Start free

Legal

Privacy Policy

How Forma collects, uses, and protects your data and your customers' data.

Template — review with qualified legal counsel before launch.This page is placeholder boilerplate written for Forma's planned features. It has not been reviewed by a lawyer and must not be relied on as a binding legal document until reviewed and approved.Last updated 13 June 2026.

1. Who this policy covers

This policy describes how Forma Technologies ("Forma", "we") handles data for: (a) merchants who create an account and operate a store on Forma, and (b) customers who place orders on a Forma-powered storefront. Each merchant's store may also have its own customer-facing privacy policy describing how that merchant uses customer data — this policy covers Forma's handling of data as the platform provider.

2. Information we collect

Merchant account data

  • Name, business details, and phone number (used for one-time-passcode verification and magic-link sign-in via Better Auth).
  • Store configuration: products, inventory, theme choices, discount rules, and tax/GST settings.
  • Billing information processed by Stripe for the Starter subscription (Forma does not store full card numbers).
  • Files you upload — product images and other assets — stored via Cloudflare R2.
  • Payment gateway and shipping carrier credentials you provide for your store (e.g. JazzCash, EasyPaisa, TCS, Leopards, PostEx), encrypted at rest.

Customer data (storefront)

  • Order details: items purchased, delivery address, contact information, and payment method selected.
  • Optional customer account information, if a customer chooses to create one after checkout.

3. How we use this information

  • To provide, operate, and maintain the Forma platform.
  • To authenticate merchant accounts via phone OTP and magic link.
  • To process Starter subscription billing via Stripe.
  • To enable order fulfillment — e.g. passing order and address details to the payment gateways and shipping carriers a merchant has configured for their store.
  • To provide customer support and respond to inquiries.
  • To maintain the security and integrity of the Service, including detecting abuse.

4. Third parties we share data with

We share data with the following categories of service providers, only as necessary to operate the Service:

  • Stripe— processes Forma's subscription billing.
  • Cloudflare R2 — stores uploaded product images and other assets.
  • SMS provider — delivers one-time passcodes for phone-based authentication.
  • Payment gateways & shipping carriers— each merchant's configured providers (JazzCash, EasyPaisa, TCS, Leopards, PostEx, etc.) receive order data necessary to process payments and deliveries for that merchant's orders.

We do not sell personal data to third parties.

5. Cookies

Forma uses essential cookies to maintain merchant and customer sessions (via Better Auth) and to remember basic preferences. We do not currently use third-party advertising or tracking cookies.

6. Data retention

We retain account and order data for as long as your account or store is active, and for a reasonable period afterward to comply with tax, accounting, and legal obligations. If you close your account, we may retain certain records as required by Pakistani law.

7. Your rights

You may request access to, correction of, or deletion of your personal data by contacting us at hello@forma.pk. We will respond within a reasonable timeframe, subject to our legal and operational requirements (e.g. retaining transaction records for tax purposes).

8. Security

We use industry-standard measures to protect your data, including encryption of merchant payment/shipping credentials at rest and secure session management via Better Auth. No system is completely secure, and we cannot guarantee absolute security.

9. Children's privacy

Forma is intended for use by businesses and adults. We do not knowingly collect personal data from children under 18.

10. International data transfers

Some of our service providers (e.g. Stripe, Cloudflare) operate infrastructure outside Pakistan. Where data is transferred internationally, we rely on those providers' own safeguards and contractual protections.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated to active merchants via email or dashboard notice.

12. Contact

Questions about this Privacy Policy can be sent to hello@forma.pk.