1. Who we are and what this policy covers
This Privacy Policy explains how Formentic, a service provided by DYS Global, a sole trader (enskild firma) registered for VAT in Sweden ("Formentic", "we", "us") collects, uses and protects personal data when you visit our website, sign up for, or use the Formentic platform (the "Service").
Contact: privacy@formentic.com. We have not appointed a Data Protection Officer, as we are not required to; please send any data protection question to privacy@formentic.com. Formentic is established in Sweden, in the EU, and has not appointed a UK representative at this time.
2. Our two roles
We handle personal data in two different roles, and this matters for your rights.
| Data | Examples | Our role | Who decides how it is used |
|---|---|---|---|
| Account Data | Your name, business email, company details, platform details, billing details, support messages, User activity logs | Controller (EU/UK) · Business (US) | Formentic, as described in this policy |
| Client Data | Contacts, leads and form submissions stored in the Data Extensions we provision in your Salesforce Marketing Cloud (SFMC) account | Processor (EU/UK) · Service provider (US) | Our Client, under our Data Processing Agreement (DPA) |
This policy mainly covers Account Data. If you are a contact or customer of one of our Clients and your data is in Client Data, the Client's own privacy notice applies. Please contact that Client to exercise your rights; we will assist them as required by the DPA.
If you visit or fill in a form that one of our Clients publishes with Formentic, the Client decides what the form collects, which cookies it uses and whether they wait for your consent, and which of its own tools (such as a tag manager or consent tool) run on the page. That is Client Data: the Client's privacy notice applies, and we act on the Client's instructions.
Credits usage data is not about people. The names of Data 360 assets are chosen by you; if one happens to contain a person's name, we treat it as Client Data.
3. What we collect, why, and our legal basis
| Category | What it includes | Why we use it | Legal basis (GDPR) |
|---|---|---|---|
| Identity and contact | Name, business email, job title, phone | Create and manage your account, communicate with you | Contract (Art. 6(1)(b)) |
| Company details | Company name, address, VAT number, country | Account setup, invoicing, tax compliance | Contract; legal obligation (Art. 6(1)(c)) |
| Platform details | SFMC subdomain, MID/business unit IDs, Installed Package Client ID and Client Secret, API endpoints; Data 360 My Domain URL, and the Consumer Key and Consumer Secret of the read-only app you create | Provision and operate your Formentic folder and Data Extensions, and read your Credits usage | Contract |
| Credits usage data | Daily credit totals, balances and allowance from your Data 360 Digital Wallet usage tables, and the name and type of each asset that used credits. We never read customer profiles or other customer records, and we do not store the Salesforce user ID that appears in the usage events | Show your credit usage, flag unusual use, and send the alerts you switch on | Contract |
| Login credentials | Password (stored only as a salted hash), MFA settings | Secure access to your account | Contract; legitimate interest in security (Art. 6(1)(f)) |
| Billing | Plan, billing history, payment status (paid by invoice and bank transfer; we do not handle payment card details) | Trial, billing, downgrades, collections | Contract; legal obligation (bookkeeping) |
| Activity and audit logs | Logins, IP address, browser, actions taken in the Service, timestamps | Security, fraud prevention, transparency and accountability logs visible to your admins | Legitimate interest (security and accountability); contract |
| Support and training | Messages, meeting notes, screen-share sessions you schedule with us | Provide training, support and live debugging | Contract; legitimate interest |
| Marketing | Email address, preferences, interaction with our emails | Product updates and marketing to business contacts | Legitimate interest, with opt-out; consent where required by law |
| Website data | Cookies and similar technologies | Site operation, analytics | Consent, except strictly necessary cookies |
| Website statistics | For each page opened on our public site: the date, the page address, the name of the website that sent you, phone, desktop or tablet, and your country. No cookie or ID is used, and your IP address and browser details are not stored; they are used only in memory to make a one-way code that is deleted at the end of the day, so we can estimate how many different visitors came | Understanding how the public website is used, in aggregate, so we can improve it | Legitimate interest (Art. 6(1)(f)); we honour Do Not Track and Global Privacy Control |
| Access requests | If you ask us for access without a work email: your name, email address, company or what you do, what you will use Formentic for, and when you agreed that we may email you about it | Answering your request and, if we approve it, sending your sign-up link | Legitimate interest (answering your request); steps you ask for before a contract (Art. 6(1)(b)) |
| Sign-up email check | When you sign up, the part of your email address after the @ is looked up in public DNS records to see that it can receive email, and compared with lists of private and short-lived email providers. The result is not stored | Making sure each workspace is created with a working business address, and preventing misuse | Legitimate interest (Art. 6(1)(f)) |
We do not sell personal data, use it for cross-context behavioural advertising, or use it to train third-party AI models. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.
Where the data comes from: mostly from you directly, from the Users of your account, and from your SFMC account through the Installed Package you create.
If you do not provide data required for the contract (for example platform details), we cannot provide the Service.
4. How we protect your data
- Credentials. SFMC Client Secrets and other integration credentials are encrypted at rest with AES-256 (AES-256-GCM) and keys are managed separately from the data. Formentic staff do not have routine access to decrypted secrets.
- Passwords. Never stored in readable form; stored only as salted cryptographic hashes (SHA-2 family). We cannot see or recover your password.
- In transit. All traffic is encrypted with TLS 1.2 or higher.
- Access control. Least-privilege access, multi-factor authentication for staff, and row-level security in our database.
