Privacy Policy

Operated by Forma Labs Technologies, LLC

1. Overview

Drya is an AI assistant for small businesses that work by appointment — clinics, salons, studios and similar businesses — operated by Forma Labs Technologies, LLC (“Forma Labs,” “we,” “us”). Drya answers customers' messages on the business's own WhatsApp number, keeps the appointment book, sends confirmations and reminders, and helps the business owner with notes and day-to-day questions.

This Privacy Policy explains what information Drya processes, why, how long we keep it, who we share it with, and the rights you have. It should be read together with the Drya Terms of Service and the Drya Data Deletion Instructions, both published on this site.

Drya is in a pilot phase and is offered first to small businesses in Brazil. This Policy covers three groups of people: business owners and their staff who use Drya (“businesses”); people who message a business that uses Drya (“clients”); and people who contact us, request a trial, or join the waitlist.

2. Who Is Responsible for Your Information

Clients' information — a client's name, phone number, appointment and the messages they send to a business — is controlled by the business the client contacted. The business decides why that information is processed and is the “controller” (in Brazil, the controlador). Forma Labs processes it only on the business's instructions, as the business's “processor” (operador), under the data-processing terms in the Drya Terms of Service. A client may send a privacy request to the business or to us; if it comes to us, we forward it to the business and help it respond.

For business accounts, trial and waitlist requests, billing, support correspondence and security records, Forma Labs decides the purposes of processing and is the controller.

Meta Platforms, Inc. and its affiliates (“Meta”) operate WhatsApp and the WhatsApp Business Platform that carries the messages. Meta processes information under its own terms and privacy policy, which we do not control.

3. Information We Process

3.1 Business accounts

The owner's name, the business's name, email address, the phone number of the WhatsApp line the business connects, a password (stored only as a hash) and a second sign-in factor (an authenticator code), the list of services the business defines (a fixed list of up to 20 names chosen by the business), business hours, settings, plan and billing status.

3.2 Clients and appointments

For each client of a business: name, phone number, the date and time of appointments, the service name chosen from the business's fixed list, and the booking status (requested, held, confirmed, cancelled). This is the information an appointment book needs, and no more.

Drya does not store the text of WhatsApp messages. When a client writes, Drya reads the message to work out what the client wants — for example, to ask for a time, confirm, or reschedule — and records only the result, never the words. When a client sends a voice message, Drya transcribes it, handles the transcript the same way, and deletes the audio once processed; a fail-safe deletes any audio within one hour regardless. Drya does not keep health information, clinical notes or any other notes about a client, for any kind of business.

Every message Drya sends to a client is a pre-written template, approved by the business and filled in by code (for example, with available times or a confirmed appointment). Drya does not write free-form text to clients.

3.3 Messaging records

WhatsApp message identifiers, timestamps, delivery and read events, which template was sent, and the identifiers of the business's WhatsApp Business Account and phone number. These records let us show that a message was delivered, bill correctly, and detect abuse; they do not contain message content.

3.4 Trial and waitlist requests

Name, email address, business name and type of business. For a trial request, also the business's website or Instagram and its WhatsApp number, which we use to check that the business is real before releasing a trial. We never ask for CPF, CNPJ, identity documents or payment details at this stage.

3.5 The owner's assistant features

When a business owner talks to Drya — by voice or text, in the desktop app or the phone app — the request is processed to answer it. A spoken request is transcribed; the recording is deleted after transcription and Drya's spoken reply is not kept. Voice notes the owner dictates in the desktop app are stored encrypted on the owner's own computer, never on our servers, and expire after 24 hours unless the owner saves them.

3.6 Optional connectors

A business owner may optionally connect their own email account (Gmail or Outlook) so Drya can send on the business's behalf, read incoming requests and help with email. Drya accesses a connected account only with the owner's OAuth authorization, only for the functions the owner enables. Access tokens are stored encrypted and deleted when the owner disconnects. All connectors are off by default.

3.7 Payments

Payments are processed by Stripe. We receive the billing name and email, plan, payment status, invoices, and the card brand and last four digits; full card numbers never pass through Drya. Stripe processes payment details under its own terms and privacy policy. Do not send card details over WhatsApp or in a conversation with Drya.

3.8 Technical and security records

IP address, device and browser type, sign-in events, security logs (which hold identifiers, not content), error reports, and usage counts per business (messages, minutes) used for billing, plan allowances and abuse prevention.

