1. INTRODUCTION
This Privacy Policy explains how ReadyForm B.V. ("ReadyForm", "we", "us", or "our") collects, uses, discloses, retains, and protects personal data in connection with the ReadyForm platform, website, applications, and related services (collectively, the "Service").
We know that our Service involves processing video and audio material that can include images of your face, recordings of your voice, and other personal and sensitive information. We have written this Policy to explain, as clearly and completely as possible, what we do with that information and why, and what choices and rights you have in relation to it.
This Policy explains our processing and is not a request for blanket consent. We rely on the specific legal bases described below and request consent separately where needed. Read it together with the Terms of Service, Cookie Policy, and DPA.
2. WHO WE ARE
ReadyForm B.V. is a private limited company incorporated under the laws of the Netherlands, registered with the Dutch Chamber of Commerce (KVK) under number 42123086, establishment number 000066269970, RSIN 869832281, VAT identification number NL869832281B01, with its business correspondence address at Newtonlaan 115, 3584 BH Utrecht, the Netherlands.
For the purposes of the General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR") and other applicable data protection law, ReadyForm acts as the data controller for the personal data described in this Policy, except where we act as a processor on behalf of our customers in respect of Material uploaded to the Service, as described in Section 3.2 and in our DPA.
You can contact us regarding any privacy matter at legal@readyform.ai, or by post at the address above.
3. SCOPE OF THIS POLICY
3.1 What This Policy Covers
This Policy applies to personal data we process in connection with: (a) your use of the Service as a registered account holder or authorised user of an account; (b) your visit to our website, whether or not you create an account; (c) your communications with us, including support requests, sales enquiries, and marketing interactions; and (d) any other interaction you have with ReadyForm that links to this Policy.
3.2 Controller and Processor Roles
Where you upload video, audio, images, or other material to the Service that contains personal data, including your own, for example footage of colleagues, interview subjects, clients, or members of the public, we process that personal data as a processor on behalf of the ReadyForm account holder, under the terms of the DPA, and not as a controller under this Policy. The account holder determines the purposes and means of that processing, and remains responsible for ensuring it has a lawful basis to upload and process that material, as set out in our Terms of Service. If you are such an individual and have questions about how your data is being used, you should in the first instance contact the organisation or person whose ReadyForm account was used to upload that material.
3.3 Who This Policy Applies To
This Policy applies to: (a) our customers and their authorised users; (b) prospective customers who interact with our marketing or sales activities; (c) visitors to our website; and (d) other individuals who contact us, such as job applicants or business contacts, to the extent relevant.
3.4 If You Are Located Outside the EEA or UK
This Policy is written to reflect the standards of the GDPR. If you are located outside the European Economic Area or the United Kingdom, and the law of your country of residence grants you additional or different privacy rights (for example, under the CCPA in California or the LGPD in Brazil), we will honour those rights on request to the extent they apply to our processing of your personal data, even though this Policy does not separately restate every such law in full. You can make such a request using the contact details in Section 22.
4. PERSONAL DATA WE COLLECT
4.1 Information You Provide Directly
We collect the following categories of personal data directly from you when you use the Service:
Account and identity data: your name, email address, password (stored only in hashed, non-reversible form), company name, job title, and language or regional preferences, when you register for an account or update your profile.
Billing and financial data: your billing address, VAT number, and payment method details, in connection with your subscription. Payments are processed for us by Stripe, Inc. ("Stripe"), our payment processor. Stripe collects and stores your full payment card or bank details directly; we do not store full card numbers on our own systems, and we only receive limited information from Stripe necessary to administer your subscription, such as confirmation of payment, the last four digits of your card, and its expiry date.
Communications and support data: the content of any message, ticket, or correspondence you send us, for example when you contact legal@readyform.ai with a question, complaint, feature request, or cancellation request, together with any attachments or account information you provide to help us resolve your request.
Source material: the video, audio, images, scripts, and text you upload to the Service for processing ("Material"), and the resulting edited video or other content generated by the Service ("Output"). Where your Material contains images or recordings of identifiable individuals, including yourself, it may include their faces, voices, spoken statements, and any other information visible or audible within that Material.
Marketing and communication preferences: your choices regarding newsletters, product updates, and other marketing communications, and any information you provide when responding to a survey, webinar registration, or similar marketing activity.
