Legal
Privacy Policy
This policy explains what data SpecFormula processes, why we use it, who helps us process it, and the choices available to you.
Effective: August 26, 2026
1. Who is responsible for your data
SpecFormula is the service and brand name used by the current service operator. The legal identity and contact details of the data controller will be updated before paid commercial launch.
Privacy questions and requests may be sent to hi@specformula.ai.
2. Data we collect
- Account data, such as your name, email address, profile, and authentication records.
- Workspace data, such as teams, projects, requirements, tests, files, and member roles.
- Billing data, such as plan, subscription status, invoice references, and limited payment-method details returned by the payment processor.
- Technical and usage data, such as IP address, device and browser details, logs, feature usage, and security events.
- Communications you send to us, including support requests and feedback.
3. How we use data
- Provide accounts, workspaces, collaboration, billing, support, and requested features.
- Authenticate users, prevent duplicate or fraudulent transactions, and protect the service.
- Send verification, transactional, security, and service-related messages.
- Diagnose faults, measure reliability, and improve product performance.
- Meet legal obligations and enforce our terms.
4. Legal grounds
Where applicable law requires a legal basis, we process data to perform our agreement with you, comply with legal duties, pursue legitimate interests such as security and service improvement, or based on consent. You may withdraw consent where processing depends on it, without affecting earlier lawful processing.
5. Service providers and sharing
We use providers that process data only to help operate the service, including:
- Supabase for account authentication and data infrastructure.
- Stripe and authorized billing partners for checkout, subscriptions, invoices, and payment-method data.
- Resend for account verification and transactional email.
- Hosting, infrastructure, monitoring, and security providers needed to deliver the service.
We may also disclose data when required by law, to protect users or the service, or as part of a business reorganization subject to appropriate safeguards. We do not sell personal data or share it for third-party behavioral advertising.
6. Payments and card information
Payment forms are provided by Stripe or an authorized billing partner. SpecFormula does not receive or store your complete card number or card security code. We may receive limited details such as card brand, last four digits, expiration month and year, billing status, customer identifiers, and invoice references so we can display and administer your plan.
7. Cookies and local storage
We use essential cookies and browser storage for authentication, security, feature settings, and interface preferences. These are needed for requested functionality. If we later add non-essential analytics or advertising technologies, we will update this policy and obtain consent where required.
8. Retention, security, and transfers
We retain data for as long as needed to provide the service, maintain security and audit records, resolve disputes, and satisfy legal obligations. Retention periods vary by data type and account status. Data that no longer needs to identify you may be deleted or de-identified.
We use reasonable administrative, technical, and organizational safeguards, but no online service can guarantee absolute security. Providers may process data in countries other than yours; where required, we use appropriate transfer safeguards.
9. Your choices and rights
Depending on your location, you may request access, correction, deletion, restriction, objection, portability, or withdrawal of consent. You may also have the right to complain to a privacy regulator.
Send requests to hi@specformula.ai. We may need to verify your identity and may retain information where law permits or requires it.
10. Children and policy updates
SpecFormula is intended for professional users and is not directed to children. If you believe a child has provided personal data without appropriate authorization, contact us.
We may update this policy as the service or legal requirements change. We will publish the new effective date and provide additional notice for material changes when appropriate.