Privacy Policy

FORMPRENEUR LLC Ohio limited liability company Registered and mailing address: 6545 Market Ave. North, Ste 100, North Canton, OH 44721, United States Telephone: +1 330 494 1644 Privacy email: [email protected]

The address above is a registered-agent and virtual mailing address. Formpreneur’s founder and authorized operator may work from Türkiye, the United Kingdom, and the United Arab Emirates.

United Kingdom representative

For UK GDPR matters, our appointed UK representative is:

ALTUDEV LTD Attn: Alper Tunga 71–75 Shelton Street, Covent Garden London WC2H 9JQ, United Kingdom Email: [email protected] Telephone: +44 7935 581459 ICO registration number: ZB554985

You may contact Formpreneur or ALTUDEV LTD about a UK privacy matter.

This Policy applies to formpreneur.com, localized pages, customer dashboard, Free Invoice Generator, formation and compliance Services, invoice tools and APIs, support interactions, and the administrative systems used to operate the Services, including internal administration through admin.formpreneur.com.

Formpreneur is generally the controller of information used for Accounts, formation, EIN assistance, payments, security, communications, tax preparation, analytics, compliance, and platform administration.

For personal information a customer enters about an invoice recipient, the customer generally acts as controller and Formpreneur acts as processor or service provider on the customer’s behalf, except where Formpreneur processes limited information for security, billing, legal compliance, or platform administration.

Paid Services are limited at launch to:

• A non-US tax resident
• One natural-person owner
• 100% ownership
• Default disregarded tax classification; and
• A supported New Mexico, Wyoming, or Florida LLC.

We do not offer multi-member formation or Form 1065 at launch.

Formpreneur does not collect through the supported launch workflow:

• Social Security numbers
• Individual Taxpayer Identification Numbers
• Passports
• National identity cards
• Government identification-document copies; or
• Full payment-card numbers or security codes.

The Managed tax workflow may collect a foreign tax identification number where applicable.

4.1 Account and contact information

We may collect:

• Name
• Email address
• Telephone number
• Hashed password credentials
• Authentication, session, one-time-code, locale, consent, and security records; and
• Information received from Google or X sign-in, depending on the permissions you authorize.

4.2 Formation and Company information

We may collect:

• Country of residence
• Citizenship or nationality
• Full residential address
• Desired and alternative LLC names
• Selected state and package
• Business type and activity
• Company address and formation details
• Sole-owner name, address, residence, citizenship, and 100% ownership record
• Order, case, status, provider, document, registered-agent, address, and mail-service records; and
• Customer certifications about eligibility, sanctions, authority, and accuracy.

4.3 Electronic signatures

We may collect typed, drawn, uploaded, or other electronic signatures and related approval evidence.

We use signatures to prepare, execute, authenticate, transmit, and retain customer-approved records. We do not analyze signatures to create a biometric template or use them for biometric identification.

4.4 EIN and Form SS-4 information

We prepare Form SS-4 for the supported foreign-owner workflow and submit it to the IRS by fax.

We process information needed for the application, such as responsible-party name and address, Company information, business activity, formation date, reason for applying, and signature.

We store signed SS-4 records in private Cloudflare R2 storage configured with the European Union jurisdiction restriction. We use WestFax to transmit the form. We ordinarily retain the WestFax payload for approximately seven days after confirmed transmission and then delete it from the WestFax account.

4.5 Managed tax and annual-compliance information

For an eligible pro forma Form 1120 and Form 5472 service, we may collect:

• Company legal name, address, EIN, formation date, and tax year
• Owner legal name, residential address, country, and foreign tax identification number where applicable
• Business activity and countries of operation
• Revenue and expense summaries
• Capital contributions
• Owner withdrawals and distributions
• Expenses paid personally by the owner
• Reimbursements and owner-Company loans
• Amounts paid to or received from a related party
• Bank and payment-processor statements
• Invoices and transaction summaries
• Prior extensions, filings, and IRS correspondence
• State annual-report information
• Customer eligibility and accuracy certifications
• Draft and final returns
• Review, signature, submission, and transmission records; and
• Communications about the tax engagement.

Formpreneur does not provide bookkeeping. Customers must provide organized records.

Tax preparation and review may be performed by Alper Tunga from Türkiye on behalf of Formpreneur. We obtain a separate offshore tax-return-information consent where required before tax-return information is accessed for this purpose.

4.6 Registered-agent, address, mail, and document information

Our assigned registered-agent and mail provider may receive customer contact, residential-address, Company, and ownership information needed to provide filing, registered-agent, address, and mail services.

Mail may contain government, tax, banking, legal, or other correspondence. Formpreneur may store a copy of a scan in private R2 storage.

You may delete Formpreneur’s copy through available controls. This does not delete the provider’s separate copy or physical original.

