FormLM Privacy Policy

Effective Date: January 1, 2025 Version: v1.2025

Thank you for using FormLM! This Privacy Policy explains how we collect, use, store, and protect your personal information. Please read it carefully before using the Service.

1. Information We Collect

1.1 Account Information

Phone number: Used for SMS verification code login and account verification
Email address: Used for email verification code login
Nickname and avatar: Displayed on your profile page (optional)
Third-party account identifier: When you log in via Google or other third-party accounts, we receive the unique identifier and public profile information provided by that platform

1.2 Usage Information

Login timestamps and IP addresses (for security auditing)
Device type, operating system, and browser version
Feature usage logs (e.g., create, view, share actions)

1.3 User Content

Content you actively upload or create while using the Service (such as survey questions, response data, and attachments) is under your control and constitutes your private data.

2. How We Use Your Information

Authentication: Verifying your identity via phone, email, or third-party accounts
Service delivery: Providing survey, assessment, and other features and generating reports
Security: Detecting abnormal logins and preventing account theft or abuse
Compliance records: Recording your consent to this Privacy Policy and the Terms of Service (timestamp and version) to satisfy regulatory requirements
Service improvement: Optimizing user experience through anonymized aggregate statistics
Legal compliance: Responding lawfully to requests from government or judicial authorities

We will not use your personal information for commercial marketing purposes, and we will not sell your personal information to third parties.

3. Information Sharing

We share your information only in the following circumstances:

With your explicit consent: When you proactively share report links or invite collaborators
Legal requirements: To comply with lawful requests from government or judicial authorities
Service providers: Trusted third parties that assist us in operating the Service (such as cloud hosting providers and SMS service providers). They are required to sign confidentiality agreements and are only permitted to process data for the purposes described in this Policy

4. Data Storage and Security

Storage location: Your data is stored on compliant cloud servers located in the Hong Kong Special Administrative Region
Retention period: Data is retained throughout the active account period; permanently deleted within 30 days of account cancellation
Security measures: HTTPS encrypted transmission, encrypted data storage, access control, operation log auditing, and regular security scanning
Backup: Daily encrypted backups with a 90-day retention period for disaster recovery purposes

Internet transmission cannot guarantee 100% security. In the event of a data security incident, we will notify you within the timeframes required by applicable law.

5. Your Rights

Under the Personal Data (Privacy) Ordinance of Hong Kong, you have the following rights:

Right	Description
Right of Access	Log into your account at any time to view your personal information
Right of Rectification	Update your nickname, avatar, and other details via Account Settings
Right of Erasure	Request account cancellation; all data will be permanently deleted within 30 days
Right to Withdraw Consent	Stop using the Service or contact customer support to withdraw authorization for data processing
Right to Lodge a Complaint	File a complaint with the Office of the Privacy Commissioner for Personal Data, Hong Kong

Account Cancellation

You can cancel your account via Account Settings → Cancel Account. After cancellation, all your data (including surveys, reports, etc.) will be permanently deleted within 30 days and cannot be recovered. Please export any data you wish to keep before proceeding.

6. Cookies and Local Storage

We use Cookies and browser local storage (LocalStorage) to:

Maintain your login session (authentication token)
Remember your language preference
Track failed login attempts to prevent brute-force attacks

You can disable Cookies through your browser settings, but this may prevent login and other features from functioning properly.

7. Children's Privacy

The Service is not intended for children under the age of 14. If we discover that we have collected personal information from a child under 14, we will immediately delete that data and cancel the associated account. If you are a minor, please read this Policy with a guardian and use the Service only with their consent.

8. Updates to This Policy

When this Policy is revised, we will post a prominent notice on the website and send a notification to the phone number or email address associated with your account. The revised version will take effect 30 days after publication. Continued use of the Service after the effective date constitutes acceptance of the revised Policy. If you do not agree, you may cancel your account and export your data before the revision takes effect.

9. Contact Us

For any privacy-related questions or to exercise your rights, please contact us through:

The in-platform "Feedback" feature
Email: formlm.me@gmail.com

We will respond to your request within 15 business days.

Thank you for trusting FormLM!