Privacy Policy

1. Who we are

Formulab AI (“we”, “us”) provides an AI-assisted cosmetic formulation application at www.formulabai.com (the “Service”). This policy explains what personal data we collect, how we use it, and your rights. We are the data controller for the personal data described here.

Formulab AI is a service of Zentroflow Ltd, a company registered in Scotland (company number SC887909), registered office 18 Kirkton Road, Neilston, G78 3HN. We are registered with the Information Commissioner's Office under registration number C2008169.

2. Information we collect

• Account information — your name and email address, collected when you create an account (via our authentication provider, Clerk).
• Content you create — the formulas, ingredients, suppliers, stock, batch records, notes, and documents (PDFs) you add to the Service.
• Chat and AI inputs — the messages and questions you send to the AI assistant.
• Payment information — handled entirely by our payment processor, Stripe. We do not store your card details; we retain only a customer/subscription reference and plan status.
• Usage data — basic technical data (such as log and request data) generated when you use the Service.

3. How we use your data

• To provide and operate the Service and your account.
• To generate AI formulation guidance in response to your inputs.
• To manage your subscription, billing, and access.
• To secure the Service and prevent misuse.
• To respond to your support requests.

Our lawful bases are the performance of our contract with you (providing the Service), our legitimate interests (securing and improving the Service), and consentwhere required.

4. Service providers (processors)

We share data only with the providers needed to run the Service:

• Clerk — authentication and account management (holds your name, email address, and sign-in metadata).
• Supabase — database and file storage for your content.
• Stripe — payment processing and subscription management.
• Anthropic — AI model provider that processes your chat and formulation inputs to generate responses.
• OpenAI — generates the embeddings used to search your uploaded documents.
• Vercel — application hosting.
• Sentry — server-side error monitoring. Error reports may include your account identifier and details of the request that failed.

These providers process data on our behalf under their own security and data-processing terms. We do not sell your personal data.

5. AI processing

When you use the AI assistant, your inputs (and relevant content from your knowledge base) are sent to our AI model providers to generate a response. Please avoid entering personal data you do not wish to be processed in this way. AI outputs are guidance only and may be inaccurate — see our Terms of Use.

Our model providers do notuse your inputs or the resulting outputs to train their models. They hold them only briefly (up to 30 days) for abuse monitoring, after which they are deleted from the provider's systems.

We do not make any decision about you that produces a legal or similarly significant effect using solely automated means. The AI generates formulation guidance for you to evaluate; it does not decide anything about you.

6. Data storage and security

Your content is stored in our dedicated Supabase project and is private to your account. We use access controls and rely on the security measures of our providers. No system is completely secure, but we take reasonable steps to protect your data.

7. Data retention

We keep your data for as long as your account is active, with these specific limits:

• Chat conversations — deleted automatically 24 months after you last used them.
• Your content (formulas, ingredients, suppliers, batches, documents) — kept while your account is active; you can delete any of it within the Service at any time.
• Closed accounts — all of the above is deleted within 30 days of account closure.
• Billing records — retained for 6 years after the transaction, as UK tax law requires.

You can delete your account and all associated content at any time from your account settings, or by emailing us.

8. Your rights

Under UK data protection law, you have the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate data;
• ask us to delete your data;
• object to or restrict certain processing;
• request a copy of your data in a portable format;
• withdraw consent where processing is based on consent.

To exercise any of these, email formulabAI@zentroflow.co.uk. You also have the right to complain to the UK Information Commissioner's Office (ICO).

9. Cookies

We use essential cookies required for authentication and to keep you signed in (set by Clerk). These are necessary for the Service to function; we do not use them for advertising.

10. International transfers

Your account content — formulas, ingredients, suppliers, batches and uploaded documents — is stored in the European Economic Area (Frankfurt, Germany), which UK law recognises as providing an adequate level of protection.

Our other providers (Clerk, Stripe, Anthropic, OpenAI, Vercel and Sentry) process data in the United States. Those transfers are made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, incorporated into each provider's data processing agreement with us. You can request a copy of the safeguards we rely on using the contact details below.

11. Children

The Service is intended for adults and is not directed at children under 18. We do not knowingly collect data from children.

12. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above.

13. Contact

Questions about this policy or your data can be sent to formulabAI@zentroflow.co.uk.