Privacy Policy

Rooks, a service of Formsort Inc. · Effective date: September 4th, 2026

We at Formsort Inc. ("Formsort," "we," "us," or "our") know you care about how your personal information is used and shared, and we take your privacy seriously. This Privacy Policy explains how we collect, use, and share information when you use Rooks and related services (collectively, the "Services").

Please read the following to learn more about how we handle your information. This Privacy Policy describes our practices regarding the information we collect when you use the Services. Where applicable law requires your consent for a particular practice, we will request that consent separately, and this Privacy Policy is not a substitute for it.

Your use of the Services is at all times subject to the Terms of Service, which incorporates this Privacy Policy. Any terms we use in this Policy without defining them have the definitions given to them in the Terms of Service.

1. What This Privacy Policy Covers

This Privacy Policy applies to information we collect when you use Rooks. It does not apply to third-party services you may access through or connect to our Services, which are governed by their own privacy policies.

We gather various types of personally identifiable information ("Personal Information") from our users, as explained below. We use this Personal Information internally in connection with our Services, including to personalize, provide, and improve our services, to allow you to set up a user account, to contact you, to fulfill your requests for certain products and services, and to analyze how you use the Services. In certain cases, we may also share some Personal Information with third parties, but only as described below.

Children's Privacy: As noted in the Terms of Service, we do not knowingly collect or solicit personal information from anyone under the age of 16. If you are under 16, please do not attempt to register for the Services or send any personal information about yourself to us. If we learn that we have collected personal information from a child under age 16, we will delete that information as quickly as possible. If you believe that a child under 16 may have provided us personal information, please contact us at hello@rooks.ai.

2. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of this Policy. If we make material changes, we will provide prominent notice before the changes take effect — such as by email to the address associated with your account and by notice within the Services — at least 15 days in advance where practicable. Please keep your account email address current so that you receive these notices.

If a material change expands how we use or share personal information that we collected before the change, we will not apply the new practice to that previously collected information without providing you prominent notice and, where required by applicable law, obtaining your consent. Changes otherwise apply prospectively from their effective date.

3. Information We Collect

Information You Provide to Us

Registration Information: When you sign up for a Rooks account to create, manage, or deploy forms, we collect and store your registration details, including your username, password, and email address.

Billing Information: If you make payments to us, we require certain billing details, such as your name, billing address, email, and payment information. We use trusted third-party payment processors and do not directly store or retain sensitive payment information provided by you or your users.

Form Responses and Metadata: When you use Rooks, your forms and the data collected through them (including form questions and responder submissions) are securely stored by default within our platform. We use third-party cloud infrastructure providers to host and securely store this data. You own the data you collect using Rooks. We do not sell or use your form responses for purposes unrelated to providing our Services to you, unless required by law or with your explicit permission.

Communication Information: We may communicate with you if you've provided us the means to do so. For example, if you've given us your email address, we may send you service-related emails about your use of the Services. We may receive confirmation when you open an email from us. This confirmation helps us make our communications with you more useful and improve our services. If you do not want to receive communications from us, please indicate your preference by emailing us at hello@rooks.ai.

Information Collected Automatically

Whenever you interact with our Services, we automatically receive and record information on our server logs from your browser or device, which may include your IP address, approximate geolocation data, device identification, "cookie" information, the type of browser and/or device you're using to access our Services, and the page or feature you requested.

Cookies: "Cookies" are identifiers we transfer to your browser or device that allow us to recognize your browser or device and tell us how and when pages and features in our Services are visited and by how many people. You may be able to change the preferences on your browser or device to prevent or limit your device's acceptance of cookies, but this may prevent you from taking advantage of some of our features.

If you click on a link to a third-party website or service, such third party may also transmit cookies to you. This Privacy Policy does not cover the use of cookies by any third parties, and we are not responsible for their privacy policies and practices. Please be aware that cookies placed by third parties may continue to track your activities online even after you have left our Services.

We may use this data to customize content for you that we think you might like, based on your usage patterns. We may also use it to improve the Services – for example, this data can tell us how often users use a particular feature of the Services, and we can use that knowledge to make the Services useful to as many users as possible.

