Data Deletion Instructions

Operated by Forma Labs Technologies, LLC

This page explains how to ask Forma Labs to delete personal information processed through Drya. It is for everyone whose information Drya processes — business owners who use Drya, and people who have messaged a business that uses Drya, whether or not they have a Drya account. It is the human-readable deletion route for Drya's WhatsApp integration with Meta.

1. Submit your request

Email privacy@formalabstech.com with the subject “Drya — Data deletion request.” Include: • The email address or phone number you used with Drya or with the business you contacted. • The business you contacted, if relevant. • Whether you want specific information deleted, or your Drya account and all associated information deleted.

You do not need a Drya account to make a request, and you do not need to explain why. Requests are free. If you cannot use email, write to support@formalabstech.com and we will arrange an accessible way to make the request.

Do not send passwords, payment-card details, identity documents or medical records in your initial request. A parent, guardian or authorized representative may request on another person's behalf; we will ask for reasonable proof of that authority.

2. Verification and timing

We acknowledge every request promptly and verify identity using only what is reasonably needed to protect the person concerned — where possible, an existing account or contact channel. We do not ask for excessive information or require you to create an account. If sensitive information is genuinely needed to verify a request, we will explain why and provide a secure way to send it.

We act on verified requests without undue delay and within the deadline the law that applies to you sets. For people in Brazil, under the LGPD we respond to a request for confirmation or access immediately in simplified form, or within 15 days in a complete statement, and act on deletion requests without undue delay. For people in the United States, applicable state laws generally require a response within 45 days, extendable once where the law permits. Verification is started promptly and does not restart these periods. If verification or a legal limitation prevents us from completing a request, our response explains the reason, the next step and your rights.

3. What deletion covers

Drya holds very little. For a client of a business: name, phone number, appointments and the chosen service. Drya does not store the text of WhatsApp messages, and voice messages are deleted once transcribed. For a business owner: the account, settings, client list, appointments, connector tokens and billing records. Depending on what Drya actually holds about you, deletion may cover any of these, plus support correspondence.

We delete information within our control when the law requires or permits it, stop any processing covered by a valid withdrawal of consent, and instruct the providers that process information on our behalf to delete their copies, following up until they confirm. We track the required downstream action ourselves; we do not tell you to contact providers when the duty to act is ours.

Clients' information is controlled by the business they contacted (see the Drya Privacy Policy, Section 2). We accept your request, explain who is responsible, forward it promptly to that business and help it respond; this does not reduce your rights against Forma Labs for the information it controls. Our response tells you which Drya copies and which independently held records are affected. Our actions do not close your WhatsApp account or erase records Meta or WhatsApp hold independently.

4. Backups and information we must keep

Information approved for deletion is removed from our active systems under the timing above. Backup copies are encrypted and restricted from ordinary use; they expire on a rolling schedule within 30 days, and if a backup is restored, deletions are reapplied before the system resumes ordinary processing. Deletion includes relevant archives and providers, not just hiding information in the interface.

We keep only information that the law requires or permits us to keep — for example, billing records required by tax law, records subject to a valid legal hold, or security-incident records the ANPD's rules require. Where we keep something, we tell you the category, the reason and the retention period or the criteria for it, unless the law prohibits disclosure, and we delete it when that requirement ends. We may keep a minimal, secured record that your request was handled. If you asked a business not to message you, a narrow suppression record of your number is kept so that the request is honored; it is never used to resume messaging.

5. Review, appeal and complaints

If we refuse all or part of your request, we explain the decision and your options. To appeal, reply to privacy@formalabstech.com with the subject “Drya — Privacy appeal” and your request reference; we review appeals and respond with reasons within the deadline the applicable law sets. We never penalize anyone for exercising privacy rights. Deleting information essential to an account or service may make that account or service unavailable; we explain those consequences before acting.

People in Brazil may petition the Autoridade Nacional de Proteção de Dados (ANPD) and use consumer-protection channels. People in the United States may contact their state attorney general or privacy regulator. Where the law requires us to provide a specific complaint mechanism, we include it in our decision. None of this limits your judicial or other legal rights.

6. Providers and integrations

Drya's production service is hosted by Oracle Cloud Infrastructure in São Paulo, Brazil. Messages are interpreted by Anthropic's Claude model, with a Brazil-hosted model from Maritaca AI as a fallback. Stripe processes payments. Your deletion request covers eligible Drya information held by these providers on our behalf, not only information on the server; we instruct them and follow up. Stripe may keep its own transaction records where the law requires; we tell you which billing information Drya keeps and on what legal basis. Do not send card details in a deletion request.

Integrations with Amazon Echo (Alexa) and Apple CarPlay are planned and not yet available. When one is released and you enable it, this same request route covers the Drya-held information connected to it. Disconnecting a device or integration is not the same as deleting information already collected; information Amazon or Apple hold independently is managed through their own privacy controls, and we carry out any downstream action the law requires of us. A business supplies its own phone line; deletion from Drya does not cancel that line or delete the business's independent WhatsApp account.

7. Brazil, United States and Meta

For Brazil, requests are handled under the LGPD, including Articles 18 and 16, and other applicable law. Withdrawing consent and deleting information are related but distinct; lawful retention exceptions may apply.

For the United States, we honor applicable deletion and related rights under federal and state law, including the California Consumer Privacy Act as amended by the California Privacy Rights Act and state consumer-health-data laws where they apply. HIPAA does not itself create a general right to erase medical records, and Drya does not hold them; a health provider's own record-keeping obligations are separate from Drya.

These instructions are available to everyone whose information Drya processes, including people who interact with a business without holding a Drya account, and they are the deletion route for the Meta integration.

Contact

Privacy and deletion: privacy@formalabstech.com Support: support@formalabstech.com General inquiries: info@formalabstech.com Data Protection Officer (encarregada): Adriana Cabral de Sousa — adrianacabral@formalabstech.com Forma Labs Technologies, LLC, 2503D N Harrison St PMB 2104, Arlington, VA 22207-1640, United States

If you send a privacy request to any of these inboxes, we route it to the privacy team without treating the routing as a new request date.