requirements, logging, and internal security policies.

Customers may also deploy forml in environments or infrastructure controlled by the customer where agreed between forml and the customer.

11. Privacy Rights

Depending on your jurisdiction and the nature of your relationship with forml, applicable law may provide rights concerning your personal information, including rights to request access to, correction of, or deletion of certain personal information.

To submit a request concerning information that forml controls directly, contact us using the information below. We may take reasonable steps to verify your identity before processing a request.

If your information was provided to forml by or on behalf of a lender, bank, broker, financial institution, employer, or another forml customer, that organization generally controls the information. Requests concerning that information should be directed to the applicable organization. We will assist our customers in responding to privacy requests as required by applicable law and our agreements.

We will not discriminate against an individual for exercising rights provided by applicable privacy law.

12. California Privacy

To the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), applies to information processed by forml, we process Customer Data on behalf of our customers consistent with applicable service-provider or contractor requirements.

forml does not sell Customer Data and does not share Customer Data for cross-context behavioral advertising.

Where forml acts as a service provider or contractor to a customer, requests concerning Customer Data should be submitted to the applicable customer. For personal information that forml controls directly, California residents may exercise applicable rights by contacting us using the information below.

13. Financial Information

Certain information processed through the Services may constitute nonpublic personal information or other information protected by financial-services privacy laws.

Where forml processes such information on behalf of a financial institution, forml processes it pursuant to the applicable customer agreement and the customer's instructions and maintains safeguards designed to protect such information.

Nothing in this Privacy Policy modifies any more protective confidentiality, privacy, information-security, or data-use obligations contained in a customer agreement.

14. Cookies and Website Technologies

Our Site does not use cookies. We may receive standard technical information through server logs and similar operational technologies that are necessary or reasonably useful for operating, securing, and maintaining the Site.

We do not use information collected through the Site for cross-context behavioral advertising.

Certain third-party services embedded in or linked from the Site, such as scheduling services, may receive standard technical information when you interact with them and are governed by their own privacy policies.

15. International Processing

forml is based in the United States, and information processed by forml may be processed in the United States.

If a customer requires processing of personal information relating to individuals outside the United States, applicable data-processing and international-transfer requirements may be addressed in the applicable customer agreement or data processing addendum.

Where forml acts as a processor of personal data subject to the European Economic Area, United Kingdom, or other applicable data-protection laws, we process that data pursuant to our customer's instructions and applicable processor obligations.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our Services, legal requirements, or privacy practices.

When we update the policy, we will post the revised version on this page and update the effective date above. Where required by law, we will provide additional notice of material changes.

17. Contact Us

Questions about this Privacy Policy, privacy requests, or forml's privacy practices may be directed to:

forml, Inc.
55 E 3rd Ave
San Mateo, CA 94401
team@forml.ai

Website Terms of Use

Effective October 13, 2026

These Website Terms of Use (the "Terms") govern your access to and use of forml.ai and the content made available through it (the "Site"). By accessing or using the Site, you agree to these Terms. If you are using the Site on behalf of an organization, you represent that you have authority to bind that organization to these Terms.

1. The Site is separate from the Services

The Site provides information about forml and its products. Access to or use of the forml platform, APIs, software, integrations, implementation services, support, or other paid or enterprise services is governed by a separate written agreement with the applicable customer. These Terms do not modify any such agreement. If there is a conflict, the written customer agreement controls with respect to the Services.

2. No credit, legal, or financial advice

forml is a technology provider. Nothing on the Site is legal, regulatory, accounting, financial, investment, underwriting, or credit advice, and nothing on the Site is an offer, commitment, or solicitation to extend credit or provide a financial product. Product descriptions, examples, workflows, outputs, and other materials are illustrative and do not replace a customer's own policies, professional judgment, compliance obligations, or review where required.

