Privacy policy.

This is a translation provided for convenience. If it differs from the Spanish version, the Spanish version prevails.

1. Summary

2. Who is responsible

The party responsible depends on the type of data:

If you are an Applicant, please also review the privacy policy of the organization you are giving your data to.

3. What data we process

About Applicants (on the Customer's behalf)

Whatever each Customer requests in its form. For example: name, national ID number (DNI), tax ID (CUIT or CUIL), email, phone, address, details of the company and its partners or representatives, documents (bylaws, ID cards, financial statements), drawn signature, liveness check images and the result of that verification. We also record the submission history (when it was created, submitted, corrected or decided).

About panel Users

Name, email, role, password (stored only as an argon2id hash), date of last access and an activity log of their actions on the platform.

Technical data

IP address, browser and device type, and the date and time of requests, used for security, abuse prevention and error diagnosis.

4. Biometric data (liveness check)

When a form includes a liveness check, the Applicant's camera captures a few images while they follow simple prompts (look straight ahead, turn, move closer). The Formsis face service analyzes those images to estimate whether a real person is in front of the camera.

• The images and result are stored with the submission so the Customer's reviewer can see them.
• They are not used to identify the person in other databases or to train models without authorization.
• They are not sent to external biometrics providers.
• Biometric data is sensitive data. The Customer must obtain your express consent before capture, and the camera only turns on when you allow it in your browser.
• The result is an aid for the reviewer: the decision on your application is made by a person.

5. What we use the data for

• Providing the Service: displaying forms, storing answers and documents, verifying identity and enabling review and approval.
• Sending operational emails: access links, receipts, correction and status change notices, team invitations and password recovery.
• Protecting the Service: detecting unauthorized access, rate limiting and keeping audit logs.
• Providing support and answering questions.
• Invoicing and managing the business relationship with Customers.
• Complying with legal obligations.

6. Legal bases

We process data on the basis of performing the contract with the Customer, the consent of data subjects (especially for sensitive data such as biometrics, which the Customer collects), compliance with legal obligations and our legitimate interest in keeping the Service secure. We are governed by Personal Data Protection Law No. 25,326 of the Argentine Republic, its Regulatory Decree No. 1558/2001 and the provisions of the Agency for Access to Public Information, and by the equivalent rules of other countries where our Customers operate, where applicable.

7. Who we share it with

We do not sell or rent personal data. We only share it with:

• The Customer that published the form, and the systems it configures to receive notifications (webhooks).
• Infrastructure providers that help us operate, under contract and only for that purpose:
  • Google Cloud (hosting of servers, database and files).
  • Resend (sending transactional email).
  • Google Analytics (visit statistics for the formsis.com informational website, never for the platform).
• Authorities, when required by law or court order.

We will keep this list up to date and notify Customers before adding providers that process Customer Data.

8. Where it is stored

Data is hosted on Google Cloud servers located in Santiago, Chile, and some providers, such as the email service, may process data in other countries (for example, the United States). These international transfers are made in accordance with article 12 of Law No. 25,326, with adequate contractual safeguards. Customers who need a different location can agree on a deployment on their own infrastructure.

9. How long we keep it

• Applicant data: for as long as the Customer determines according to its obligations (for example, anti-money laundering rules), while its account is active. When the service ends, the Customer has 30 days to export it, and it is then deleted.
• Unsubmitted drafts: may be deleted after a long period of inactivity.
• User data: while the account exists, and afterwards as needed to meet legal obligations.
• Technical logs: for short periods, unless needed to investigate an incident.

Backups are overwritten in their normal rotation cycles.

10. Security

We apply reasonable technical and organizational measures: HTTPS encryption on all traffic, argon2id passwords, access links stored only as hashes, role-based permissions enforced on the server, rate limits, file validation, audit logging and internal services isolated from the internet. No system is infallible; if an incident affects personal data, we will notify the Customer and the authorities as required by law.

11. Your rights

You may request access to your data, its rectification, deletion, objection to processing, portability and temporary blocking, and you may withdraw your consent when it is the basis for processing.

• If you are an Applicant: send your request to the organization that published the form. If you write to us, we will forward it to them and help them respond.
• If you are a User or Customer: write to us at [email protected].

We will respond within the legal deadlines: 10 calendar days for access and 5 business days for rectification, updating or deletion. The right of access is free of charge if exercised at intervals of no less than six months, unless a legitimate interest is shown.

The AGENCY FOR ACCESS TO PUBLIC INFORMATION, as the Supervisory Authority of Law No. 25,326, has the power to handle complaints and claims filed by anyone whose rights are affected by non-compliance with the rules in force on personal data protection.

12. Cookies

This informational website only stores one cookie, idioma, when you choose Spanish or English with the language switch, so it can show you that language on future visits. The platform uses only strictly necessary cookies, such as the one that keeps panel Users signed in. We do not use advertising or cross-site tracking cookies.

In addition, the informational website (not the platform) uses Google Analytics 4 to learn how many people visit it, from which country and which pages they read. It stores the _ga and _ga_* cookies, which identify your browser pseudonymously for up to 2 years. Google Analytics 4 does not store your IP address. We use this information only in aggregate, we do not combine it with other data and we do not use it for advertising. You can block these cookies in your browser or with the Google Analytics opt-out add-on, and the site keeps working the same.

13. Minors

Formsis is intended for organizations and adults. If a Customer needs to receive data about minors, it is responsible for obtaining authorization from their parents or guardians as required by law.

14. Changes to this policy

We may update this policy. We will publish the new version with its date on this page and, if the change is significant, notify Customers by email.

15. Contact

For any privacy question: [email protected].