FormWise

GDPR overview

The word GDPR appears nowhere on the site, on none of the fourteen pages reviewed. There is no EU representative under Article 27, no DPO and no dedicated data protection address; the single contact for any privacy question is hello@formwise.ai. No DPA is published or offered, no subprocessor list exists, and no standard contractual clauses or international transfer mechanism are mentioned. The only compliance wording is generic: We adhere to the relevant data protection regulations, and customers may request information about our compliance standards (User Access & Fulfillment Policy, 19 June 2026). The 6 October 2024 document lists none of the data subject rights — access, rectification, erasure, portability, objection — and mentions only account deletion. Hosting is declared exclusively in the United States. The minimum age of 13 is the US COPPA threshold, not a GDPR one.

Who owns the data?

The combined Privacy Policy / Terms Of Service dated 6 October 2024 contains no clause at all on ownership of the content customers create: SmartForms, CoPilots, Toolsets and Artifacts are simply never addressed. What the document does say is that Formwise LLC stores user session data, tool data and prompts on its own servers, and that it may screen prompts and inputs for usage-policy compliance. It collects names, emails, billing details, generated content, the forms created and the data they capture, plus IP, browser, device and OS data. Customers may not use the platform to build a competing product or reverse-engineer it. The marketing line Your methodology stays yours is a promise on a product page, not a contractual term.

Reuse rights

The contract lists broad purposes: delivering and improving the service, personalisation, troubleshooting, communication, answering requests, producing usage analytics and statistics, and meeting legal obligations. Disclosure is permitted with consent, to third-party service providers, on legal request and to protect the publisher's rights — and no subprocessor list is published. On the homepage FAQ the publisher states that Notebook knowledge stays inside FormWise, that it does not share customer data with model providers for training, and that end-user context in Toolset Notebooks is scoped per user and per Toolset. That commitment is narrow: it covers sharing with model providers only and says nothing about internal use by FormWise itself, and no opt-out mechanism is documented anywhere. As for the customer reusing what the platform produces, the terms are silent: beyond the ban on building a competing product or reverse-engineering the platform, nothing grants or restricts reuse of the Artifacts generated. Note also that the 2024 text still refers exclusively to OpenAI while the 2026 product advertises Claude, Gemini and Mistral.

Data retention & training

Hosting summary

Formwise LLC states in its combined Privacy Policy / Terms Of Service that our servers, where all data collected and processed through our Service is stored, are located in North America, specifically in the United States, adding that no data is hosted abroad. There is no European data residency option and no choice of region. The public site sits behind Cloudflare (IP 104.21.66.73, anycast), but that is a CDN edge, not the storage location: the applicable jurisdiction is the United States. No hosting certification is cited, with neither SOC 2 nor ISO 27001 nor HIPAA appearing anywhere on the site. No subprocessor list is published; the terms refer to unnamed third-party service providers. The only technical measure described is the encryption of customer-supplied OpenAI API keys, which the publisher says it cannot access. For a European buyer, this means US jurisdiction with no disclosed transfer mechanism, no DPA and no Article 27 representative.