We may also collect formation documents, government records, support attachments, logos, signatures, invoice PDFs, and file metadata.

We do not currently represent that every uploaded file is scanned by an antivirus or malware-detection provider.

4.7 Payments

Stripe collects card details directly through Stripe-hosted or integrated payment components. Formpreneur does not receive or store full card numbers or security codes.

We may receive and store:

• Stripe customer and Payment Intent identifiers
• Billing name and address
• Amount, currency, status, date, and Order information
• Card brand and last four digits where supplied
• Refund, dispute, fraud-review, renewal, and reconciliation records; and
• Subscription status after a customer separately opts into annual renewal.

Stripe Radar may perform automated risk analysis. Formpreneur may conduct manual review.

4.8 Support and communications

We may collect contents and metadata of:

• Account, security, formation, document, compliance, and service emails
• Support tickets and attachments
• Managed WhatsApp support messages
• Essential SMS messages
• Marketing consent, preference, unsubscribe, and suppression records; and
• Customer service and complaint records.

We use Resend for email delivery and Twilio for essential SMS. We never use SMS for marketing.

Sensitive formation and tax documents must be submitted through the authenticated website, not WhatsApp or ordinary email.

4.9 Free Invoice Generator

The Free Invoice Generator is designed to operate in your browser. Invoice contents, client information, logos, signatures, and saved drafts are stored locally in browser storage and are not intentionally sent to Formpreneur’s backend.

Clearing browser storage may remove them. Consented analytics and ordinary infrastructure information about the page may still be processed, but we do not intentionally send invoice field contents to Google Analytics.

4.10 Account-based invoice tools

Eligible customers may use cloud invoice storage, PDF generation, API keys, uploaded logos, signatures, and other invoice features Formpreneur makes available.

Depending on use, we may process Company and recipient names, addresses, emails, invoice numbers and dates, line items, amounts, taxes, discounts, notes, logos, signatures, PDFs, API metadata, and security logs.

The customer is responsible for having a lawful basis to enter recipient information and for providing any required notice.

4.11 Information collected automatically

We and our infrastructure providers may process:

• IP address and approximate region
• Browser, device, operating system, and language
• Referrer, requested URL, timestamp, and diagnostic information
• Login, session, OTP, API, authentication, security, fraud, and error logs
• Cookie, local-storage, consent, and session identifiers; and
• CDN, firewall, network, and basic traffic data processed by Cloudflare.

4.12 Analytics and cookies

Google Analytics runs only on public marketing pages or public tools where the consented analytics configuration is enabled. It remains blocked until analytics consent is given.

We use it for basic visitor counts and website performance. We do not use Google Signals, User-ID, remarketing audiences, or Google advertising features.

User-level and event-level retention is configured for up to 14 months. Aggregated reports may remain longer. We do not intentionally send names, emails, phone numbers, formation-form contents, invoice contents, signatures, tax data, or document contents to Google Analytics.

We use Google Search Console for search visibility and website performance. Cloudflare provides infrastructure, security, and basic traffic analytics.

See the Cookie Policy for more detail.

We collect information:

• Directly from you
• From authentication providers you select
• From Stripe and other payment providers
• From the assigned filing, registered-agent, and mail provider
• From state authorities and the IRS
• From WestFax
• From banks or payment processors when you request support or authorize communication
• From public sanctions and business records; and
• Automatically from devices and infrastructure.

Depending on the location and context, we rely on contract, steps requested before contract, legal obligation, legitimate interests, consent, and establishment or defense of legal claims.

Our legitimate interests include operating a secure and reliable service, documenting transactions and filings, preventing fraud, providing support, maintaining records, and protecting legal rights without using personal information for targeted advertising.

7.1 Filing, government, and professional recipients

We may disclose information to:

• The assigned filing, registered-agent, address, and mail provider
• State filing authorities
• The Internal Revenue Service
• WestFax
• A bank or payment processor at your direction
• Professional advisers; and
• Courts, regulators, law enforcement, or other authorities where lawfully required.

The assigned provider is currently Northwest Registered Agent for the described launch workflow. It does not receive Formpreneur’s reusable signature file as part of the ordinary formation submission.

Some recipients act as independent controllers for parts of their work.

7.2 Technology and operational providers

We may use:

• Cloudflare for EU-jurisdiction R2 storage, DNS, content delivery, security, and basic traffic analytics
• Hetzner for dedicated server infrastructure in Finland
• Amazon Web Services for encrypted S3 backups in an EU region
• Stripe for payments, renewals, refunds, disputes, and fraud prevention
• Resend for email
• Twilio for essential non-marketing SMS
• Google for Analytics, Search Console, and Google sign-in
• X for X sign-in
• WestFax for fax transmission; and
• Self-hosted Better Auth, PostgreSQL, Redis, MongoDB, Gotenberg, and Coolify components.

