Forma Privacy Policy
Effective 2026-10-05 · 한국어
1. Scope and contact
This policy covers sign-in, cover creation, storage, payment, and support in Forma, provided by Goyo (고요). To access, correct, delete, or restrict processing of your personal data, or for any privacy question, contact support@sleite.com. The Sleite homepage has a separate policy.
2. What we process and why
From Google sign-in we receive an account identifier, your verified email address, and display name to authenticate you and confirm ownership of your work. We never receive your Google password. We process the descriptions, reference images, generated images, titles and author names, project settings, job status, and credit usage you create, to generate, edit, store, and restore your work and to handle errors. Request data, IP addresses, security logs, and session cookies are used to provide and secure the service. If you contact us, we process your email address and message.
3. Third-party services
Google provides sign-in. When you request a generation or edit, the text, reference images, or image and mask needed for that job are sent to the OpenAI API; reference images may be downscaled before sending. We use AWS servers and Cloudflare network and storage services. When you subscribe, Paddle, as the merchant of record, processes payment, tax, receipt, and refund information, and Forma receives transaction and subscription identifiers, status, billing periods, and credit grant records to manage your access. Full card numbers and security codes are never stored on Forma's servers. Each provider's own privacy policy applies to its processing, and data may be processed outside your country through global infrastructure.
4. Retention and deletion
Accounts, projects, images, and usage records are kept while we provide the service. Covers you delete in the app can be restored for 30 days. You can request account deletion in account settings or by contacting us; we aim to complete verified requests within 7 days. Payment and dispute records required by law may be retained separately as needed. Disaster-recovery backups are kept for 14 days, and confirmed deletion requests are re-applied if a backup is restored.
5. Your choices
Reference images are optional. Do not submit sensitive information or other people's personal data that the generation does not need. You can revoke the Google connection in your Google account settings, but that does not automatically delete data already stored. Projects are not shared publicly by default; access is limited by authentication and ownership checks. We will announce material changes to this policy together with a new effective date.
Provider policies: Google · OpenAI · AWS · Cloudflare · Paddle