Do Not Track and Opt-Out Preference Signals

Some browsers offer a “Do Not Track” signal. Because there is no uniform industry standard for responding to these signals, our Services do not currently respond to them. However, we do recognize and honor universal opt-out preference signals, such as the Global Privacy Control (GPC), as a request to opt out of any sale of personal information, sharing for cross-context behavioral advertising, or processing for targeted advertising, where required by applicable law. When we detect a signal from your browser, we will apply the opt-out to that browser and, if you are logged in, to your account. You can also manage cookies and similar technologies through your browser settings and any controls we make available.

4. How We Share Personal Information

We do not rent or sell your Personal Information in personally identifiable form to anyone, except as expressly provided below. We may share your Personal Information with third parties as described below:

De-identified Information: We may de-identify your Personal Information so that you are not identified as an individual, and provide that information to our partners. We may also provide aggregate usage information to our partners (or allow partners to collect that information from you), who may use such information to understand how often and in what ways people use our Services. However, we never disclose aggregate usage or de-identified information to a partner in a manner that would identify you as an individual.

Analytics: We use third-party analytics providers to understand how the Services are used, measure performance, diagnose issues, and improve functionality. These providers may collect device, browser, cookie, identifier, and usage information as described in this Privacy Policy.

Product Analytics and Session Recording: We use product analytics and session-replay technologies to understand how account holders interact with the Rooks form builder. These technologies may capture clicks, navigation, interface interactions, device information, and related technical metadata. Session recording applies only to logged-in account holders using the form builder. We do not record the sessions of patients or other individuals filling out forms, and submitted form responses are not captured by these tools.

Service Providers and Subprocessors: We engage third-party service providers to help us host, operate, secure, support, analyze, and improve the Services. These providers may include cloud infrastructure, authentication, payment processing, communications, customer support, security, analytics, session-replay, artificial intelligence, and AI observability providers. They may process Personal Information only as necessary to provide services to us and subject to applicable contractual restrictions. A current list of providers that process Customer Data on our behalf is available on our Subprocessor List.

User Profiles and Submissions: Certain user profile information, including your name and any content you have uploaded to the Services, may be displayed to other users to facilitate user interaction within the Services or address your request for our services. Your account privacy settings may allow you to limit the other users who can see the Personal Information in your user profile and/or what information in your user profile is visible to others.

Business Transfers: We may choose to buy or sell assets, and may share and/or transfer customer information in connection with the evaluation of and entry into such transactions. Also, if we (or our assets) are acquired, or if we go out of business, enter bankruptcy, or go through some other change of control, Personal Information could be one of the assets transferred to or acquired by a third party.

Protection of Formsort and Others: We reserve the right to access, read, preserve, and disclose any information that we believe is necessary to comply with law or court order; enforce or apply our Terms of Service and other agreements; or protect the rights, property, or safety of Formsort Inc., our employees, our users, or others.

5. AI (Artificial Intelligence) Usage

We use artificial intelligence (AI) capabilities within our Services to help you create, manage, and enhance forms and workflows. This includes assisting with content extraction from uploaded documents, analyzing form structure, improving form interactions, and automating parts of the form-building experience.

We use third-party AI model providers to support these features. To provide and support the features, these providers may process prompts, uploaded source materials, form structure and metadata, account identifiers, agent outputs, and related technical information.

We do not use your prompts, uploaded source materials, or AI outputs to train generalized AI models; our AI model providers and observability providers process this data solely to provide services to us.

We do not send form responses or data submitted by patients or other form respondents to AI model providers.

AI Observability: We use third-party observability providers to monitor the reliability, quality, and safety of our AI features. This may include processing prompts sent to the form-building agent, agent outputs, timestamps, feature usage, error states, and related technical metadata. This monitoring covers only the form-building experience for account holders. Form responses and data submitted by patients or other form respondents are not included in AI observability logging.

The providers used for AI processing and observability can be identified on our Subprocessor List.

6. Security of Personal Information

Your account is protected by a password for your privacy and security. You must prevent unauthorized access to your account and Personal Information by selecting and protecting your password appropriately and limiting access to your computer or device by signing off after you have finished accessing your account.

We endeavor to protect the privacy of your account and other Personal Information we hold in our records, but unfortunately, we cannot guarantee complete security. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of user information at any time.

7. Your Rights and Choices

Through your account settings, you may access, and, in some cases, edit or delete the following information you've provided to us:

• Name and password
• Email address
• User profile information
• Forms and form configurations

The information you can view, update, and delete may change as the Services change. If you have any questions about viewing or updating information we have on file about you, please contact us at hello@rooks.ai.

U.S. State Privacy Rights: This section applies to residents of U.S. states with comprehensive consumer privacy laws — including California, Colorado, Connecticut, Texas, Virginia, Oregon, and others — and supplements the rest of this Privacy Policy. Your rights, and the terms used to describe them, vary somewhat by state; we describe them together here and will honor the rights available to you under the law of your state.

A note on form respondents: If you submitted information through a form created by one of our customers, we process that information on behalf of that customer — as a service provider or processor under applicable state privacy laws and, where we have entered into a Business Associate Agreement with a customer subject to HIPAA, as a business associate. Please direct requests about that information to the organization that created the form; we will assist our customers in responding as required by law. If your information is protected health information governed by HIPAA, your rights with respect to that information (such as access and amendment) are provided under HIPAA through the covered entity, and such information is generally exempt from the state privacy laws described in this section.

Categories of personal information we collect. In the last 12 months, we have collected the following categories of personal information from account holders, as described in Section 3: identifiers (such as name, username, email address, and IP address); commercial information (such as billing details and subscription history); internet or other electronic network activity information (such as usage data, cookie information, and interactions with the form builder, including session recordings of the form builder); approximate geolocation data (derived from IP address); and professional information (such as your organization). We collect this information directly from you and automatically from your browser or device, and we use it for the purposes described in Sections 1 and 3. We do not collect sensitive personal information as defined under these laws, except account credentials used solely for authentication.

Disclosure of personal information. We disclose personal information to service providers, processors, and contractors (including the categories of providers listed in Section 4 and on our Subprocessor List) for business purposes, such as hosting, payment processing, analytics, security, and providing AI features. We do not "sell" personal information, we do not "share" personal information for cross-context behavioral advertising, and we do not process personal information for targeted advertising. We have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age.

Your rights. Subject to certain limitations and depending on your state of residence, you have the right to: (1) confirm whether we process your personal information and access it, including, where applicable, in a portable format; (2) correct inaccurate personal information; (3) delete personal information; (4) opt out of the "sale" of personal information, "sharing" or processing for targeted advertising, and certain profiling in furtherance of decisions that produce legal or similarly significant effects; and (5) not receive discriminatory treatment for exercising these rights.

Exercising your rights. You may exercise these rights by emailing hello@rooks.ai or through your account settings as described above. We will verify your request, which may require you to confirm your identity via the email address associated with your account, and will respond within the time required by applicable law. You may designate an authorized agent to make a request on your behalf where your state's law permits; we may require proof of the agent's authorization and verification of your identity.

Appeals. If we decline to take action on your request, you may appeal by replying to our response or emailing hello@rooks.ai with the subject line "Privacy Request Appeal." If your appeal is denied, you may contact your state Attorney General to submit a complaint, using the contact method we provide in our appeal response.

California: Shine the Light. Under California Civil Code Sections 1798.83-1798.84, California residents may request certain information about disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes. You may submit inquiries to hello@rooks.ai.

Your Choices

You can always opt not to disclose information to us, but keep in mind some information may be needed to register with us or to take advantage of some of our features.

You may request deletion of your account by emailing hello@rooks.ai. Some information may remain in our records after your deletion of such information from your account. We may use any aggregated data derived from or incorporating your Personal Information after you update or delete it, but not in a manner that would identify you personally.

8. Data Retention

We retain your Personal Information for as long as your account is active or as needed to provide you with the Services. We may also retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

For customers with HIPAA compliance obligations, we will retain necessary audit logs and compliance-related records for a minimum of six (6) years as required by HIPAA.

9. Questions or Concerns

If you have any questions or concerns regarding our privacy policies, please send us a detailed message to hello@rooks.ai, and we will try to resolve your concerns.