7.3 Business transactions

Information may be disclosed in a merger, financing, acquisition, reorganization, insolvency, or asset sale, subject to appropriate confidentiality and legal safeguards.

7.4 At your direction

We may disclose information when you direct us, authorize an integration, request forwarding, or ask us to communicate with a provider.

• We do not sell or rent personal information.
• We do not share it for cross-context behavioral advertising.
• We do not use customer data or documents to train our or third-party AI models.
• We do not send customer formation, tax, mail, support, or invoice content to general-purpose AI providers for unrelated AI processing.
• We do not use SMS for marketing.
• We do not use signatures for biometric identification.
• We do not collect SSNs, ITINs, passports, or national identity documents under the supported launch workflow.

Formpreneur is established in the United States. Significant infrastructure is in the European Union:

• Self-hosted application and database infrastructure is on a Hetzner dedicated server in Finland
• Relevant R2 buckets use the explicit EU jurisdiction restriction; and
• Encrypted AWS S3 backups are stored in an EU region.

Authorized operational access may occur from Türkiye, the United Kingdom, and the United Arab Emirates. Tax preparation may occur from Türkiye.

Providers and recipients such as Formpreneur, the registered-agent provider, IRS, WestFax, Stripe, Resend, Twilio, Google, and X may process information in the United States or other countries.

Where required, we use an adequacy decision, contractual safeguards such as Standard Contractual Clauses, the UK Addendum or International Data Transfer Agreement, consent where legally appropriate, or another lawful mechanism.

You may contact us for more information about applicable safeguards.

We retain information only as reasonably necessary to provide Services, comply with law, resolve disputes, prevent fraud, meet sanctions and tax obligations, and preserve defensible records.

Deletion from active systems may not immediately remove an encrypted backup copy. Backup copies expire through the rolling lifecycle.

We may preserve information under a legal hold, active dispute, fraud or sanctions investigation, security incident, tax obligation, or other overriding requirement.

Measures include:

• Encryption in transit
• Private and encrypted object storage
• EU-jurisdiction R2 buckets for relevant files
• Encrypted backups with a rolling 90-day maximum
• Access controls and need-to-know administration
• Multi-factor authentication for administrative access
• Session, audit, security, and access logging
• Separation of customer, backend, and administration systems
• A Written Information Security Plan for tax information; and
• Secure dashboard-only tax-document submission.

No method is completely secure. You must protect credentials and API keys and notify us of suspected compromise.

We do not currently promise antivirus or malware scanning for all uploads. Do not upload unnecessary sensitive information or executable files.

Depending on location, you may have rights to:

• Access personal information
• Receive a portable copy
• Correct inaccurate information
• Request deletion
• Restrict or object to processing
• Withdraw consent
• Object to direct marketing
• Request transfer-safeguard information
• Appeal a refusal where applicable; and
• Complain to a regulator.

The app may allow data download, account correction, Company-information correction, invoice deletion, Formpreneur mail-scan deletion, reusable-signature removal, Account closure, and analytics-consent management.

Account closure does not automatically erase records retained for completed formation or tax work, payments, sanctions, fraud, disputes, security, or legal obligations.

We may verify a request through Account authentication, email confirmation, transaction information, or other reasonable means. We will not request a government identity document unless genuinely necessary and lawful.

EEA and UK

EEA and UK individuals may have rights including access, rectification, erasure, restriction, objection, portability, consent withdrawal, and complaint to a supervisory authority.

UK individuals may contact the UK representative in Section 1.

Service messages include security notices, Order confirmations, formation updates, document notifications, action-required messages, compliance reminders, renewal messages, and support responses. You cannot opt out of a message strictly necessary for an active Service.

Marketing email requires an appropriate lawful basis and generally separate opt-in. Every marketing email includes an unsubscribe method. Opting out of marketing does not stop service messages.

SMS is never used for marketing. It is reserved for crucial security, status, action-required, or compliance messages.

The Services are not directed to anyone under 18. Contact us if you believe a minor supplied information.

We may update this Policy and will post the revised version with a new date. We may provide additional notice for a material change.

Contact us first so we can investigate:

FORMPRENEUR LLC 6545 Market Ave. North, Ste 100, North Canton, OH 44721, United States Email: [email protected] Telephone: +1 330 494 1644

For UK matters:

ALTUDEV LTD — UK Representative Attn: Alper Tunga 71–75 Shelton Street, Covent Garden London WC2H 9JQ, United Kingdom Email: [email protected] Telephone: +44 7935 581459 ICO registration number: ZB554985

You may also complain to the privacy regulator in your country. In the United Kingdom, this is the Information Commissioner’s Office.