Privacy Policy

1. What we collect

Form answers you type while filling a form; account data (email, or your name/email from Google if you sign in with Google); saved profile values you choose to reuse across forms (never SSNs/EINs — see §3); payment and verification status from Stripe (we never see or store card numbers or identity documents); and ordinary technical logs needed to operate the service.

2. How we use it

Solely to provide the service: filling your forms, saving your progress, autofilling values you've saved, processing payments, and preventing abuse. We do not sell personal information and do not use your form answers for advertising.

3. Sensitive identifiers (SSN, EIN, A-Number)

Identifiers are handled under a strict regime: they are collected via structured input, encrypted at rest, shown masked everywhere except on the completed form itself, never stored in your reusable profile, never sent to AI model providers, and redacted from chat history.

3a. Identifiers we never ask for

Omniform never asks for passwords to other services, full payment card numbers, or one-time security codes in chat. Anything that looks like a request for those is not from us.

4. Third parties that process data

Supabase (database, authentication, file storage); OpenAI (AI processing of chat messages and uploaded forms' field labels — API data is not used to train OpenAI's models; sensitive identifiers are excluded as described in §3); Stripe (payments and identity verification); Railway and Vercel (hosting). Each processes data only to provide its service to us.

5. Retention and deletion

Deletion by default: anonymous sessions are automatically purged after 30 days of inactivity (7 days after completion). Data tied to your account persists so your forms remain available — under your control: every form has a Delete action that permanently removes its answers, chat history, and generated documents, and deleting your account removes everything, immediately. You can export all of your data from the Account page at any time.

6. Security

Encryption in transit everywhere; sensitive values additionally encrypted at rest; database-level row isolation between accounts; and a written security program covering access control and breach response. No system is perfectly secure — minimizing what we keep (§5) is part of how we protect you.

7. Your rights

Access, export, correction, and deletion are built into the product (Profile and Account pages). Depending on where you live, you may have additional statutory rights; contact us and we will honor them. We do not discriminate against users who exercise privacy rights.

8. Children

The service is not directed to children under 13.

9. Changes and contact

Material changes will be posted here with a new date. Privacy questions or requests: contact Construct Systems LLC at me@willenglish.tech.