4.2 Information We Collect Automatically
When you use the Service or visit our website, we and our service providers automatically collect the following categories of information:
Log data: your Internet Protocol (IP) address, browser type and version, operating system, referring and exit pages, the date, time, and duration of your use of the Service, and the specific pages, buttons, links, and forms you interact with.
Device and usage data: the type of device you use, unique device identifiers, mobile carrier or Internet service provider, and information about how you navigate and interact with the Service, including which features you use and how frequently ("Usage Data"). We use Usage Data to understand how the Service is used, to improve it, and to diagnose technical issues.
Approximate location data: your general geographic location, inferred from your IP address, used for purposes such as fraud prevention, localisation of pricing or language, and understanding our user base at a country or regional level. We do not collect precise device-level location data (such as GPS coordinates) unless you separately and explicitly enable a feature that requires it.
Cookies and similar technologies: as described in Section 12 (Cookies and Similar Technologies).
4.3 Information We Collect From Other Sources and Third Parties
We also obtain personal data about you from the following sources, which we may combine with information described in Sections 4.1 and 4.2:
Single sign-on providers: if you register or log in using a third-party identity provider, such as Google, we receive basic profile information from that provider, such as your name and email address, together with a token used to authenticate you. We do not receive or store your password for that third-party account.
Payment providers: Stripe may provide us with limited information confirming your identity, transaction status, and fraud risk indicators, in connection with processing your payments.
Marketing and advertising platforms: where you interact with our advertising on third-party platforms (for example, by clicking an advertisement that leads you to sign up), we may receive limited information from that platform confirming the interaction, subject to your privacy settings on that platform and the platform's own privacy notice.
Publicly available sources: we may supplement business contact information, such as a company name or role, from publicly available professional sources, for example to correct or update details for an existing business customer relationship.
5. HOW WE USE YOUR PERSONAL DATA
We use personal data for the purposes, and on the legal bases under the GDPR, described below. Where a purpose relies on "legitimate interest", we have considered and balanced that interest against your rights and freedoms before relying on it, and you have the right to object as described in Section 16.
(a) Providing and operating the Service, including creating and maintaining your account, hosting, analysing, transcribing, editing, and exporting your Material, delivering Output, and providing customer support. Legal basis: performance of a contract with you (Article 6(1)(b) GDPR). Where Material you upload contains personal data of other individuals, the applicable legal basis for that underlying data is determined by you as controller of that data, subject to the DPA.
(b) Billing, invoicing, and subscription administration, including calculating and collecting fees via Stripe, applying taxes, and managing renewals, upgrades, downgrades, and cancellations. Legal basis: performance of a contract (Article 6(1)(b)) and compliance with legal obligations, including Dutch tax and accounting law (Article 6(1)(c)).
(c) Customer communications, including responding to support requests, sending service notifications (such as billing reminders or security alerts), and administering your account. Legal basis: performance of a contract (Article 6(1)(b)) and our legitimate interest in maintaining an effective support and communication process (Article 6(1)(f)).
(d) Security, fraud, and abuse prevention, including detecting and investigating unauthorised access, suspicious activity, payment fraud, or misuse of Credits or other features. Legal basis: legitimate interest in protecting the Service, our users, and our business (Article 6(1)(f)).
(e) Service improvement, analytics, and product development, including understanding usage patterns, diagnosing and fixing technical issues, and developing new features, using data that is aggregated or pseudonymised wherever reasonably possible. Legal basis: legitimate interest in developing and improving the Service (Article 6(1)(f)) where consent is not required; consent (Article 6(1)(a)) for non-essential cookie analytics.
(f) Direct marketing, including newsletters, product announcements, and promotional offers. Legal basis: consent (Article 6(1)(a)), which you may withdraw at any time as described in Section 18.
(g) Marketing use of your Material, Output, name, or logo, including in case studies, testimonials, and advertising, only after your separate, affirmative, documented prior opt-in under Section 12.2 of our Terms of Service. Uploading content, accepting the Terms, or remaining silent is not promotional permission. Legal basis: consent (Article 6(1)(a)) for promotional processing of personal data under this opt-in arrangement. Customer authorisation and the necessary permissions and legal basis for each affected individual must be established before publication; a customer cannot give consent on behalf of recorded individuals without authority. The limits in Section 12.2 of the Terms and the DPA apply. Consent may be refused or withdrawn without affecting the Service. Withdrawal does not affect the lawfulness of earlier processing, but we do not continue publication on the withdrawn consent.
