Formless Privacy Policy

Last Updated: August 7, 2026

Effective Date: August 7, 2026

I. Introduction

FORMLESS BASICS PTE. LTD. including their respective parents, subsidiaries, and affiliates (collectively, “Formless”, “we”, “us”, or “our”) respects your privacy regarding any information we may collect in the course of providing products and services (“Services”) to you through our Formless application (the “APP”).

We are a Singaporean company, with our registered office at 91 BENCOOLEN STREET, #12-03, SUNSHINE PLAZA, SINGAPORE 189652.

This Privacy Policy applies to users of our APP in the United States. It describes the types of personal data we collect, how we use and share it, the data rights you have, and how you can contact us about our privacy practices. This Privacy Policy is intended to comply with applicable U.S. federal and state privacy laws, including the California Consumer Privacy Act of 2018 (“CCPA”), as amended by the California Privacy Rights Act of 2020 (“CPRA”).

II. Updates to this Privacy Policy

We may update this Privacy Policy from time to time to ensure compliance with all applicable laws and to reflect any changes in our collection, processing, and/or retention of personal data. When we make material changes, we will notify you by posting the updated Privacy Policy on our APP and updating the “Last Updated” date at the bottom of this Privacy Policy. We encourage you to review this Privacy Policy periodically.

III. What Personal Data Do We Collect and How We Process Your Personal Data

We may directly or indirectly collect personal data when you use our Services, or when you interact with us. Your personal data with us is obtained from various sources. This includes: (a) data provided by you or sources authorized by you, such as our affiliates or partners; (b) information generated through your use of our Services; (c) information obtained from legally and publicly available sources.

Our APP offers a guest mode that allows limited access without registration. In guest mode, we may collect your device-level information (such as device ID, device model, operating system version, and network connection type) and voice data when you have a dialogue through the Services. To access full functionality, you will need to create an account, at which point additional information described below will be collected.

The processing of personal data includes the following:

Ÿ Account Registration and Login. To create and manage your account and verify your identity, we may collect account registration and login information depending on the authentication method you choose, including your phone number, email address, or information provided by third-party login providers (such as Google or Apple), such as your account ID, email address, name, profile information, and authentication credentials. We use this information to create and maintain your account, verify your identity, and enable you to access our services.

Ÿ Invitation Code and Age Verification. To administer invitation-based access, we may collect your invitation code, which is only bound to your account when it is redeemed. To confirm that you meet the minimum age requirement to use the Services under the applicable laws, we may collect your date of birth.

Ÿ Account Personalization. To provide a personalized experience, we may collect your preference settings you select within the APP, such as your chosen language, tone, avatar, and nickname.

Ÿ AI Interactive Dialogue. To provide our core AI-powered interactive services, we collect the content you input through text or voice when interacting with our AI. Your voice input is processed through automatic speech recognition (ASR) services to convert speech to text and is not used for biometric identification purposes. The original audio is processed in transit only and is not stored.

Ÿ User Feedback and Complaint Handling. To receive and respond to your feedback, complaints, and service improvement suggestions, we may collect the text content you submit.

Ÿ Language, Voice, and Avatar Switching. To allow you to customize the language, voice style, and AI avatar used during your interactions, we may collect the selections you make within the APP.

Ÿ Safety and Compliance Review. To maintain a safe and compliant platform, we may review the content of interactions between you and our AI (including both your inputs and AI-generated outputs) for safety, content moderation, and regulatory compliance purposes.

Ÿ Account Deletion. To process your account deletion request, we may collect the email address or phone number associated with your account to verify your identity.

Ÿ Marketing and Promotional Communications. You acknowledge and agree that we may send you marketing and promotional communications. For this purpose, we may collect your  phone number or email address.

Ÿ Security Operations: To perform tasks such as identifying business interface devices, correlating login states, conducting behavior analysis, eliminating duplicate events, diagnosing crashes, and monitoring performance, we may collect your device and network information, including device model, device manufacturer and type, operating system version, language settings, time zone, network connection type, application version and build number, platform, application package identifier (Bundle ID / Package Name), a login user ID, a locally generated device identifier, Firebase Installation ID, Crashlytics Installation UUID, screen resolution, and IP address. Based on your IP address, we may also infer your approximate location (such as country or region) for analytics and security.

