Freeform Systems (“we”, “our”, “us”) respects your privacy. This policy explains what data we collect, why we collect it, and your rights regarding that data.
1. What we collect
- Email address — for authentication and communication
- Birth date, birth time, and birth place — to read your chart and generate your brand
- Business idea (optional) — to customize your brand
- Your belief statement and the conversation you have with our chat assistant — to write your brand; we keep the conversation with your brand (section 11)
- Payment information — processed by Stripe (we never see your full card number); we keep the Stripe customer ID that links your account to your Stripe payments and subscription
- Who referred you, if you arrived through someone’s referral link — to credit the person who referred you
- An email address you leave on a brand page when you are not signed in — to send you that brand’s link (kept 90 days, section 11)
- An email address you give to join a waitlist for a product that is not out yet — to tell you when it is
- If you send a gift: the recipient’s name and email address and your personal message — to email them the gift. Send a gift only to someone who would expect to hear from you
- IP address, browser type and country — recorded with your consent to process birth data, and for security
- Cookies and usage data — for authentication, locale, referral tracking, and analytics (with consent)
2. How we use your data
- Generate your personalized brand identity
- Show your brand in the public gallery and on the home page — only if you opted in when you made it. Turn it off or on any time under Share on your brand page; your birth date and city appear on the tile only with a second, separate yes, and your birth time never
- Every brand has its own page link. Anyone who has the link can open the finished brand — its name, story, images and colors, and its Sun, Moon and Rising signs and Human Design type — even if it is not in the gallery. Your birth date, birth time, birth place, belief and chat are never shown on it. Share the link only with people you want to see it
- Process payments via Stripe
- Send service emails (brand ready, receipts, your brand book, your Alive monthly brief, gifts and referral credit)
- Send marketing emails, which you can stop at any time (section 3)
- Improve our service through aggregated, anonymous analytics
3. Marketing emails
Besides service emails, we send marketing emails to account holders: reminders before an unpaid brand expires and after it has, a nudge if you signed up but never made a brand, occasional emails inviting you back, and our newsletter. You receive them unless you opt out; we do not ask first.
- Every marketing email has an Unsubscribe link in its footer. One click stops all of them, and the unsubscribe button some email apps show uses the same link
- You can also opt out by emailing hello@freeformsystems.ai
- If an email to you bounces or is marked as spam, we stop sending you marketing email
- Service emails are not marketing and keep coming after you opt out: receipts, the brand-ready email, your brand book, your Alive monthly brief, gifts, referral credit, and links you ask us to send
4. Why we may use it (lawful basis)
Each use of your data rests on one legal ground:
- Your account and sign-in — contract — we need it to give you the service
- Your chart and your brand (birth data, belief, chat) — your consent, given in the chat and again before your brand is made
- Payments, receipts and the records tax law requires — contract and legal obligation
- Service emails (brand ready, receipts, your brand book and brief) — contract
- Security, fraud and abuse limits (IP address, browser) — legitimate interest in keeping the service safe
- Error reports — legitimate interest in fixing what breaks
- Analytics cookies and usage events — your consent, through the cookie banner
- Showing your brand in the public gallery — your consent, only if you tick the box
- Marketing emails — legitimate interest; you can opt out at any time
You can withdraw consent at any time. That stops future use; it does not undo what was done before.
5. Data storage and security
Your data is stored in a PostgreSQL database hosted on Railway. Your birth data, belief and chat are used to calculate your chart and write your brand; they are never sold, and are shared only with the processors listed in section 9 that do that work. Generated files (images, PDFs) are stored on Cloudflare R2 at long, unguessable addresses that are not listed anywhere; paid downloads are served only to the brand’s signed-in owner.
6. Cookies
Essential cookies, always set: your sign-in session (next-auth), your language (NEXT_LOCALE), the referral that brought you (ref, 30 days), whether you have already seen the opening animation (origin_splash, 1 year), and your answer to the cookie banner (cookie_consent). Only if you accept analytics: where you came from (utm_source, utm_medium, utm_campaign, utm_content, first_source, first_landing) and your country (geo_country), each for 30 days, and anonymous usage events sent to PostHog. If you decline, none of these are set and no usage events are sent. To change your answer, open the menu and tap Cookie settings: we forget your answer, delete the analytics cookies above and ask again.
7. Your rights
To download your data or delete your account, use Account on your dashboard. To use any other right below, email hello@freeformsystems.ai from the address on your account. We reply within one month, or sooner where your law requires. We may ask you to confirm it is you.