(h) Legal compliance and defence of legal claims, including responding to lawful requests from courts, regulators, or law enforcement, and establishing, exercising, or defending legal claims. Legal basis: compliance with a legal obligation (Article 6(1)(c)) or legitimate interest in protecting our legal position (Article 6(1)(f)).
We may also aggregate or de-identify personal data such that it can no longer reasonably be used to identify you. Once data has been fully and irreversibly de-identified, we may use it for any reasonable business purpose, including research, benchmarking, and marketing, without further restriction under this Policy.
6. FACES, VOICES, AND SPECIAL CATEGORY DATA
6.1 What This Section Covers
Because the Service processes video and audio material, it may involve images of faces, recordings of voices, and other personal characteristics belonging to you or to other individuals appearing in your Material. This Section explains how we treat that information.
6.2 Current Video and Audio Analysis
ReadyForm transcribes the audio of your videos using Speechmatics, processed in its EU region; only the audio track is sent (no video frames), together with a word list derived from the script and brand terms you provide. Where Speechmatics is unavailable, transcription falls back to Whisper running on ReadyForm-controlled infrastructure. Interview-mode processing includes speaker diarisation using pyannote, grouping speech segments by speaker within a video. Reframing uses YuNet face detection to locate faces and position a crop. These operations involve audio/visual features and derived speaker or face-location information. They are current editing functions, not merely planned future features.
These functions are used to organise and frame content for editing; they are not described as account authentication or identification against an external identity database. Face images, voices, transcripts, and derived features may be personal data. Technical biometric data and the special-category restriction in Article 9 GDPR are distinct questions: classification depends on the actual processing and whether it enables or is used for unique identification or confirmation of identity. This Policy does not categorically exempt speaker diarisation or face analysis from biometric-data requirements.
6.3 Biometric and Special-Category Safeguards
Where the processing involves biometric data for uniquely identifying a person, an applicable Article 9 condition must be established in addition to an Article 6 legal basis, and the necessary information and safeguards must be provided. Customer-content processing is performed on the customer's instructions under the DPA. Customers must ensure their authority and applicable legal bases, and notify ReadyForm in advance of special-category processing under Section 2.5 of the DPA. A customer account agreement does not automatically constitute explicit consent from recorded speakers or people appearing in footage. Material can reveal other special-category data regardless of biometric analysis.
If a new identification or authentication purpose is introduced, we will explain it before use and establish the required legal basis and safeguards. The legal classification depends on the implemented models, derived features, retention, and purpose. Describing a feature as an editing tool does not itself remove applicable biometric-data obligations.
6.4 Other Special Category Data
Our Terms of Service require that you do not upload Material containing special category personal data (such as data revealing health conditions, racial or ethnic origin, religious beliefs, or sexual orientation) unless you have an independent, lawful basis for doing so and have notified ReadyForm in advance and arranged any necessary safeguards under Section 2.5 of the DPA. Where such data is nonetheless present in Material you upload, we process it as a processor on your behalf, and you remain responsible, as controller, for ensuring a valid legal basis exists for that processing.
7. AUTOMATED PROCESSING AND ARTIFICIAL INTELLIGENCE
The Service uses automated processing, including artificial intelligence, to analyse your Material and produce Output, such as cutting footage, generating subtitles, creating B-roll, and adjusting pacing.
This automated processing supports the creative and editing functionality of the Service; it does not produce decisions that have a legal effect on you or similarly significantly affect you within the meaning of Article 22 GDPR. All Output remains subject to your own review, editing, and approval before publication, as described in our Terms of Service. We do not use the Service to make automated decisions about you personally, such as decisions regarding pricing, account status, or eligibility, without human involvement, except where necessary to detect and prevent fraud or abuse, in which case any resulting suspension may be reviewed by contacting us at legal@readyform.ai.
