Privacy Policy

Effective date: June 2, 2026.

0. The two data sets — read this first

FormDFlow works with two fundamentally different kinds of data, and they are governed differently. The distinction matters, so we state it up front.

1. Public Form D filings (NOT your personal data, NOT covered by this policy as “your” data). FormDFlow ingests Form D and Form D/A filings from the U.S. Securities and Exchange Commission’s EDGAR system. These filings are public-domain federal disclosure — private companies are required to file them with the SEC when they raise capital under Regulation D, and the SEC publishes them as a free public record. We read EDGAR, normalize the filings, tag them by vertical and stage, and make them searchable and filterable. We do not own these filings, and surfacing them is not the subject of your privacy rights as a FormDFlow customer. SEC EDGAR is a public data source we read — it is not a sub-processor of your data (see §4).

2. Your account and customer data (private, protectable, the subject of this policy). When you create an account, configure saved filters, add teammates, or pay us, you give us information that is personal data: your email, your name, your organization, your filter configurations, your team/seat identities, and your billing identity. This data is private, and it is what this Privacy Policy governs. We treat it under the GDPR, the UK GDPR, and the CCPA/CPRA as applicable.

We never use “the filings are public” as cover for loose handling of your data. The Form D filings being public has no bearing on how we protect your account, your filters, your team data, or your billing identity. Those are private and are handled under the standards described below.

1. Who we are, and the scope of this policy

This Privacy Policy explains how Sleet Labs LLC (“Sleet Labs,” “FormDFlow,” “we,” “us,” or “our”) collects, uses, and protects the personal data of customers and visitors to the FormDFlow service.

What this policy covers: the personal data of our customers, account holders, team members, newsletter subscribers, and website visitors.

What this policy does not cover: the contents of public SEC Form D filings. Those are public-domain federal disclosures published by the SEC; we present and filter them, and we make no ownership claim over them. FormDFlow is not affiliated with, endorsed by, or sponsored by the U.S. Securities and Exchange Commission, and FormDFlow is not an investment adviser, broker-dealer, or registered securities professional. Nothing in our product constitutes investment advice. EDGAR is a free public resource operated by the SEC.

For the data Sleet Labs holds about you, Sleet Labs is the controller. The third parties listed in §4 act as our processors (sub-processors).

2. What we collect

We collect only what we need to run the service you signed up for.

Account and identity data

• Email address (your login identifier and the address we deliver to)
• Name (where you provide it)
• Organization / company name
• Authentication data — we support Google sign-in (OAuth); we receive the basic profile and email scope from Google and do not receive or store your Google password

Service-configuration data

• Saved filter configurations (e.g., vertical, geography, offering-size band, exemption type, keyword)
• Delivery preferences and destinations you configure (e.g., a Slack or Teams integration on eligible tiers)
• Team / seat data — the identities (email and role) of teammates you invite to your organization

Billing data

• Billing identity and subscription state. Card payments are processed by Stripe; we do not store full card numbers. We retain Stripe customer and subscription references and the entitlement state they reflect (e.g., tier, active/trialing).

Trial eligibility and acceptance

When we offer a trial, we process the initiating account and billing Organization references, prior subscription and trial history, trial start and original end, and confirmed cancellation or reversal. We record the accepted offer and Terms versions, the wording accepted, Stripe Checkout and subscription references, and verification and event timestamps to establish what was agreed and administer billing. These are private customer records, not public filing data.

We use this information to check trial eligibility, prevent duplicate enrollment, honor cancellation, resolve payment questions, and measure trial outcomes in internal reports. Accepting trial and recurring payment terms is separate from any optional consent to marketing. Declining marketing does not prevent enrollment or cancellation. Account or payment identifiers are not sent to public website analytics for trial measurement.

Usage, log, and device data

• Standard server and application logs (e.g., timestamps, IP address, user agent, requested routes, error events) used for security, debugging, abuse prevention, and operating the service
• Cookieless website-analytics events collected through Vercel Web Analytics, including the requested page or route, timestamp, referrer, approximate geography, device type, browser, and operating system. These events are aggregated and are not tied to your FormDFlow account identity. Vercel estimates daily unique visitors using a hash derived from request data; the hash resets after 24 hours and is not used to track you across days or websites.
• Delivery records (e.g., that a digest was sent, and to which destination) used to operate and troubleshoot delivery

Cookies and similar technologies

• Strictly necessary cookies for authentication and session management. See §9.
• We use no analytics, advertising, or product-telemetry cookies (see §9). Only strictly-necessary authentication/session cookies are set.

We do not intentionally collect special-category (sensitive) personal data, and we ask that you not put it into free-text fields such as filter keywords.

3. How we use your data, and our lawful basis

FormDFlow is a B2B service that you (or your organization) chose to subscribe to. We process your personal data for the following purposes:

Where we rely on legitimate interests, we have weighed those interests against your rights; you may object (see §7).

3.1 Transactional vs. commercial email

We distinguish two kinds of email, and treat them differently:

• Transactional / service email — receipts, password resets, security alerts, and account notices. These are not marketing and do not carry a marketing unsubscribe, because you need them to use the service.
• Commercial email — the daily digest and the free “Top 50 deals” newsletter. Both are commercial messages under the U.S. CAN-SPAM Act. Every commercial send carries a valid physical postal address, accurate sender and header identification, and a non-deceptive subject line. Each commercial send also carries a functioning unsubscribe that we honor promptly and the one-click List-Unsubscribe headers (RFC 8058) that mailbox providers require. Unsubscribing from commercial email does not stop transactional/service email.

4. Sub-processors

We use a small set of third-party service providers (“sub-processors”) to operate FormDFlow. Each processes only the data needed for its function. The list below is living documentation — our CISO owns the per-vendor due-diligence and Data Processing Agreement (DPA) review, and we update this list as vendors change. Our current sub-processor list is available on request; the tables below summarize it.

EDGAR is not a sub-processor. SEC EDGAR is a public data source we read — not a processor of your data. We send EDGAR no customer personal data. We send only the SEC-required User-Agent request header (which contains a FormDFlow support email, not customer data) when retrieving public filings, and we respect EDGAR’s fair-access terms (real-contact User-Agent and the rate limit). EDGAR therefore does not appear in the sub-processor table.

4.1 Sub-processors that handle customer personal data

4.2 Providers that process public Form D / public-record data, not customer PII

These providers support our enrichment of public Form D filings and the issuers and signatories named in them. Their classification was confirmed by our CISO: in the enrichment data we send them, they process public Form D and other public-record data only — never your account or customer PII. Brandfetch, and a small number of manually curated image hosts, additionally receive your IP address when your browser loads an issuer logo — disclosed under “Browser-side logo loading” below. (Form D issuers are private companies; the filings about them are the public record.)

Browser-side logo loading (your IP). Issuer logos on our filing and directory pages are loaded by your browser, which fetches each logo directly from the image host we have on file for that issuer. That host is almost always Brandfetch; for the small number of issuers whose logo we have manually curated, it may instead be another image host we selected (typically the issuer’s own brand source). Because these requests come from your device, whichever host is contacted receives your IP address and standard HTTP headers — a limited piece of your personal data. We therefore disclose these providers as third-party recipients; they are not sub-processors of your account data, which they never receive.

We minimize what we send: we set a no-referrer policy (they do not learn which page you were viewing), we attach no FormDFlow account or login information, and we use the response solely to render an issuer’s logo — we do not add tracking parameters, and we do not use these requests to profile or track you. We rely on our legitimate interest (Art. 6(1)(f) GDPR / UK-GDPR) in showing recognizable company branding on a public-record product.

What each provider does with the request is governed by its own privacy notice, not ours. For international transfers, Brandfetch’s operator is established in Switzerland, which the EU and UK recognize as providing an adequate level of data protection; for a manually curated host we apply the same minimization but cannot state a single transfer mechanism in advance. You can stop these requests entirely by blocking third-party image loading in your browser — a neutral placeholder is shown instead.

Why two tables. The §4.1 vendors touch your private account/customer data and are full sub-processors under GDPR/CCPA. The §4.2 providers see only data derived from public SEC filings (and queries about the issuers named in them) — not your account or customer data. The one exception is the transient IP address your browser reveals when it loads an issuer logo (see “Browser-side logo loading” below); that makes those providers third-party recipients of that request, not sub-processors of your account data. If a §4.2 provider’s role ever changes to touch your account/customer PII, it moves to §4.1 and gets a DPA.

Public signatory data. Some enrichment resolves the public professional profiles of the persons named in a filing’s public signature block (a signatory’s name → their public LinkedIn/company profile). A signatory name is a natural person, so this is personal data — but it is public SEC-record data, and the data subjects are the filing signatories, not you, our customer. We process this public-record personal data on a legitimate-interest basis to enrich public filings; the §4.2 providers never touch your account/customer PII.

We do not sell your personal data, and we do not share it with third parties for their own marketing.

5. International data transfers

FormDFlow and its sub-processors are primarily hosted in the United States. If you access the service from the European Economic Area, the United Kingdom, or Switzerland, your personal data will be transferred to and processed in the US and in other countries where our sub-processors operate.

Where we transfer personal data out of the EEA/UK/Switzerland, we rely on appropriate safeguards — typically the European Commission’s Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, or another lawful transfer mechanism — and we require our sub-processors to provide equivalent protections. The per-vendor mechanism is summarized in §4.1 (most providers are EU-US Data Privacy Framework–certified and/or rely on SCCs). Our primary data store (Supabase) is hosted in the United States (AWS us-east-1), so the EU/UK→US transfer analysis for that store rides the SCCs / UK-IDTA described above.

6. Data retention

We keep your personal data for as long as your account is active and for as long as we need it to provide the service, comply with our legal obligations, resolve disputes, and enforce our agreements.

• Account, filter, team, and billing data — retained for the life of your account.
• After account closure — we delete or anonymize your personal data after a short deletion grace window, except where we must retain limited records (e.g., for tax, accounting, or legal-compliance reasons) or in backups that age out on a rolling schedule.
• Deletion grace window — 30 days after closure or a deletion request before permanent deletion, allowing accidental-deletion recovery and orderly off-boarding.
• How erasure works today — we honor a verified deletion request by removing your data administratively, on request through our contact form, within the window above. We do not currently offer a self-serve “delete my account” button; erasure is handled by our team (a self-serve control is on our roadmap).
• Logs — operational and audit logs are retained for up to 12 months and then pruned; platform logs (Vercel/Railway/Supabase) follow each platform’s default retention.
• Website analytics — aggregated Web Analytics events follow Vercel’s retention settings for our plan. The hash used to estimate a unique visitor resets after 24 hours.
• Trial records after account closure — when you use an offered trial, we keep a limited record for 12 months after account closure to prevent repeat trial enrollment and resolve trial billing questions. It contains a code derived from your verified email using a secret key, an internal organization ID, whether the trial was used, and the acceptance, cancellation and payment references needed to establish the agreement. The code lets us recognize the same email without storing the email address in this record. This record remains personal data and is not used for marketing. We then erase it unless a specific legal obligation or unresolved dispute requires longer retention. We document the reason and review the record when that obligation or dispute ends. This limited exception does not extend retention of your whole account.
• Billing records — retained as required by applicable financial/tax law even after account closure. Trial acceptance and cancellation evidence is kept only as needed to administer the agreement, resolve disputes, or meet a legal obligation. A deletion request does not itself cancel a Stripe subscription; please also complete cancellation through account billing or the Stripe portal. We review retained records when handling your request and explain any applicable retention exception. Contact us to exercise your rights under Section 7.

7. Your privacy rights

Depending on where you live, you have rights over your personal data. We honor these rights regardless of how public the underlying SEC filings are — your account data is yours.

7.1 If you are in the EEA / UK / Switzerland (GDPR / UK GDPR)

You have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data (“right to be forgotten”), subject to our legal-retention obligations
• Restrict or object to certain processing, including processing based on legitimate interests and direct marketing
• Portability — receive your data in a structured, commonly used, machine-readable format
• Withdraw consent at any time where we rely on consent (this does not affect prior processing)
• Lodge a complaint with your local supervisory authority (e.g., the UK ICO or an EU data-protection authority)

Response time: we respond to verified GDPR/UK-GDPR requests within 30 days. If a request is complex, we may extend this and will tell you within the initial 30 days.

7.2 If you are in California (CCPA / CPRA)

You have the right to:

• Know what personal information we collect, use, and disclose
• Delete personal information we hold about you, subject to legal exceptions
• Correct inaccurate personal information
• Opt out of the “sale” or “sharing” of personal information for cross-context behavioral advertising — note: we do not “sell” or “share” your personal information in this sense
• Non-discrimination for exercising your rights

Response time: we acknowledge CCPA/CPRA requests within 10 business days and respond within 45 days. We may extend by an additional 45 days where reasonably necessary, and will notify you of any extension.

7.3 How to make a request

Submit a request through our contact form, our path for privacy and data requests. We will verify your identity before acting on a request, and we will not charge a fee except where a request is manifestly unfounded or excessive. You may use an authorized agent where the law permits.

8. Security

We take the security of your account data seriously. Our controls include role-scoped database access (row-level security with a strict service-role boundary), least-privilege OAuth scopes, encryption in transit (HTTPS/TLS) and at rest (provider-managed), restricted webhook egress (SSRF defenses), idempotent billing-event handling, and audit logging. Our CISO owns the security program, vendor security review, and breach detection and response.

No method of transmission or storage is perfectly secure, but we work to protect your data and to maintain the safeguards described here.

9. Cookies and similar technologies

FormDFlow uses only strictly necessary cookies:

• Authentication / session — a first-party Supabase auth cookie that keeps you signed in (the service will not work without it).
• Third-party cookies appear on Stripe Checkout and the Google sign-in screen — on those providers’ own domains, for the flow you invoked.

Vercel Web Analytics collects aggregated page-view and visitor statistics without setting analytics cookies or tying events to a FormDFlow account identity. Its daily visitor hash resets after 24 hours and is not used to follow a visitor across days or websites.

We use no analytics, advertising, product-telemetry, or tracking cookies. Because we set only strictly-necessary cookies, no cookie-consent banner is required as the service is built today. If we ever introduce a non-essential cookie (e.g., analytics or marketing), we will obtain prior consent and add a consent banner before it is set. You can control cookies through your browser settings; disabling strictly necessary cookies may break sign-in.

10. Children

FormDFlow is a B2B service intended for business users. It is not directed to children, and we do not knowingly collect personal data from anyone under 18 — FormDFlow has no consumer or minor users. If you believe a minor has provided us personal data, contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date and, where appropriate, notify account holders by email or in-product notice. Continued use of FormDFlow after an update means you accept the revised policy.

12. Contact

Questions, requests, or complaints about this policy or your personal data:

Sleet Labs LLC
5830 E 2nd St, Ste 7000
Casper, WY 82609, USA
Contact form (a dedicated privacy@formdflow.com mailbox is being established)

See also our Terms of Service.