EU, EEA and UK (GDPR)
- Access a copy of your data, and correct it
- Erasure, and restriction of use
- Portability — your data in a structured, machine-readable format
- Object to use based on legitimate interest
- Withdraw consent at any time
- We make no decisions about you by automated means alone that have legal or similarly significant effects
Thailand (PDPA)
- Access and obtain a copy of your data, and learn how it was obtained
- Receive or transfer your data in a readable format
- Object to collection, use or disclosure
- Have your data deleted, destroyed or made anonymous
- Restrict use, and have inaccurate data corrected
- Withdraw consent at any time
Brazil (LGPD)
- Confirm that we process your data, and access it
- Correct incomplete, inaccurate or outdated data
- Anonymisation, blocking or deletion of unnecessary or excessive data
- Portability to another provider
- Deletion of data processed with your consent, and revoking that consent
- Know who we share your data with, and what happens if you refuse consent
China (PIPL)
- Know and decide how your personal information is used, and restrict or refuse it
- Access, copy and transfer your information
- Correct and complete it, and have it deleted
- Ask us to explain how we handle it
- The close relatives of a person who has died may use these rights over that person’s data, for their own lawful interests
United States, including California (CCPA/CPRA)
- Know what personal information we collect, use and disclose
- Delete it, and correct it
- We do not sell your personal information or share it for cross-context behavioural advertising
- We use sensitive information (such as your birth details) only to provide the service you asked for
- Using a right will never change the price or quality of what you get
8. Right to complain
If you think we have mishandled your data, tell us first at hello@freeformsystems.ai so we can put it right. You can also complain to the data protection authority where you live — in the EU your national supervisory authority, in the UK the ICO, in Thailand the PDPC, in Brazil the ANPD, in China the Cyberspace Administration (CAC), and in California the California Privacy Protection Agency.
9. Third-party services
- Anthropic — writes your brand from your chart, belief and chat (anthropic.com/legal/privacy)
- fal.ai — generates your brand’s images from written descriptions (fal.ai/privacy)
- Stripe — payment processing (stripe.com/privacy)
- Resend — transactional email delivery (resend.com/legal/privacy-policy)
- Cloudflare — CDN and file storage (cloudflare.com/privacypolicy)
- Railway and Vercel — hosting for our database and website (railway.com/legal/privacy, vercel.com/legal/privacy-policy)
- Sentry — error reports so we can fix what breaks (sentry.io/privacy)
- Google — sign-in, only if you choose “Continue with Google” (policies.google.com/privacy)
- PostHog — analytics, only with consent (posthog.com/privacy)
- OpenStreetMap Nominatim — turns your birth place into map coordinates; only the place name is sent (osmfoundation.org/wiki/Privacy_Policy)
10. International transfers
The services in section 9 process your data outside your country. Anthropic, fal.ai, Stripe, Resend, Railway, Vercel, Sentry, Google and PostHog are companies based in the United States. Cloudflare stores files on its global network. OpenStreetMap Nominatim is run from the United Kingdom. Using the service means your data is transferred to these countries, whose laws may protect it less than yours. Email hello@freeformsystems.ai to ask which safeguards apply to a transfer.
11. Data retention
How long we keep each kind of data:
- Unpaid brands: the free hold lasts 48 hours. When it ends we keep the brand for one year — it stays on your link, and appears in the public gallery only if you opted in. Then it is hidden from everyone, and 30 days later we delete it with your birth details, belief, chat and images
- Purchased brands: for as long as your account exists
- Your account, and the record of what you agreed to and when: until you ask us to delete your account
- When you delete your account: from each of your brands we erase everything about you — your birth date, time and place, belief, business idea, chat, personality profile and founder brief — and delete its brand book, kit and Identity File. We keep the rest of the brand with nothing that links it to you: its name, story, images, colors and type, its Sun, Moon and Rising signs and Human Design type, and what was paid for it. Nobody can open it again, on its link or in the gallery, and we keep it for internal use only. An unpaid one is still deleted on the schedule above; a purchased one is kept with no end date
- An email address a signed-out visitor leaves to save a brand link: 90 days
- Email delivery records (sent, delivered, bounced, marked as spam): one year. We do not record whether you open an email or click its links
- Waitlist sign-ups: two years
To delete your account sooner, use "Delete my account" on your dashboard, or email hello@freeformsystems.ai. What then happens to your brands is in the list above.
12. Children
Freeform Systems is for people aged 16 and over. We refuse a birth date that makes you younger than 16, and we do not knowingly collect data from anyone under 16.
13. Changes
We may update this policy. Material changes will be communicated via email. Continued use after changes constitutes acceptance.
14. Contact
For privacy-related questions or data requests, email hello@freeformsystems.ai.
This page is published in English, Thai, Spanish, Portuguese and Chinese. If the versions differ, the English version governs.