8. HOW WE DISCLOSE PERSONAL DATA
We disclose personal data only in the circumstances described below. We do not sell personal data, and we do not disclose your Material or Output to third parties for their own independent marketing or model-training purposes.
8.1 Subprocessors and Service Providers
We use specialist providers for the following functions:
- Hetzner: storage of customer source videos, exports, and related processing files.
- RunPod: GPU video processing and rendering, which can involve customer video/audio and temporary processing files.
- Speechmatics: transcription of the audio track of customer videos, processed in its EU region; transcription jobs are deleted immediately after retrieval and in any event within 7 days.
- Vercel: website/app hosting and execution; the configured application execution region is Frankfurt (fra1).
- Supabase: database and authentication; the configured primary project region is Frankfurt. Customer video-object storage is provided by Hetzner rather than described as Supabase video storage.
- Anthropic: transcript-text analysis and selection using Pexels stock-image previews; no customer video/audio or customer-footage previews are sent to Anthropic.
- Resend: service emails and delivery records.
- Sentry: error reporting and diagnostics.
- Upstash: rate limiting and related technical request/security information.
- PostHog: consent-based product analytics and session replay in the app, as described in Sections 12 and 13.
- FirstPromoter: website affiliate attribution and associated referral/conversion records, subject to the Cookie Policy.
- Stripe: billing, subscription management, and payments, including the independent-controller activities described in Section 9.
- Pexels: supply of stock media used as AI-selected B-roll.
- Google: user-requested Drive imports, with the permissions and selected-file access authorised by the user.
Provider roles depend on the activity. Providers processing customer content on our behalf are subject to the DPA and its Annex III; providers processing ReadyForm's own account, communication, security, analytics, or affiliate records are governed by this Policy. Pexels stock supply and Google's independent operation of a user's Drive account are not automatically customer-content subprocessing. Not every provider receives the same information or a complete customer video.
Our configured Frankfurt execution/database regions do not mean all providers, logs, support access, backups, or GPU workloads are confined to Germany or the EEA. Section 11 describes international-transfer safeguards. When appointing a new subprocessor for customer content, we provide the notice and objection procedure in Section 6 of the DPA.
8.2 Within ReadyForm
We may share personal data internally among ReadyForm personnel and, where applicable, affiliated companies, to the extent necessary to provide the Service, provide support, and operate our business, subject to appropriate confidentiality obligations.
8.3 Professional Advisors
We may disclose personal data to our legal, tax, financial, insurance, or other professional advisors, where necessary for the services they provide to us.
8.4 Legal and Regulatory Disclosures
We may disclose personal data where we believe in good faith that disclosure is necessary to: comply with a legal obligation, court order, or valid legal process; respond to a lawful request from a public or government authority; protect the rights, property, or safety of ReadyForm, our users, or the public; or establish, exercise, or defend legal claims.
8.5 Business Transfers
If we are involved in a merger, acquisition, reorganisation, financing, or sale of all or part of our business or assets, personal data may be disclosed to the parties involved in that transaction and transferred as part of it, subject to appropriate confidentiality protections and, where required, prior notice to you.
8.6 With Your Consent
We may disclose personal data to other third parties where you have given your specific consent for us to do so.
9. PAYMENT PROCESSING VIA STRIPE
Subscription payments are processed by Stripe, Inc., a payment services provider. When you subscribe to a paid Plan, you will be directed to provide your payment details directly to Stripe through its secure payment interface. Stripe acts as our processor for this purpose and, in certain respects such as fraud prevention and compliance with payment network rules, may also act as an independent controller of your payment data under its own privacy notice, available at stripe.com/privacy.
We receive from Stripe only the limited information necessary to administer your subscription, such as confirmation that payment was successful, the subscription plan and amount charged, and partial card details (such as the last four digits and expiry date) for your reference. We do not have access to, and do not store, your full card number, CVC code, or online banking credentials.
10. THIRD-PARTY AI SERVICES
Anthropic receives transcript text and previews of Pexels stock imagery for text-based analysis and stock selection. Customer video files, customer audio files, and previews extracted from customer footage are not sent to Anthropic. Transcripts can still identify people, contain their spoken statements, or reveal sensitive information; transmitting text is therefore not the same as transmitting no personal data.