- Limited SFMC scope. We only request Data Extension, Documents and Images, Saved Content and Email read/write permissions (and Journeys read, if you choose to grant it), and only act on the folders, Data Extensions, content blocks, emails and images we create for you and, for the emails you build with Formentic, on the content blocks you include in them and the triggered sends that use them, as described in our Terms (Section 4). Screenshots of your tests are uploaded to your own Content Builder; we keep no copy.
- Limited Data 360 scope. The app you create for Credits has two permissions only, "api" and "cdp_query_api", and Formentic reads only the Digital Wallet usage tables. Formentic reads your usage about once an hour (once a day on the Free plan), which can use a very small number of your own Data 360 credits.
- Logging. User actions in the Service are logged and available to your admins.
- Your part. You control session duration, IP allowlisting and your Users' credentials. We recommend enabling all of them.
No system is completely secure. If a personal data breach affects your data, we will notify you without undue delay, and supervisory authorities and individuals where the law requires.
5. Who we share data with
We share personal data only with the service providers below, under written contracts that protect your data, and when required by law. This table is a summary — see the Subprocessor List for the current, most detailed version.
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Database, authentication and storage | London, United Kingdom (covered by an EU adequacy decision) |
| Netlify, Inc. | Application hosting and server functions | Functions in London, United Kingdom; static content delivered through a global network (Standard Contractual Clauses) |
| Resend, Inc. | Transactional and product emails | EU sending region (Ireland); company based in the United States (Standard Contractual Clauses) |
| Google Ireland Limited (Google Workspace) | Training and live support sessions, support email | EU and United States (Standard Contractual Clauses) |
| Salesforce, Inc. | Your own SFMC and Data 360 accounts, which you connect to the Service | Per your Salesforce contract |
We may also disclose data to professional advisers, to authorities when legally required, or to a buyer in a merger or acquisition, with notice to you. We will notify Clients at least 30 days before adding or replacing a sub-processor that handles Client Data.
6. International transfers
We aim to store data in the EU/EEA. Where data is transferred outside the EU/EEA or the UK (for example to US-based providers), we rely on an adequacy decision, including the EU–US Data Privacy Framework where the recipient is certified, or on the European Commission's Standard Contractual Clauses (and the UK Addendum), together with additional safeguards where needed. You can request a copy of the relevant safeguards by contacting us.
7. How long we keep data
| Data | Retention |
|---|---|
| Account and company data | For the life of your account, then deleted within 60 days of account closure |
| SFMC integration credentials | Until you remove them or your account closes; deleted within 30 days |
| Data 360 integration credentials | Until you disconnect Data 360 or your account closes; deleted straight away when you press Disconnect |
| Credits usage readings and alert history | The latest reading is replaced at each refresh. Both are deleted when you disconnect Data 360 or your account closes |
| Audit and activity logs | 12 months |
| Invoices and billing records | 7 years, as required by Swedish bookkeeping law |
| Support records | 24 months after the ticket closes |
| Marketing preferences | Until you opt out, plus a suppression record to respect your opt-out |
| Access requests | 12 months after the request, then deleted |
Data in your own SFMC account, including the Data Extensions we provisioned, stays in your account and under your control.
8. Your rights in the EU, EEA, UK and Switzerland
Under the GDPR and similar laws you have the right to:
- access your personal data and get a copy;
- rectify inaccurate data;
- erase your data ("right to be forgotten");
- restrict our processing;
- data portability — receive your data in a machine-readable format;
- object to processing based on legitimate interest, and to direct marketing at any time;
- withdraw consent at any time, without affecting earlier processing; and
- lodge a complaint with a supervisory authority. Our lead authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), www.imy.se, but you may contact the authority where you live or work.
We respond within one month, extendable by two months for complex requests. We may need to verify your identity.
9. Your rights in the United States
Depending on your state of residence (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with comprehensive privacy laws), you may have the right to:
- know what personal information we collect, use and disclose, and access a copy;
- correct inaccurate personal information;
- delete personal information;
- opt out of the sale or sharing of personal information and targeted advertising — we do not sell or share personal information as those terms are defined under the CCPA, and have not done so in the past 12 months;
- limit the use of sensitive personal information — we use it only for purposes permitted by law, such as account security;
- appeal our decision on your request; and
- not be discriminated against for exercising your rights.
California notice at collection. In the past 12 months we collected these categories: identifiers; commercial information; internet or network activity; professional or employment-related information; and account login credentials (sensitive personal information). Sources, purposes, disclosures and retention are described in Sections 3, 5 and 7. We disclose these categories to the service providers listed in Section 5 for business purposes only.
To exercise your rights, email privacy@formentic.com. You may use an authorised agent. We respond within 45 days, extendable once by 45 days where permitted.
10. Cookies
We use strictly necessary cookies to run the Service and keep you signed in. With your consent, we use analytics cookies to understand usage. You can change your choices at any time through cookie settings. We honour Global Privacy Control signals where required by law. See our Cookie Policy for details.
Forms our Clients publish with Formentic use a few cookies of their own, set for the Client and only where the form needs them. They are listed in the Cookie Policy, section 4.
11. Children
The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal data from children.
12. Changes to this policy
We may update this policy. We will post the new version with a new "Last updated" date and notify account owners by email of material changes before they take effect.
13. Contact us
DYS Global · Sole trader (enskild firma), VAT-registered · Sweden · Postal address on request · privacy@formentic.com