3. Product information and results

We may describe product capabilities, customer outcomes, processing speeds, accuracy, efficiency improvements, funding outcomes, or other performance information. Unless expressly stated otherwise, such information reflects particular configurations, datasets, time periods, or customer deployments and is provided for illustration. Actual results may vary based on data quality, customer workflows, integrations, policies, implementation, usage, and other factors. Nothing on the Site is a guarantee of any particular result.

Product interfaces, screenshots, examples, borrower records, decisions, and other demonstrations may use fictional, anonymized, aggregated, or sample information and may not reflect every feature or current production configuration.

4. Permitted use

You may use the Site only for lawful business and informational purposes. You may not use the Site to violate law or third-party rights; interfere with or disrupt the Site; attempt to gain unauthorized access to systems or information; introduce malicious code; scrape or harvest information in a manner that materially burdens the Site; misrepresent your identity or affiliation; or use Site content to develop, train, benchmark, or market a competing product in a manner that infringes forml's intellectual property or other legal rights.

5. Intellectual property

The Site, including its software, design, text, graphics, logos, product names, trademarks, demonstrations, workflows, documentation, and other content, is owned by forml or its licensors and is protected by intellectual-property and other laws. Except for the limited right to access and use the Site under these Terms, no rights are granted to you by implication, estoppel, or otherwise.

If you provide feedback, suggestions, or ideas about forml's products or Services, you permit us to use them without restriction or obligation to you, provided that this does not give us any right to Customer Data, customer confidential information, or customer-owned credit policies or decision criteria.

6. Submissions and confidentiality

Please do not submit borrower files, consumer financial information, credentials, production data, or other sensitive information through public Site forms or ordinary email unless forml has specifically instructed you to do so through an approved channel. Information submitted through a general inquiry or demo request is not treated as confidential unless it is protected by a separate written agreement or applicable law.

7. Third-party services and links

The Site may contain links to, embed resources from, or interoperate with third-party websites and services. forml does not control and is not responsible for third-party services, content, availability, security, or privacy practices. Your use of third-party services is governed by the applicable third party's terms.

8. Disclaimer of warranties

TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SITE AND ALL CONTENT AVAILABLE THROUGH IT ARE PROVIDED "AS IS" AND "AS AVAILABLE." FORML DISCLAIMS ALL WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, AND UNINTERRUPTED OR ERROR-FREE OPERATION. FORML DOES NOT WARRANT THAT THE SITE WILL BE FREE OF VULNERABILITIES, MALICIOUS CODE, OR OTHER HARMFUL COMPONENTS.

9. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, FORML AND ITS AFFILIATES, OFFICERS, DIRECTORS, EMPLOYEES, AND AGENTS WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, BUSINESS, DATA, OR GOODWILL, ARISING FROM OR RELATING TO THE SITE OR THESE TERMS, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. TO THE MAXIMUM EXTENT PERMITTED BY LAW, FORML'S TOTAL LIABILITY ARISING FROM OR RELATING TO THE SITE OR THESE TERMS WILL NOT EXCEED ONE HUNDRED U.S. DOLLARS ($100).

These limitations apply only to the Site and these Terms. Liability relating to the Services is governed by the applicable written customer agreement.

10. Changes, suspension, and availability

We may modify, suspend, or discontinue all or part of the Site, and may update these Terms, from time to time. Updated Terms are effective when posted unless a later date is stated. Your continued use of the Site after updated Terms become effective constitutes acceptance of the updated Terms.

11. Miscellaneous

If any provision of these Terms is found unenforceable, the remaining provisions will remain in effect. A failure to enforce a provision is not a waiver. You may not assign rights or obligations under these Terms without our prior written consent; forml may assign these Terms in connection with a merger, acquisition, reorganization, or sale of all or substantially all of its relevant assets or business. These Terms, together with the Privacy Policy above, constitute the entire agreement between you and forml regarding use of the Site, except to the extent a separate written agreement applies.

12. Contact

Questions about these Terms may be sent to team@forml.ai.