Transcription is performed by Speechmatics, which receives the audio track of your videos (not the video frames) and a word list from your script and brand terms; Whisper on ReadyForm-controlled infrastructure is used as a fallback. Speechmatics processes this data on our behalf and does not use it to train models. Speaker diarisation and face detection are described in Section 6. Hetzner stores customer video files and RunPod performs GPU rendering; the restriction on Anthropic's inputs does not mean no external provider processes customer video/audio.
We do not train or fine-tune our own or third-party AI models using identifiable customer Material or Output. Processing agreements and settings for the commercial AI service must support that restriction. Analytics for product improvement does not authorise reuse of identifiable footage or transcripts for model training. Only genuinely anonymous or aggregated information that cannot reasonably identify a person is treated as outside personal-data protection requirements.
11. INTERNATIONAL DATA TRANSFERS
Some of our service providers and subprocessors, including certain AI infrastructure providers such as Anthropic and our payment processor Stripe, are located, or process personal data, outside the European Economic Area ("EEA"), including in the United States. Speechmatics is established in the United Kingdom, which is covered by an adequacy decision of the European Commission.
Where personal data is transferred outside the EEA, we put in place an appropriate safeguard recognised under the GDPR before the transfer occurs. Depending on the recipient and the mechanisms available at the relevant time, this will typically be one of the following: (a) an adequacy decision issued by the European Commission in respect of the recipient country; (b) certification of the recipient under the EU-U.S. Data Privacy Framework, where applicable and where the recipient is so certified; (c) the European Commission's Standard Contractual Clauses ("SCCs"), together with any supplementary technical, contractual, or organisational measures necessary to ensure an essentially equivalent level of protection; or (d) another valid transfer mechanism recognised under Chapter V of the GDPR.
You may request further information about the specific safeguard applicable to a particular transfer, including confirmation of which mechanism applies to a named subprocessor, by contacting us using the details in Section 22.
12. COOKIES AND SIMILAR TECHNOLOGIES
12.1 Scope and Purposes
Cookies, local storage, and related identifiers support authentication, consent preferences, payment security, app analytics, and affiliate attribution. The Cookie Policy distinguishes those purposes and recipients. PostHog is used for app product analytics and session replay. FirstPromoter is used for website affiliate tracking, including the _fprom_tid attribution cookie.
12.2 Necessary and Optional Processing
Storage genuinely necessary for a requested login/session, consent preference, or payment security function is distinguished from optional analytics and marketing. PostHog analytics/session replay relies on consent. FirstPromoter affiliate tracking requires prior marketing consent and may not be treated as necessary merely because it allocates affiliate commission. Continuing to browse or accepting general Terms is not tracking consent.
12.3 Consent Controls
The app provides consent controls for optional analytics and session replay. You may refuse optional tracking and withdraw consent through the app's privacy/cookie controls; this does not affect access to core paid editing functions. Necessary service notifications remain separate. Where website affiliate tracking is offered, it requires a prior consent mechanism; in the absence of one, that tracking must remain disabled. This Policy does not represent that the website currently provides a cookie banner. Browser controls can additionally block or delete stored identifiers. Contact legal@readyform.ai if you need help exercising your choices.
13. PRODUCT ANALYTICS AND SESSION REPLAY
With your consent, PostHog collects app usage events and session-replay data to understand usability, investigate problems, and improve the product. Session replay reconstructs interactions with the app interface from recorded interface state and actions, such as navigation, clicks, and scrolling; it is not the customer's source-video render or an AI-training dataset.
Replay can capture personal information displayed in an interface unless effective masking and exclusion rules are applied. We do not authorise customer videos, audio, transcript text, private project content, passwords, tokens, or full payment details to be included in general analytics or replay. Relevant screens, elements, and event payloads must be masked or excluded; the permitted data collection remains limited to the purposes and consent described here. Consent must describe the replay purpose rather than silently treating it as anonymous statistics.
FirstPromoter associates affiliate referrals with qualifying signups/conversions for attribution and commission administration. Optional browser attribution relies on consent; financial/contractual commission records and their retention are separate from cookie lifetime. Recipients and international processing are described in Sections 8 and 11 and the Cookie Policy.
