Formless Privacy Policy

Last Updated: May 22th, 2026

Effective Date: May 22th, 2026

I. Introduction

FORMLESS BASICS PTE. LTD. including their respective parents, subsidiaries, and affiliates (collectively, “Formless”, “we”, “us”, or “our”) respects your privacy regarding any information we may collect in the course of providing products and services (“Services”) to you through our Formless application (the “APP”).

We are a Singaporean company, with our registered office at 91 BENCOOLEN STREET, #12-03, SUNSHINE PLAZA, SINGAPORE 189652.

This Privacy Policy applies to users of our APP in the United States. It describes the types of personal data we collect, how we use and share it, the data rights you have, and how you can contact us about our privacy practices. This Privacy Policy is intended to comply with applicable U.S. federal and state privacy laws, including the California Consumer Privacy Act of 2018 (“CCPA”), as amended by the California Privacy Rights Act of 2020 (“CPRA”).

II. Updates to this Privacy Policy

We may update this Privacy Policy from time to time to ensure compliance with all applicable laws and to reflect any changes in our collection, processing, and/or retention of personal data. When we make material changes, we will notify you by posting the updated Privacy Policy on our APP and updating the “Last Updated” date at the bottom of this Privacy Policy. We encourage you to review this Privacy Policy periodically.

III. What Personal Data Do We Collect and How We Process Your Personal Data

We may directly or indirectly collect personal data when you use our Services, or when you interact with us. Your personal data with us is obtained from various sources. This includes: (a) data provided by you or sources authorized by you, such as our affiliates or partners; (b) information generated through your use of our Services; (c) information obtained from legally and publicly available sources.

Our APP offers a guest mode that allows limited access without registration. In guest mode, we may collect your device-level information (such as device ID, device model, operating system version, and network connection type) and voice data when you have a dialogue through the Services. To access full functionality, you will need to create an account, at which point additional information described below will be collected.

The processing of personal data includes the following:

Ÿ Account Registration and Login. To create and manage your account and verify your identity, we may collect your email address (if you choose register or log in through email/ Google /Apple), phone number (if you choose register or log in through phone number), and device information including device ID, device model, operating system version, language settings, time zone, and network connection type.

Ÿ Account Personalization. To provide a personalized experience, we may collect your preference settings you select within the APP, such as your chosen language, tone, avatar, and nickname.

Ÿ AI Interactive Dialogue. To provide our core AI-powered interactive services, we collect the content you input through text or voice when interacting with our AI. Your voice input is processed through automatic speech recognition (ASR) services to convert speech to text and is not used for biometric identification purposes.

Ÿ User Feedback and Complaint Handling. To receive and respond to your feedback, complaints, and service improvement suggestions, we may collect the text or voice content you input.

Ÿ Language, Voice, and Avatar Switching. To allow you to customize the language, voice style, and AI avatar used during your interactions, we may collect the selections you make within the APP.

Ÿ Safety and Compliance Review. To maintain a safe and compliant platform, we may review the content of interactions between you and our AI (including both your inputs and AI-generated outputs) for safety, content moderation, and regulatory compliance purposes.

Ÿ Account Deletion. To process your account deletion request, we may collect the email address or phone number associated with your account to verify your identity.

Ÿ Membership Subscription and Recharge Services. To process and manage your membership subscriptions and account recharges, we may collect your [membership plan type, subscription status, activation and expiration date, payment and billing information].

Ÿ Marketing and Promotional Communications. You acknowledge and agree that we may send you marketing and promotional communications. For this purpose, we may collect your [ email address ].

We may use automated decision-making, including profiling, in connection with our Services. To recommend content tailored to your interests and preferences, we process your historical interaction data, including your prior text and voice inputs and viewing duration within the APP. Please note that we implement technical measures such as data minimization and pseudonymization to protect your personal data during such processing.