We may use automated decision-making, including profiling, in connection with our Services. To recommend content tailored to your interests and preferences, we process your behavioral data, including content and topic identifiers, swipes, clicks, and your text and voice input operations. Please note that we implement technical measures such as data minimization and pseudonymization to protect your personal data during such processing.

IV. How Do We Keep Your Personal Data

The retention period of personal data collected by us shall be the shortest time necessary to realize the purpose specified herein, unless a longer retention period is required by laws and regulations. Your personal data will be deleted or anonymized after the aforementioned retention period expires. More specifically:

Ÿ Account-related information (including registration and login data, personalization settings and behavioral records, content recommendation data, and feedback and complaint data): except as set forth above, retained on a long-term basis.

Ÿ Account deletion: upon submission of an account deletion request, your account will be maintained for thirty (30) days during which you may withdraw the request. After the 30-day period, your personal information will be deleted from our active systems. The deletion covers the personal data and behavioral records associated with the cancelled account.

Ÿ Third-party service provider data: Personal information transmitted to our automatic speech recognition (ASR) provider is processed in transit only. The original audio is not stored.For real-time communication services, your voice data and audio synthesized by TTS are transmitted in transit only and are not persistently stored.

Ÿ System logs and backups: system logs and data backups are retained for thirty (30) days.

V. Who Will We Share Your Personal Data With

We may share your personal data inside the company if it is necessary to provide services in a timely manner. We may share your personal data with the following categories of recipients:

1. Formless Affiliates and Subsidiaries

Access to your personal data may be provided to staff of Formless affiliates and subsidiaries. Such staff abide by statutory confidentiality obligations and, where required, additional confidentiality agreements.

2. AI Model and Cloud Service Providers

We use third-party service providers to deliver our core AI-powered services. These include AI model providers (for AI dialogue generation), automatic speech recognition (ASR) providers (for converting your voice input to text), text-to-speech (TTS) providers (for converting AI-generated text to audio), and real-time communication (RTC) providers (for audio/video transmission). We share only the minimum information necessary for these providers to perform their functions, and they are contractually prohibited from using your personal information for any purpose other than providing services on our behalf.

3. Other Service Providers

We may engage external service providers such as IT infrastructure providers, customer service providers, and other advisors working on our behalf. We carefully select and regularly monitor these providers, particularly with respect to their handling and safeguarding of personal information.

4. Law Enforcement and Government Authorities

To fulfil our legal obligations, we may be required to disclose information in response to subpoenas, court orders, or lawful requests from government authorities conducting investigations.

VI. International personal data transfers

Formless is a global business, and your personal data may be transferred to, and processed in, countries other than the country in which you are a resident. These countries may have different privacy and data protection laws to your country of residence.

Specifically, our APP servers and key systems are located in the United States, and our subsidiaries and affiliated companies and third-party service providers and partners operate around the world. This means that when we collect your personal data, we may process it in any of these countries. However, we have adopted appropriate safeguards to ensure that your personal data will remain protected in accordance with this Privacy Policy and our contractual commitments.

VII. Security

We use appropriate technical and organizational measures, including anti-virus software and encryption, to protect the personal data that we collect and process about you. The measures we use are designed to provide a level of security appropriate to the risk of collecting and processing your personal data.

Please note that while we have taken reasonable steps to protect your personal data, no website, Internet transmission, computer system, or wireless connection is secure. In the event of a personal data security incident, we will, in accordance with the requirements of applicable laws and regulations, promptly inform you of the following: the basic situation and possible impact of the security incident, disposal measures we have taken or will take, suggestions for your self-protection and risk mitigation, remedies for you, etc. We will timely inform you of the relevant situation of the event by email, letter, telephone, or push notification. When it is difficult to inform the personal data subjects individually, we will issue an announcement in a reasonable and effective manner. Meanwhile, we will also actively report the handling of the personal data security incident in accordance with the requirements of the regulatory authorities.

VIII. Marketing communications

We may send marketing communications to our users, including newsletters, emails, or promotional offers related to our Services. You can opt out the marketing communications at any time by following the instructions provided in such communications or by contacting us through the methods specified in this Privacy Policy. .

Aside from Marketing Communication, please note that from time to time, you may receive some important service information that we believe is critical to the use of our Services. If you send us a request (e.g., via support email or via our feedback mechanisms), we reserve the right to publish it to help us clarify or respond to your request or to help us support other users.