14. DATA RETENTION
We retain personal data only for as long as necessary for the purposes described in this Policy, taking into account the nature and sensitivity of the data, the purposes for which it is processed, and our legal and contractual obligations. In particular:
Account data is retained for as long as your account remains active. If you close your account, a seven (7) day grace period applies as described in Section 17 of our Terms of Service, after which the account closes. Account data is deleted from active systems without undue delay and within thirty (30) days after closure, subject to required legal retention and protected backup deletion cycles under Section 17 of the Terms.
Accepted source-video files are automatically deleted after one hundred eighty (180) days in storage, exported-video files after ninety (90) days, and rejected-upload files after seven (7) days, even if the account remains active. Account closure or valid deletion instructions may cause earlier removal. Account-closure deletion from active systems is completed without undue delay and within thirty (30) days after closure, subject to the Customer's return/deletion choice, required legal retention, and protected backup cycles in Section 17 of the Terms and Section 10 of the DPA. These file lifecycles do not establish identical retention for transcripts, metadata, diagnostics, or vendor backups; those are limited to their applicable purpose and deletion obligations. Where you have requested removal of specific published material while your account remains active, the removal timelines in Section 15 of our Terms of Service apply.
Billing and invoicing records, including records received from Stripe confirming payment, are retained for seven (7) years following the relevant transaction, in accordance with Dutch statutory record-keeping obligations for tax and accounting purposes (fiscale bewaarplicht), even if your account is closed sooner.
Support and communication records are retained for as long as reasonably necessary to resolve your request, and for a limited period afterwards for quality assurance, training, and dispute-handling purposes, after which they are deleted or anonymised.
Usage and log data is retained for a limited period sufficient for security monitoring, fraud prevention, and analytics purposes, after which it is deleted or aggregated into a form that no longer identifies you.
Marketing consent and preference records are retained for as long as you remain subscribed to marketing communications, and for a reasonable period afterwards, to allow us to demonstrate compliance with consent and suppression requirements.
Where personal data is retained for longer for a specific legal or regulatory reason, we will retain only the minimum data necessary for that purpose and for no longer than required.
15. DATA SECURITY AND BREACH NOTIFICATION
We implement technical and organisational measures designed to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage, taking into account the state of the art, the cost of implementation, and the nature, scope, context, and risk of the processing involved. These measures include, among others: encryption of data in transit; access controls limiting internal access to personal data on a need-to-know basis; regular review and testing of our security measures; and contractual security obligations imposed on Stripe, Anthropic, and our other subprocessors.
No method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security of personal data. You play an important role in protecting your own account by keeping your credentials confidential and notifying us promptly, as described in our Terms of Service, of any suspected unauthorised access.
In the event of a personal data breach affecting personal data for which we act as controller, and which is likely to result in a risk to the rights and freedoms of individuals, we will notify the competent supervisory authority without undue delay, and, where required by the GDPR, notify affected individuals, in accordance with Articles 33 and 34 GDPR. In the event of a personal data breach affecting Material or other personal data for which we act as a processor on behalf of a customer, we will notify the affected customer without undue delay in accordance with the timelines and procedure set out in the DPA, so that the customer, as controller, can meet its own notification obligations.
16. YOUR RIGHTS UNDER THE GDPR
If you are located in the EEA, the United Kingdom, or another jurisdiction with similar data protection law, you have the following rights in relation to your personal data, subject to the conditions and exceptions set out in applicable law:
Right of access (Article 15): to obtain confirmation as to whether we process your personal data, and, if so, to obtain a copy of that data together with certain related information.
Right to rectification (Article 16): to have inaccurate personal data corrected, and incomplete personal data completed.
Right to erasure (Article 17): to have your personal data deleted in certain circumstances, for example where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies.
Right to restriction of processing (Article 18): to request that we limit how we use your personal data in certain circumstances, for example while we verify its accuracy or assess an objection you have raised.
Right to data portability (Article 20): to receive personal data you have provided to us, in a structured, commonly used, machine-readable format, and to have it transmitted directly to another controller, where this is technically feasible and the processing is based on consent or contract and carried out by automated means.
Right to object (Article 21): to object to processing based on legitimate interests, subject to applicable statutory conditions. You may object to direct marketing, including related profiling, at any time; we then stop that marketing processing. The compelling-grounds exception for other legitimate-interest processing does not override a direct-marketing objection.
Right to withdraw consent (Article 7(3)): where processing is based on your consent, to withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Right to lodge a complaint (Article 77): to lodge a complaint with a supervisory authority, in particular the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), or the supervisory authority of your habitual residence, place of work, or the place of the alleged infringement, if you consider that our processing of your personal data infringes the GDPR.
To exercise any of these rights, please contact us at legal@readyform.ai. We may need to verify your identity before responding, for example by asking you to confirm details associated with your account. We will respond to your request within one month of receipt, as required by the GDPR, which period may be extended by a further two months where necessary, taking into account the complexity and number of requests, in which case we will inform you of the extension and the reasons for the delay.
Some personal data may be exempt from a particular request under applicable law, for example where retention is required to comply with a legal obligation. Where we need certain personal data to provide the Service to you, and you ask us to delete it, you may no longer be able to access or use the Service, or certain features of it.
17. YOUR CHOICES
In addition to the rights described in Section 16, you have the following practical choices available to you:
Account information: you may review, update, or correct your account information at any time by logging into your account, or by contacting us at legal@readyform.ai.
Closing your account: use the account-deletion option on the app account page. This also initiates subscription cancellation. Section 17 of the Terms describes the seven-day reversible grace period and subsequent deletion. Subscription renewal can separately be cancelled through the customer portal without deleting the account.
Marketing communications: you may opt out of marketing emails at any time using the unsubscribe link included in those emails, or by contacting us at legal@readyform.ai. Opting out does not affect service-related communications necessary to operate your account, such as billing notices or security alerts.
Marketing use of your Material: we ask for separate prior opt-in before promotional use of your Material, Output, name, or logo under Section 12.2 of the Terms. You may refuse or withdraw permission without affecting access or pricing. Withdrawal must be as easy as giving permission, using the same channel or legal@readyform.ai. We stop further promotional use and address removal without undue delay under Section 15 of the Terms; applicable privacy rights take precedence over its outer removal limit.
Cookies: you may manage your cookie preferences as described in Section 12.3.
18. MARKETING PREFERENCES (SUMMARY)
For ease of reference, you can stop receiving marketing communications, withdraw promotional permission, or exercise applicable privacy rights at any time by contacting legal@readyform.ai, without affecting your ability to use the paid or free features of the Service. Promotional permission can also be withdrawn through the same channel used to give it.
19. CHILDREN'S DATA
The Service is intended for professional and business use by individuals who are at least 18 years old, as set out in our Terms of Service. We do not knowingly register account holders under 18, and the Service is not directed at children. Customer Material may lawfully depict minors subject to the permissions and safeguards in the Terms and DPA. If we become aware that we have collected personal data from someone under the age of 18 without appropriate authorisation, we will take reasonable steps to delete that data as soon as reasonably possible. If you believe a child has provided us with personal data, please contact us at legal@readyform.ai.
20. THIRD-PARTY WEBSITES AND SERVICES
The Service and our website may contain links to third-party websites, plug-ins, applications, or services that are not owned or controlled by ReadyForm. This Policy does not apply to, and we are not responsible for, the privacy practices of any third party, including Stripe's or Anthropic's own privacy notices, which govern their independent processing activities where they act as independent controllers. We encourage you to review the privacy notices of any third-party website or service before providing personal data to it or connecting it to your ReadyForm account.
21. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time to reflect changes to our practices, the Service, our subprocessors, or applicable law. Where a change is material, we will notify you in advance, for example through a notice within the Service or by email, together with the effective date of the change, before that change takes effect. The version identifier at the top indicates the edition of this Policy. We encourage you to review this Policy periodically.
22. CONTACT US AND COMPLAINTS
If you have any questions, comments, or requests regarding this Privacy Policy or our data protection practices, or if you wish to exercise any of the rights described in Section 16, please contact us at:
ReadyForm B.V. Newtonlaan 115, 3584 BH Utrecht, the Netherlands KVK: 42123086 Email: legal@readyform.ai
If you are not satisfied with our response to a request or complaint, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), Bezuidenhoutseweg 30, 2594 AV Den Haag, the Netherlands, www.autoriteitpersoonsgegevens.nl, or with the supervisory authority in your own country of residence within the EEA.