Privacy Policy

Effective date: 28 July 2026

1. Controller

DAIARK SL is controller for personal data processed through Formak. Its registered office and registry details are in the Legal Notice. Contact: privacy@formak.app. No Data Protection Officer has been appointed because Formak has not determined that one is legally required.

Paddle.com Market Ltd is an independent controller for payment, billing, tax, fraud-prevention and buyer-support data. We do not receive full card details. See Paddle's Privacy Notice.

2. Data, purposes and legal bases

  • Account data: email, authentication identifiers, profile and session information. Used to create, authenticate and operate the account under the contract (Article 6(1)(b) GDPR).
  • Uploaded media and derived data: images/video of identifiable people, 3D skeletons, joint angles and metrics. Used to perform the analysis requested under the contract. This can be sensitive in context, but Formak does not use it to identify a person or infer health for medical purposes. Do not upload material unless you have authority and informed permission from everyone shown.
  • Usage and security data: credit grants, expiry and consumption events, IP address, user agent, request and anti-abuse information. Used to meter the service, prevent fraud and keep it secure under the contract, legal obligations and Daiark's legitimate interests (Article 6(1)(b), (c) and (f)).
  • Support data: messages and associated account/order details. Used to answer requests and manage the contract (Article 6(1)(b) and (f)).
  • Payment metadata: Paddle order, product, status and entitlement data. Used to fulfil purchases and keep accounting records (Article 6(1)(b) and (c)).

Formak does not use uploaded media to train or improve AI models and does not use it for advertising.

3. Recipients and providers

  • Supabase: authentication, account database and access-controlled service records.
  • Cloudflare: website hosting, content delivery, security, Turnstile anti-abuse checks and API connectivity.
  • Daiark's inference infrastructure: transient processing of submitted media and generation of motion outputs.
  • DeepSeek or MiniMax, when the report feature is requested: processing of numerical measurements and contextual report inputs to generate text. Raw uploaded images/video are not sent to these report providers.
  • Paddle: independent controller and Merchant of Record for checkout and payment.

We may also disclose data where legally required or necessary to establish, exercise or defend legal claims. The public site currently has no advertising or behavioural-analytics provider. Transactional authentication email is delivered through the configured authentication/email infrastructure; the provider list will be updated before any separate marketing-email service is enabled.

4. International transfers

Some providers may process data outside the EEA. Where Chapter V GDPR requires it, transfers rely on an adequacy decision, the European Commission's Standard Contractual Clauses with appropriate supplementary measures, or another lawful safeguard. Provider locations can change; contact privacy@formak.app for current transfer information relevant to your account.

5. Retention

  • Uploaded images: held in memory or temporary processing storage only for the requested analysis and not intentionally retained as a server-side media library.
  • Uploaded video: held in temporary server storage during the processing stream, normally deleted when that stream ends, and subject to a 24-hour hard deletion limit. A browser copy may remain in IndexedDB on the user's device until the user removes local Formak data.
  • Derived analyses: stored primarily on the user's device. Server-side job ownership, credit and security records do not contain the source video and are retained while needed to operate and secure the account.
  • Account data: while active, then deleted or anonymised within 30 days of a verified deletion request, except records that must be retained or blocked by law.
  • Transaction and credit-ledger records: for the legal limitation period and any longer tax/accounting period that applies, generally up to 6 years in Spain.
  • Security and operational logs: normally up to 90 days, unless needed longer to investigate an incident or legal claim.
  • Support correspondence: up to 3 years after the request closes, unless related to a transaction, dispute or legal obligation requiring longer retention.

6. Your rights

You may request access, rectification, erasure, restriction, portability or objection, and may withdraw consent where processing relies on it, by emailing privacy@formak.app. We may ask for information needed to verify identity. We normally respond within one month. You may complain to the Spanish Data Protection Agency (AEPD) or another competent supervisory authority.

Account deletion requests also remove or anonymise associated server-side account records subject to the exceptions above. Browser-held analyses, preferences and media are controlled on the device and should be removed through Formak's local delete controls or browser site-data settings.

7. Security and automated decisions

We use encryption in transit, access controls and account-level database isolation. No system can be guaranteed absolutely secure. Formak uses automated models to generate motion estimates and text reports, but does not make decisions producing legal or similarly significant effects about users.

8. Children

Accounts are for adults aged 18 or over. A user uploading footage of a minor must have authority and valid parent or guardian permission. Contact privacy@formak.app if a child's data may have been submitted improperly.

9. Browser storage and changes

See the Cookie and Storage Policy for cookies, localStorage, sessionStorage and IndexedDB. We may update this policy and will show a new effective date and notify users of material changes where appropriate.