IV. How Do We Keep Your Personal Data

The retention period of personal data collected by us shall be the shortest time necessary to realize the purpose specified herein, unless a longer retention period is required by laws and regulations. Your personal data will be deleted or anonymized after the aforementioned retention period expires. More specifically:

Ÿ Account-related information (including registration and login data, personalization settings, AI interaction data, content recommendation data, and feedback data): retained for the duration of your active account.

Ÿ Account deletion: upon submission of an account deletion request, your account will be maintained for thirty (30) days during which you may withdraw the request. After the 30-day period, your personal information will be deleted from our active systems.

Ÿ Third-party service provider data: personal information transmitted to our third-party AI model and cloud service providers for processing purposes is stored by such providers for no more than seven (7) days and then deleted. For real-time communication services, your voice data and audio synthesized by TTS are transmitted in transit only and are not persistently stored.

V. Who Will We Share Your Personal Data With

We may share your personal data inside the company if it is necessary to provide services in a timely manner. We may share your personal data with the following categories of recipients:

1. Formless Affiliates and Subsidiaries

Access to your personal data may be provided to staff of Formless affiliates and subsidiaries. Such staff abide by statutory confidentiality obligations and, where required, additional confidentiality agreements.

2. AI Model and Cloud Service Providers

We use third-party service providers to deliver our core AI-powered services. These include AI model providers (for AI dialogue generation), automatic speech recognition (ASR) providers (for converting your voice input to text), text-to-speech (TTS) providers (for converting AI-generated text to audio), and real-time communication (RTC) providers (for audio/video transmission). We share only the minimum information necessary for these providers to perform their functions, and they are contractually prohibited from using your personal information for any purpose other than providing services on our behalf.

3. Other Service Providers

We may engage external service providers such as IT infrastructure providers, customer service providers, and other advisors working on our behalf. We carefully select and regularly monitor these providers, particularly with respect to their handling and safeguarding of personal information.

4. Law Enforcement and Government Authorities

To fulfil our legal obligations, we may be required to disclose information in response to subpoenas, court orders, or lawful requests from government authorities conducting investigations.

VI. International personal data transfers

Formless is a global business, and your personal data may be transferred to, and processed in, countries other than the country in which you are a resident. These countries may have different privacy and data protection laws to your country of residence.

Specifically, our APP servers and key systems are located in the United States, and our subsidiaries and affiliated companies and third-party service providers and partners operate around the world. This means that when we collect your personal data, we may process it in any of these countries. However, we have adopted appropriate safeguards to ensure that your personal data will remain protected in accordance with this Privacy Policy and our contractual commitments.

VII. Security

We use appropriate technical and organizational measures, including anti-virus software and encryption, to protect the personal data that we collect and process about you. The measures we use are designed to provide a level of security appropriate to the risk of collecting and processing your personal data.

Please note that while we have taken reasonable steps to protect your personal data, no website, Internet transmission, computer system, or wireless connection is secure. In the event of a personal data security incident, we will, in accordance with the requirements of applicable laws and regulations, promptly inform you of the following: the basic situation and possible impact of the security incident, disposal measures we have taken or will take, suggestions for your self-protection and risk mitigation, remedies for you, etc. We will timely inform you of the relevant situation of the event by email, letter, telephone, or push notification. When it is difficult to inform the personal data subjects individually, we will issue an announcement in a reasonable and effective manner. Meanwhile, we will also actively report the handling of the personal data security incident in accordance with the requirements of the regulatory authorities.

VIII. Marketing communications

We may send marketing communications to our users, including newsletters, emails, or promotional offers related to our Services. You can opt out the marketing communications through [*] .

Aside from Marketing Communication, please note that from time to time, you may receive some important service information that we believe is critical to the use of our Services. If you send us a request (e.g., via support email or via our feedback mechanisms), we reserve the right to publish it to help us clarify or respond to your request or to help us support other users.

IX. Third-party service providers and their services

Our APP may contain links to third-party websites, products, and services. You can choose whether to visit or accept websites, products, and services offered by third parties. We have no control over third-party privacy and data protection policies as such third parties are not bound by this Privacy Policy. Before you submit personal data to third parties, please refer to their respective privacy policies.