3.9 Support correspondence

What you send us when you contact support or make a privacy request, and our replies.

4. How We Use Information, and On What Basis

We use the information above to: provide Drya and keep the appointment book; interpret clients' messages (Section 5); send approved confirmations and reminders; sign businesses in securely and protect accounts; prevent fraud, spam and abuse, including rate limits and spending caps; bill for the service and meet tax and accounting obligations; respond to requests and support; handle security incidents; and comply with the law.

We measure how Drya is used only in aggregate counts (messages handled, bookings made). We do not use businesses' or clients' content to train AI models, and we do not permit our providers to do so.

We send marketing only to businesses that asked for it — for example, by joining the waitlist — and every such message includes a way to unsubscribe.

For processing subject to Brazil's Lei Geral de Proteção de Dados (Law 13,709/2018, “LGPD”), our legal bases are: performance of a contract (Art. 7, V) for providing the service to a business; legitimate interest (Art. 7, IX) for security, fraud prevention and service improvement in aggregate; compliance with a legal obligation (Art. 7, II) for billing, tax and legally required records; and consent (Art. 7, I) for the waitlist and marketing, which you may withdraw at any time. Where a business is a health practice, an appointment with it may be health data; the business relies on Art. 11, II, “f” (protection of health, in a procedure carried out by health professionals or health services), and Forma Labs processes that data only on the business's instructions and never for its own economic advantage (Art. 11, §4).

5. AI and Automated Processing

Drya uses AI to understand what a client's message asks for and to assist the business owner. Its replies to clients are fixed templates; AI does not compose free text to clients. To interpret messages, Drya uses Anthropic's Claude model through Anthropic's API. A Brazil-hosted model from Maritaca AI may be used as a fallback. Voice transcription runs on our own servers.

The text sent to a model is limited to what the task needs. Our AI providers process it under commercial terms that prohibit using it to train their models and that limit how long they retain it. Anything a model cannot interpret with confidence becomes a task for the business owner, never an automated action. No decision that produces legal or similarly significant effects on you is made solely by automated means; you may ask for human review of any automated outcome.

6. Who We Share Information With

We share information only with the providers needed to run Drya, each for its own function and under a contract:

Meta Platforms (WhatsApp Business Platform) — delivers messages between a business and its clients. Forma Labs is registered with Meta as a technology provider, and each business's WhatsApp Business Account is created and connected through Meta's onboarding. Meta processes messages under its own terms; it holds a message that could not yet be delivered for up to 30 days. Oracle Cloud Infrastructure, São Paulo, Brazil — hosting and database for the production service. Anthropic, PBC (United States) — interpretation of messages and of the owner's requests; Maritaca AI (Brazil) — fallback model. Stripe — payment processing. Google or Microsoft — only if the business owner connects an email account, and only within the authorization the owner grants. A transactional email provider — to send sign-in codes, reports and notifications.

We may also disclose information to professional advisers under confidentiality; to public authorities where the law requires it, within the limits of that requirement; and to a successor if Forma Labs is involved in a merger, acquisition or sale of assets, under this Policy. We do not sell personal information, do not share it for advertising, and do not use advertising or tracking SDKs in Drya.

This list is current as of the effective date. We update it when a provider changes and give notice of material changes.

7. International Transfers

The production service and its database are hosted in Brazil (Oracle Cloud Infrastructure, São Paulo). Forma Labs is a United States company, and our team operates and supports the service from the United States. Anthropic processes model requests in the United States. Meta processes messages under its Data Transfer Addendum. For information subject to the LGPD, transfers out of Brazil rely on the ANPD's standard contractual clauses (Resolution CD/ANPD 19/2024) or another mechanism permitted by LGPD Art. 33. Agreeing to our Terms is not, by itself, consent to an international transfer.

8. Retention

We keep information only as long as the purposes above require. Our current periods are:

Business account: while the account is active; deleted within 30 days after it is closed, except billing records. Clients and appointments: while the business is a customer and keeps them. The business can delete or export any client at any time. Deleted within 30 days after the business's account ends. Message text: not stored. Message identifiers and delivery events: six months — the period Brazil's Marco Civil da Internet requires for application-access records — then deleted. Audio of clients' voice messages: deleted once transcribed and processed, and in any case within one hour. The owner's spoken requests: recording deleted after transcription; the spoken reply is not kept. Trial requests: up to 90 days, then deleted. Waitlist entries: until you ask to be removed, or after 24 months without contact. Connector tokens: until the owner disconnects. Billing records: as long as tax and accounting law requires (generally five years in Brazil; generally seven years in the United States). Security logs: six months. Records of a security incident: five years, as the ANPD's rules require. Support correspondence: 24 months.

Backups are encrypted and access-restricted. Deletions and opt-outs are reapplied before a restored system sends anything, and backup copies expire on a rolling schedule within 30 days.

9. Security

We protect information with two-step sign-in for every business account, encryption in transit and at rest, strict separation between businesses' data, logs that record identifiers rather than content, confirmation by the business owner for any action beyond the approved templates, rate limits and spending caps, a pause switch that every sending path checks, restricted access for our team, and synthetic data only in development and testing. No system is completely secure, and we cannot guarantee absolute security.

If we confirm a security incident affecting your information, we pause the affected sending paths, assess it, inform the affected business within 24 hours of confirmation, and notify the ANPD and affected people within the legal deadline (generally three business days under Resolution CD/ANPD 15/2024) where the incident is reportable.

10. Your Rights

If you are in Brazil, the LGPD (Art. 18) gives you the right to obtain confirmation that we process your data and access to it; to correct incomplete, inaccurate or outdated data; to have unnecessary, excessive or unlawfully processed data anonymized, blocked or deleted; to data portability; to information about the public and private entities we share with; to information about the consequences of refusing consent, and to withdraw consent; to request deletion of data processed on the basis of consent; to request review of decisions made solely by automated processing; and to petition the Autoridade Nacional de Proteção de Dados (ANPD). We answer requests for confirmation and access immediately in simplified form, or within 15 days in a complete statement, and other requests without undue delay.

If you are in the United States, depending on your state you may have the right to access, correct or delete your personal information, to receive it in a portable format, to opt out of its sale or sharing (we do neither), to appeal a decision on your request, and not to be discriminated against for exercising these rights.

To exercise any right, email privacy@formalabstech.com or our Data Protection Officer (Section 15). We verify identity in proportion to the request and the sensitivity of the information, using an existing account or contact channel where possible, and never ask for more than is needed. For information controlled by a business (Section 2), we forward your request to that business and help it respond. Step-by-step deletion instructions are on the Drya Data Deletion Instructions page.

11. Children

Drya business accounts are for adults aged 18 or over. A business's clients may include children or adolescents whose appointments are made by a parent or guardian; the business is responsible for processing their information lawfully (in Brazil, under LGPD Art. 14), and Drya stores for them only the same minimal appointment information it stores for anyone: name, phone number, time and service.

12. Messages and Opting Out

A business that uses Drya must have its clients' permission to message them and must honor a request to stop. A client can ask the business to stop at any time; when a client opts out, Drya keeps only a minimal record of the number so it is not messaged again. Opting out of messages, disconnecting an integration and deleting information are different actions; tell us which one you want and we will explain what each changes.

13. Where Drya Is Offered

Drya is offered first to businesses in Brazil. It is not yet offered to businesses in the United States; when it is, we will update this Policy with the notices United States law requires. Drya is not directed to, and does not knowingly collect information from, people in the European Economic Area or the United Kingdom.

Drya is not designed to hold protected health information under the United States HIPAA rules, and Forma Labs does not currently offer a business associate agreement. A United States health provider should not use Drya for protected health information until we do.

14. Changes to This Policy

We may update this Policy. If a change is material, we will notify businesses through the service or by email before it takes effect, and obtain renewed consent where the law requires it. Prior versions are available on request.

15. Contact and Data Protection Officer

Forma Labs Technologies, LLC 2503D N Harrison St PMB 2104, Arlington, VA 22207-1640, United States Privacy requests: privacy@formalabstech.com Support: support@formalabstech.com General inquiries: info@formalabstech.com Data Protection Officer (encarregada, LGPD Art. 41): Adriana Cabral de Sousa — adrianacabral@formalabstech.com

Our Data Protection Officer communicates in Portuguese and in English. If you submit a privacy request to any of our other published inboxes, we route it to the privacy team without treating the routing as a new request date.