DRAFT — REQUIRES LICENSED ATTORNEY REVIEW BEFORE USE Prepared by D&M Business Solutions HR/Legal. Not legally final. See
README.mdfor open items.
Effective Date: [EFFECTIVE DATE TBD] Last Updated: [EFFECTIVE DATE TBD]
D&M Business Solutions, LLC ("D&M," "we," "us," or "our") operates FormPics (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect information about you ("Customer," "you," or "your") when you use the Service. It is incorporated by reference into our Terms of Service.
This Privacy Policy is required under Section 2.3.1(c) of the Smartsheet Developer Agreement and applies to all data we access via the Smartsheet API.
When you authorize FormPics to connect to your Smartsheet account via OAuth 2.0, we access the following Smartsheet data solely to provide the Service:
We access this data only as instructed by your configuration and only to the extent necessary to perform the photo-movement operation.
We automatically collect and retain metadata about Service operations, including:
This metadata is used for audit, billing, troubleshooting, and analytics purposes.
We use essential cookies and similar technologies to operate the Service, including session management and authentication state. We may use analytics cookies to understand aggregate usage patterns.
Attorney review needed: If third-party analytics (e.g., Vercel Analytics, Google Analytics) are deployed, a more detailed cookie disclosure and, for EU/UK users, a cookie consent mechanism may be required. Confirm current analytics stack with the engineering team.
You can control cookie settings through your browser. Disabling essential cookies may impair Service functionality.
We use the information we collect to:
We do not use your Customer Data or Smartsheet data for any purpose other than providing the Service to you.
Photos retrieved from your Smartsheet account are not retained beyond the time necessary to complete the photo-movement operation. Once a photo has been written into the designated Smartsheet cell, we do not retain a copy of the photo file. Processing metadata (timestamps, IDs, counts) is retained as described in Section 5.
We do not sell, rent, or trade your personal information or Customer Data to any third party.
We share information only as follows:
We use the following subprocessors to deliver the Service. Each subprocessor is bound by contractual obligations to protect your data:
| Subprocessor | Purpose | Location | |---|---|---| | Vercel, Inc. | Application hosting and delivery | United States | | Neon, Inc. | Managed PostgreSQL database (account data, processing logs) | United States | | Stripe, Inc. | Payment processing | United States | | Resend, Inc. (if applicable) | Transactional email delivery | United States |
Attorney review needed: Confirm whether Resend is currently in use. If additional subprocessors are added, this table must be updated and, for GDPR purposes, a Data Processing Agreement (DPA) must be in place with each.
We may disclose your information if required to do so by law or in response to valid legal process (e.g., a court order or government subpoena). Where permitted, we will notify you of such requests.
If D&M Business Solutions, LLC is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Service before your information is transferred and becomes subject to a different privacy policy.
We may disclose information where we believe disclosure is necessary to protect the rights, property, or safety of D&M, our customers, or the public, or to detect and prevent fraud or abuse.
| Data Category | Retention Period | |---|---| | Photos / form attachments | Transient — deleted upon successful completion of the processing operation | | Processing logs (timestamps, IDs, counts) | 90 days, then deleted or anonymized | | Account information | Until account deletion request, plus any legally required retention period | | Billing records | 7 years (US tax and accounting requirements) | | OAuth tokens | Until revoked by you or upon account termination; stored encrypted | | Security and audit logs | 90 days |
You may request deletion of your account and associated personal data at any time (see Section 7). Billing records may be retained as required by applicable law even after account deletion.
We implement reasonable technical and organizational measures to protect your information from unauthorized access, use, disclosure, alteration, or destruction, including:
No method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. In the event of a data breach that affects your rights, we will notify you as required by applicable law.
Depending on your location, you may have the following rights regarding your personal information:
California residents have the right to know what personal information we collect, use, and disclose; the right to delete personal information (subject to exceptions); and the right not to be discriminated against for exercising these rights. We do not sell personal information. To exercise your rights, contact us at privacy@formpics.com.
Attorney review needed: Confirm whether CCPA/CPRA applies based on D&M's revenue and data volumes. The thresholds under CPRA (effective Jan 2023) are: annual gross revenue >$25M; buys/sells/receives/shares for commercial purposes personal information of 100,000+ CA consumers/households per year; or derives 50%+ of annual revenue from selling/sharing personal information.
Attorney review needed: FormPics' current beta customer base is US and Australia. If EU/UK customers are onboarded, full GDPR compliance infrastructure is required, including: lawful basis analysis, Data Processing Agreements, Standard Contractual Clauses for US transfers, cookie consent (ePrivacy), and a Data Protection Officer assessment. This section should be expanded materially before EU customers are accepted.
If you are located in the European Union or United Kingdom, you may have additional rights under the GDPR or UK GDPR, including the right to object to processing, the right to restrict processing, and the right to lodge a complaint with a supervisory authority. Contact us at privacy@formpics.com to exercise these rights.
We are committed to complying with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) in relation to our Australian customers, including current beta customer Waratah.
Australian individuals have the right to:
If we do not satisfactorily resolve your complaint, you may contact the Office of the Australian Information Commissioner (OAIC) at https://www.oaic.gov.au.
Attorney review needed: Assess whether D&M meets the threshold for APP obligations (generally, entities with annual turnover >AUD 3 million, though some smaller entities are also covered). Confirm whether a Privacy Impact Assessment is advisable for the Smartsheet integration. Australian counsel should review this section.
To exercise any of the rights above, contact us at: privacy@formpics.com
We will respond to verifiable requests within the timeframe required by applicable law (e.g., 30 days under CCPA; 45 days under GDPR; 30 days under the Privacy Act 1988).
FormPics is hosted in the United States (Vercel and Neon infrastructure). If you are located outside the United States — including our Australian customers — your personal information and Customer Data will be transferred to and processed in the United States.
The United States may not have data protection laws equivalent to those in Australia or the European Union. By using the Service, you acknowledge this transfer. We take steps to ensure that your data is protected in accordance with this Privacy Policy regardless of where it is processed.
Attorney review needed: For Australian customers, assess whether the transfer of personal information to the US requires additional safeguards under APP 8 (cross-border disclosure). For any future EU/UK customers, Standard Contractual Clauses or another transfer mechanism will be required under GDPR Chapter V.
We obtain your consent to our data practices through:
You may withdraw consent at any time by revoking OAuth access (via Smartsheet account settings) and/or deleting your FormPics account.
The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a minor, we will delete it promptly. If you believe we have inadvertently collected information from a minor, contact us at privacy@formpics.com.
We use the following types of cookies:
We do not use third-party advertising cookies or cross-site tracking for marketing purposes.
Attorney review needed: If Vercel Analytics or any other analytics tool places cookies, document them here with names and durations. For Australian customers, assess whether the Australian Spam Act or Privacy Act requires specific cookie consent.
We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date and notify you by email (at the address associated with your account) or by a prominent notice within the Service at least 14 days before the changes take effect for material changes. Your continued use of the Service after the effective date constitutes acceptance of the revised Policy.
For privacy-related questions, data access or deletion requests, or to file a complaint:
D&M Business Solutions, LLC — Privacy [D&M Business Solutions, LLC mailing address] Email: privacy@formpics.com
For general support: support@formpics.com
For Smartsheet platform abuse: https://www.smartsheet.com/abuse
FormPics is an independent application. Smartsheet® is a registered trademark of Smartsheet Inc. FormPics is not affiliated with, endorsed by, or sponsored by Smartsheet Inc.