X. Artificial Intelligence

Our APP uses artificial intelligence technology to generate video content and provide interactive dialogue services. We want you to be aware of the following:

Ÿ AI-Generated Content. Content provided through the APP, including video content and dialogue responses, is generated by artificial intelligence and may not always be accurate, complete, or up to date. AI-generated content does not represent the views or opinions of Formless and should not be relied upon as professional, legal, medical, financial, or other expert advice.

Ÿ AI Model. Our AI services are powered by third-party AI model (such as Dola Seed Lite 2.0, provided by BytePlus). Your interaction content is transmitted to the model provider via API for processing. The model is deployed in Malaysia, and the data processed through the API is stored in the United States.

Ÿ No Model Training on User Data. We do not use your personal information or interaction content to train or improve AI models. Our third-party AI service providers are contractually restricted from using your personal information for model training purposes, unless explicitly disclosed to you. In principle, your data transmitted to our AI model provider is stored for no more than seven (7) days and then deleted.

Ÿ Content Safety. As required by the applicable laws and regulations, both your inputs and AI-generated outputs are subject to safety and compliance review to prevent the generation or dissemination of harmful, illegal, or otherwise objectionable content.

XI. Your Rights to Your Personal Data

We respect your rights to your Personal data. To the extent provided by applicable data protection laws, you may have the following right(s), including:

l Right to know/be informed as to the personal data or categories of personal data we have about you.

l Right to access a copy of the personal data we have about you.

l Right to correct/rectify inaccurate personal data that we have about you.

l Right to delete/erase personal data about you.

l Right to opt-out of sale or sharing of personal data to third parties.

l Right to restrict sensitive personal data - to limit the use and disclosure or to opt-out.

l Right of non-discrimination, because of your exercise of data protection rights.

To exercise any of the rights listed above, please contact us through the information set out in Section XIII below. We will verify your identity before processing your request. You may also designate an authorized agent to submit a request on your behalf by providing the agent with written permission and verifying your identity directly with us. Generally, we provide responses to the exercise of your rights free of charge. However, we may need to charge a reasonable fee if the request is manifestly unfounded or excessive, or if necessary and unavoidable costs are incurred. We will ensure the security of your personal data when you exercise the rights.

XII. Children

Formless Services are not directed to children. You must be at least 18 years of age, or the minimum age required to provide valid consent to the use of the Services under applicable law in your jurisdiction, whichever is higher. If you do not meet this requirement, you must not access or use the Services.

We do not knowingly collect, use, sell, share or disclose the personal data of children. If we discover that a child under the age of 13 has provided personal information to us, or that a user under the age of 18 has created an account in violation of our terms, we will take prompt steps to delete the personal information collected and terminate the account. If you have reason to believe that a child has provided personal information to Formless, please contact us at contact@formless.com.ai. Users under 16 must have permission from their parent or guardian to use our Services.

XIII. Contact us

If you wish to exercise your privacy rights listed in Section XI, or have any concerns or questions about this Privacy Policy or our data practices, please contact us at:

Email: contact@formless.com.ai

Tel:

XIV. Additional Disclosures for California Residents

The following additional disclosures apply where Formless is subject to the requirements of the CCPA, as amended by the CPRA, and the California Consumer Privacy Act Regulations (“CCPR”). These disclosures supplement the information provided in the preceding sections of this Privacy Policy.

A. Collection of Personal Data within the Last Twelve (12) Months

We have collected the following personal data from your using our Services within the last twelve (12) months.

B. Personal Data that has been Sold or Shared within the Last 12 Months

We have not sold or shared (as those terms are defined under the CCPA) any personal information of consumers within the last twelve (12) months.

C. Personal Data that has been Disclosed for a Business Purpose within the Last 12 Months

We have disclosed the following categories of personal information to third-party service providers for business purposes within the last twelve (12) months: