Privacy Policy

Who operates FormFold

FormFold is operated by Hornor Technology. Privacy questions and requests can be sent to support@hornor.tech.

What stays on your device

For the free digital-PDF workflow, PDF file bytes and the answers you enter remain in your browser. Completed PDFs and ZIP bundles are always generated locally and are not uploaded to FormFold.

The Merge & organize tool processes PDF bytes, field names and values, thumbnails, page selections, and generated output entirely in browser memory. It does not call the normalization API, OpenAI, or Turnstile. Closing or refreshing clears that unsaved work.

Optional paid cloud OCR

When cloud OCR is offered, it requires an account, a page-credit quote, and your confirmation. The recommended mode uploads temporary page images rendered by your browser while keeping the source PDF local. If you instead choose original-PDF mode, the complete source PDF is uploaded. Native Tesseract running inside FormFold’s isolated worker extracts printed text and coordinates, while OpenCV detects blank lines and boxes. This primary OCR path does not send page images to OpenAI or a per-page OCR provider.

Cloud OCR is intended for blank printed forms. FormFold rejects low-confidence results without asking you to map fields, and returns reserved credits for rejected or failed jobs. Automated handwriting and completed-form detection remains a launch requirement and may conservatively reject uncertain documents. Temporary inputs are deleted after terminal processing, with a 24-hour storage lifecycle rule as a backstop. Outages can delay immediate cleanup up to that backstop.

What is processed by the service

To recognize and combine fields, FormFold may send extracted field labels, nearby headings, page coordinates, form structure, inferred document titles, page counts, and opaque identifiers or hashes to the FormFold API. Use blank forms: existing text inside a PDF could be interpreted as form context and included in this metadata.

When automatic normalization requires it, this metadata may be sent to OpenAI. Cache hits and deterministic matches can avoid an OpenAI request. Except for cloud OCR input explicitly confirmed by you, FormFold does not intentionally send PDF bytes or the answers you type to its API or OpenAI.

Security, abuse prevention, and operational data

A random session identifier and your network address are processed transiently to enforce hourly limits. Microsoft Azure and Cloudflare may also process standard request and security logs. Application Insights receives bounded operational metrics such as event counts, outcome categories, page-count buckets, credit actions, token totals, latency, and estimated AI cost—not filenames, answers, OCR text, field labels, document titles, hashes, account identifiers, session identifiers, or raw network addresses as custom metric dimensions.

Optional Google Analytics

Google Analytics is disabled until you choose “Allow analytics.” If you decline, FormFold does not load the Google Analytics tag or send analytics events to Google. A strictly necessary first-party preference cookie remembers your choice for up to six months across FormFold’s subdomains. You can change it through Privacy & cookie settings.

After permission, FormFold sends bounded events such as a public page category, workspace arrival, analysis start, bundle generation, ZIP download, organizer use, and document or page counts within published limits. FormFold does not intentionally send Google Analytics PDF content, filenames, answers, form labels, document titles, hashes, query strings, referrers, or FormFold session identifiers. Google may process browser, device, session, and coarse geographic information. Google Analytics uses network addresses during collection and states that they are discarded before being logged.

Automatic page-view collection is disabled in code, advertising signals remain denied, and FormFold does not enable Google Signals through its tag. Google Analytics event-level retention follows the property’s configured retention setting; aggregated reporting may be retained longer.

Retention

Normalized schema cache entries expire after 90 days. Expired entries are removed by cleanup at startup and hourly, normally within one additional hour; service or database outages can delay physical removal until recovery. Cloud OCR input expires within 24 hours, while bounded job, credit, and provider-attempt accounting is retained for operational and financial records. AI-attempt accounting records are retained for 90 days, and daily aggregate usage records for 13 months. Operational monitoring follows the configured Azure retention and ingestion limits. Closing or refreshing the browser clears the unsaved intake state on your device.

Service providers

FormFold uses Microsoft Entra External ID for optional account authentication, with Google or other enabled identity providers; Microsoft Azure for hosting, database, monitoring, temporary cloud OCR storage, and worker compute; OpenAI for selected form-schema normalization; Cloudflare Turnstile for abuse prevention; and, only after permission, Google Analytics for product-usage measurement. An optional Azure Document Intelligence fallback will be disclosed before use if it is enabled later. When advertising is enabled on a free version, FormFold also uses Google AdSense and participating advertising technology providers to deliver and measure ads.

Advertising on free and paid versions

Free versions of FormFold may display third-party advertising. Paid versions, when available, will not display third-party ads. Advertising is kept separate from PDF selection, processing, preview, and download controls.

When ads are enabled, Google and its advertising partners may process information such as your network address, browser and device information, the page being viewed, approximate location, ad impressions and interactions, and cookies or similar local-storage technologies. Ads may be selected contextually or, where permitted and chosen through the available consent controls, personalized using activity or interests.

FormFold does not intentionally provide advertisers with PDF file bytes, extracted field labels, document titles, form answers, completed PDFs, or ZIP bundles, and those materials are not used by FormFold for advertising targeting.

Advertising choices

Where required, FormFold presents Google’s certified consent tool before serving advertising that relies on consent. Choosing “Do not consent” does not block access to FormFold. Depending on your location and choices, Google may serve personalized, non-personalized, limited, or no ads. Non-personalized ads can use cookies or local storage. Limited ads disable the use of personal data for advertising personalization, but still process technical information such as network addresses. If programmatic limited ads are enabled, Google also uses invalid-traffic-detection-only cookies and local storage.

You can revisit an available advertising decision at any time using Privacy & cookie settings. When advertising is not active, that control opens the analytics preference described above.

Optional accounts

Fill PDFs and Merge & organize remain available without an account. When enabled, optional accounts use Microsoft Entra External ID with Google or other configured sign-in methods. FormFold stores an internal account identifier, the Entra tenant and user identifiers, account status, subscriptions, feature entitlements, OCR credit balances, and bounded OCR job accounting. FormFold does not store passwords or payment-card data, and its API does not persist OAuth tokens. The browser uses session storage for authentication state and tokens; the identity providers may use their own necessary sign-in cookies.

Separate identities are not merged based on matching email addresses. Connecting or merging separate sign-in identities is not available during this migration. If you request deletion, access is disabled immediately; you may restore the account for 30 days, after which FormFold account records and the associated Entra customer profile are scheduled for deletion. Microsoft normally retains the deleted directory profile for a further 30 days before permanent removal. This does not delete your Google account or another external provider account. Outages can delay physical cleanup.

Sale or sharing of information

FormFold does not sell personal information. Some privacy laws may define disclosures used for personalized advertising as “sharing” or a “sale” even when no money is exchanged; where applicable, FormFold will provide the required notice and choices before enabling that advertising.

Your choices

Do not use cloud OCR if you do not want the selected page images or original PDF processed as described above. Contact support@hornor.tech about privacy questions or applicable data requests.