IX. Third-party service providers and their services

Our APP may contain links to third-party websites, products, and services. You can choose whether to visit or accept websites, products, and services offered by third parties. We have no control over third-party privacy and data protection policies as such third parties are not bound by this Privacy Policy. Before you submit personal data to third parties, please refer to their respective privacy policies.

X. Artificial Intelligence

Our APP uses artificial intelligence technology to generate video content and provide interactive dialogue services. We want you to be aware of the following:

Ÿ AI-Generated Content. Content provided through the APP, including video content and dialogue responses, is generated by artificial intelligence and may not always be accurate, complete, or up to date. AI-generated content does not represent the views or opinions of Formless and should not be relied upon as professional, legal, medical, financial, or other expert advice.

Ÿ AI Model. Our AI services are powered by a third-party AI model (Qwen). Your interaction content is transmitted to the model provider via API for processing. The prompt, context, and output data processed through the API are stored by the provider in its North America region . Automatic speech recognition is provided separately by BytePlus, which processes your audio in transit only and does not store the original audio.

Ÿ No Model Training on User Data. We do not use your personal information or interaction content to train or improve AI models. Our third-party AI service providers are contractually restricted from using your personal information for model training purposes, unless explicitly disclosed to you. While we do not use your data to train AI models, your inputs and the AI-generated outputs may be subject to access-controlled review and safety audit for content-safety and compliance purposes.  

Ÿ Content Safety. As required by the applicable laws and regulations, both your inputs and AI-generated outputs are subject to safety and compliance review to prevent the generation or dissemination of harmful, illegal, or otherwise objectionable content.

XI. Your Rights to Your Personal Data

We respect your rights to your Personal data. To the extent provided by applicable data protection laws, you may have the following right(s), including:

l Right to know/be informed as to the personal data or categories of personal data we have about you.

l Right to access a copy of the personal data we have about you.

l Right to correct/rectify inaccurate personal data that we have about you.

l Right to delete/erase personal data about you.

l Right to opt-out of sale or sharing of personal data to third parties.

l Right to restrict sensitive personal data - to limit the use and disclosure or to opt-out.

l Right of non-discrimination, because of your exercise of data protection rights.

To exercise any of the rights listed above, please contact us through the information set out in Section XIII below. We will verify your identity before processing your request. You may also designate an authorized agent to submit a request on your behalf by providing the agent with written permission and verifying your identity directly with us. Generally, we provide responses to the exercise of your rights free of charge. However, we may need to charge a reasonable fee if the request is manifestly unfounded or excessive, or if necessary and unavoidable costs are incurred. We will ensure the security of your personal data when you exercise the rights.

XII. Children

Formless Services are not directed to children. You must be at least 18 years of age, or the minimum age required to provide valid consent to the use of the Services under applicable law in your jurisdiction, whichever is higher. If you do not meet this requirement, you must not access or use the Services.

We do not knowingly collect, use, sell, share or disclose the personal data of children. If we discover that a child under the age of 13 has provided personal information to us, or that a user under the age of 18 has created an account in violation of our terms, we will take prompt steps to delete the personal information collected and terminate the account. If you have reason to believe that a child has provided personal information to Formless, please contact us at contact@formless.com.ai.

XIII. Contact us

If you wish to exercise your privacy rights listed in Section XI, or have any concerns or questions about this Privacy Policy or our data practices, please contact us at:

Email: contact@formless.com.ai

Tel: +6582201354

XIV. Additional Disclosures for California Residents

The following additional disclosures apply where Formless is subject to the requirements of the CCPA, as amended by the CPRA, and the California Consumer Privacy Act Regulations (“CCPR”). These disclosures supplement the information provided in the preceding sections of this Privacy Policy.

A. Collection of Personal Data within the Last Twelve (12) Months

We have collected the following personal data from your using our Services within the last twelve (12) months.

B. Personal Data that has been Sold or Shared within the Last 12 Months

We have not sold or shared (as those terms are defined under the CCPA) any personal information of consumers within the last twelve (12) months.

C. Personal Data that has been Disclosed for a Business Purpose within the Last 12 Months

We have disclosed the following categories of personal information to third-party service providers for business purposes within the last twelve (12) months: