Privacy Policy

1. Introduction

UAB Silotech ("we," "us," or "our"), company code 306971572, VAT LT100020253611, registered in Lithuania, operates FORMIUS.AI (the "Service"). The company was formerly named UAB Saakuru Technologijos. This Privacy Policy explains how we collect, use, disclose, and safeguard personal data when you use the Service.

1.1 Who is responsible for your data

• If you fill in a form or lesson (a respondent), the organization or person that created the form (the form owner) decides why and how your answers and files are collected. The form owner is the controller of that data, and we process it on their behalf as processor under our Data Processing Agreement. Questions about why a form collects your data, or requests to see or delete your answers, are best sent to the form owner first. We forward requests we receive to them.
• If you hold a FORMIUS.AI account (a form owner or team member), we are the controller of your account, billing and usage data.

We are committed to protecting your privacy and ensuring the security of your personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Information We Collect

2.1 Information You Provide

• Form responses: Any data you submit through forms, which varies depending on the form's questions
• Email address: Required for verification of form submissions
• File uploads: Any files you choose to upload as part of form submissions, which can include CVs, photos, identity document images and driving licence images when the form asks for them
• Lesson answers: Answers, completion state, and AI feedback generated when you complete an interactive lesson

2.2 Information From Account Holders

• Account data: Your email address, used for sign-in with a one-time code, and the forms, lessons and settings you create
• Billing data: Subscription status and the billing details you enter at checkout. Payment details are handled by Stripe and are not stored by us
• Usage data: Product analytics events about how you use the Service (see section 11)

2.3 Information Collected Automatically

• IP address: Used for security and fraud prevention
• Browser type (user agent): Used for security and debugging purposes
• Submission timestamp: When you submitted the form

3. How We Use Your Information

• Process and store your form submissions
• Send verification emails to confirm your submissions
• Ensure security and prevent fraud or abuse
• Provide your submissions to form owners (the organizations that created the forms)
• Improve our Service and fix technical issues
• Provide optional AI feedback on a lesson answer when you explicitly request it

4. Legal Basis for Processing

For form responses, the form owner, as controller, decides the legal basis and should explain it to you in or next to the form. We process that data on the form owner's instructions.

Where we are the controller, we rely on:

• Contract: To provide the Service to account holders and to bill subscriptions
• Legitimate Interest: For security measures, fraud and abuse prevention, error monitoring, and product analytics to improve the Service
• Legal Obligation: To keep invoices and accounting records as required by law

5. Data Sharing

We may share your information with:

• Form owners: The organizations that created the forms receive your submissions
• Service providers (subprocessors): Companies that help us operate the Service. The full list, with the data each one receives and where, is on the subprocessors page:
  • Supabase (database, file storage and admin sign-in (one-time email codes))
  • Vercel (application hosting, serverless functions and scheduled jobs)
  • Upstash (Vercel KV) (key value store behind Vercel KV, used for rate limiting and short-lived AI form generation state)
  • Resend (transactional email: submission confirmation links to respondents, and new response and form deletion emails to form owners)
  • PostHog (product analytics)
  • Fly.io (self-hosted GlitchTip error monitoring) (error monitoring. We run GlitchTip, a Sentry-compatible error tracker, ourselves on Fly.io. The Sentry SDK in the app sends its reports to that server, not to Sentry)
  • Stripe (subscription billing, checkout, tax and customer portal)
  • Google Cloud (Vertex AI, Gemini) (aI form generation and editing. Form generation runs on one provider at a time, chosen in configuration: this one, Anthropic or Vercel AI Gateway)
  • Anthropic (aI form generation, the form chat agent and its checks (Claude), and the fallback for lesson text generation. Form generation runs on one provider at a time, chosen in configuration: this one, Google Cloud or Vercel AI Gateway. Production uses this one through Vercel AI Gateway with inference pinned to the EU, so the model runs on Amazon Web Services Bedrock in Frankfurt. Also the fallback model for lesson text generation)
  • Amazon Web Services (Bedrock, through Vercel AI Gateway) (runs the Claude model for form generation and the form chat agent when Vercel AI Gateway routes the request with EU inference)
  • Vercel AI Gateway (routing of AI model requests: form generation and the form chat agent (Claude, with inference pinned to the EU), lesson generation and lesson answer feedback)
  • OpenAI (through Vercel AI Gateway) (not used by default since 2026-10-01, when lesson models moved to EU inference. Used only if a lesson model setting names an OpenAI model, which the EU inference option then refuses)
  • Google Gemini (through Vercel AI Gateway) (lesson text generation, optional AI feedback on lesson answers, and lesson illustration generation and validation, with inference pinned to the EU (Vertex AI EU))

When a learner requests AI feedback, we send only the relevant answer, lesson question, saved rubric, and saved reference material. We do not include the learner's email address or unrelated form responses in that model request. The feedback is advisory and does not produce legal or similarly significant effects by itself. AI form generation uses only what the form owner writes, never respondent answers.

We do NOT sell your personal data to third parties.

6. Data Retention

• Form submissions: Retained as determined by the form owner and any configured retention settings
• Unverified submissions: Verification links expire after 24 hours
• File uploads: Follow the same configured retention cleanup as their related submissions. Files are stored as soon as they are picked, before the form is sent; a file that never becomes part of a submission (removed, replaced or left behind in an unsent form) is deleted automatically, usually within 3 days
• Generated lesson illustrations: Follow the deletion lifecycle of their owning lesson
• Account data: Kept while the account is active and deleted within 90 days after the account ends, unless the law requires us to keep it longer (for example invoices)
• Backups: The database is backed up daily and each backup is kept for 7 days, so deleted data disappears from backups within 7 days

7. Your Rights

Under the GDPR, you have the following rights:

• Right of access: Request a copy of your personal data
• Right to rectification: Request correction of inaccurate data
• Right to erasure: Request deletion of your personal data ("right to be forgotten")
• Right to restrict processing: Request limitation of how we use your data
• Right to data portability: Receive your data in a machine-readable format
• Right to object: Object to processing based on legitimate interests
• Right to lodge a complaint: File a complaint with a supervisory authority

8. How to Exercise Your Rights

To exercise any of your rights, please contact us at: privacy@silotech.xyz, or use the privacy request form.

If your request is about answers you gave in someone else's form, we pass it to the form owner, who decides on it as controller. We help the form owner carry it out.

We will respond to your request within 30 days. We may need to verify your identity before processing your request.

9. International Data Transfers

Form responses, uploaded files and account data are stored in the EU, in Frankfurt, Germany (Supabase). Product analytics are processed in the EU (PostHog EU Cloud). Other providers, such as hosting, email, error monitoring, billing and AI providers, may process data in the EU or the United States, as stated in each provider's DPA. When data is transferred outside the EU/EEA, the transfer relies on an adequacy decision (including the EU-US Data Privacy Framework where the provider is certified) or on the European Commission's Standard Contractual Clauses.

10. Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption in transit (HTTPS/TLS)
• Encryption at rest of the database and file storage, provided by Supabase
• Uploaded files kept in a private storage bucket, reachable only through short-lived signed links issued after a permission check
• Access controls: Row Level Security, server-only writes of responses, and per-form sharing permissions for account holders
• Email confirmation of every form submission
• Daily database backups, each kept for 7 days
• Error reports sent without default personal data, with cookies and authorization headers removed

The full list of measures is in section 7 of the Data Processing Agreement.

11. Cookies

11.1 On public form and lesson pages

• Form access cookie: A strictly necessary cookie that remembers, for up to 24 hours, that you may open a form (and that you entered its password, if it has one)
• Browser storage: Kept on your device only. It can hold your language choice, a short-lived record of your submission for the confirmation page, your progress in a lesson, and an unsent draft of your form answers so a page reload does not lose them. A draft lives only in the open browser tab, is cleared when you submit, when the tab closes or after 24 hours, and never includes uploaded files, consent answers or the form password. Nothing in this storage is sent to us until you submit
• Analytics: Anonymous page and progress events are counted without storing any analytics cookie or identifier on your device

11.2 On the website and in the account area

• Session cookies: Strictly necessary for sign-in. They store access, refresh, expiry, user ID, and email values.
• Preference cookies: Your chosen language and pricing currency
• Analytics cookies: PostHog, hosted in the EU, stores an identifier in a cookie and in local storage to measure how the website and the Service are used. Browsers that send Do Not Track are not tracked

We do not use marketing or advertising cookies.

12. Children's Privacy

Our Service is not intended for children under the age of 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately at privacy@silotech.xyz.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by updating the "Last Updated" date at the top of this policy. We encourage you to review this policy periodically.

14. Contact Us

15. Supervisory Authority

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the supervisory authority in Lithuania: