FormulasHQ

GDPR overview

GDPR is documented rather than certified. The privacy notice, last updated 21 December 2023, sets out the legal bases relied on under the GDPR and UK GDPR: consent, contract performance, legal obligation and vital interests. It lists the rights of residents of the EEA, the United Kingdom, Switzerland and Canada, namely access, rectification, erasure, restriction, portability, objection and the right not to be subject to automated decision-making. Complaints may be filed with a member state supervisory authority, the UK authority or the Swiss federal data protection authority. Transfers to United States servers rely on the European Commission's Standard Contractual Clauses, supplied on request, and consent can be withdrawn at any time. Requests go to hello@formulashq.com or through a data subject access request form. Two gaps: no Article 27 representative and no named data protection officer. CCPA, CPA, CTDPA, UCPA and VCDPA are covered separately.

Who owns the data?

The privacy notice belongs to BeSavee, Inc dba FormulasHQ and was last updated on 21 December 2023. The publisher collects names, email addresses, authentication data, billing addresses, card numbers, phone numbers, usernames, passwords and preferences, but card details themselves are stored by Stripe rather than by FormulasHQ. No sensitive information is processed and no personal data is received from third parties. Users keep practical control of their own record: account details can be edited or the account deleted from the settings screen, and deletion can also be requested directly. Files handled by Data Wizard and Campaign Intelligence never change hands at all, as they are processed inside the browser and are not uploaded to any server.

Reuse rights

The notice lists a closed set of purposes: creating and authenticating accounts, answering requests, sending administrative information, managing orders and protecting vital interests. For EEA and UK users the legal bases are consent, performance of the contract, legal obligation and vital interests. Sharing is limited to two situations, business transfers such as a merger, sale or financing round, and business partners. On the question everyone asks first, the FAQ is unambiguous: Your prompts and generated formulas are processed securely and not used to train AI models. Generation runs on Anthropic's Claude Sonnet 4.5, while in-chat file analysis uses OpenAI's Assistants API. The publisher states it has not disclosed, sold or shared personal information for a business or commercial purpose in the preceding twelve months, and commits not to. Do Not Track signals are not honoured.

Data retention & training

Hosting summary

The privacy notice is explicit: Our servers are located in the United States. Transfers into that jurisdiction from the EEA and the UK are covered by the European Commission's Standard Contractual Clauses, which the publisher says it will provide on request. No EU data residency option is offered, and no broader region is ever named, only that one country. Payment data sits outside the picture entirely, as card details are stored by Stripe. Two modules reverse the logic altogether: Data Wizard and Campaign Intelligence run DuckDB compiled to WebAssembly, so uploaded files are parsed, joined, filtered and queried inside the browser tab and never leave the device. Network checks place the website itself on Amazon infrastructure (AS16509) in the United States, an observation from DNS and IP lookups rather than a claim the site makes. No data processing agreement and no subprocessor list are published, so the hosting chain below that first level remains undocumented.