Privacy Policy

This policy explains how the current version of Formidify handles data during the beta. We will update it as the product changes and before any material new privacy-related feature launches.

Formidify is a Microsoft Word add-in that helps law firms fix formatting in legal documents. Because those documents are often privileged and confidential, Formidify was designed around one rule: the text of your document never leaves your machine. This policy explains exactly what that means, what little data our servers do handle, and the choices you have.

The short version

• Your document’s text is never transmitted anywhere. All formatting checks run locally, inside Word, on your computer.
• In offline mode, nothing leaves your machine at all. In online beta use, no document content is transmitted unless you choose AI analysis for eligible findings; the usage statistics listed in section 5 are always on as part of beta participation, and they are counts and categories, never text.
• With AI analysis switched on, Formidify transmits only limited structural tokens — style names, section-number tokens, font names, and short defined-term phrases — never sentences, clauses, paragraphs, file names, or document text. Defined-term phrases are sent as the phrase itself. They are not hashed, masked, stripped of entities, or checked for names, so a defined term can include a party name and may include personal data if the party is a natural person. These tokens are processed inside AWS (Amazon Bedrock) under a zero-retention configuration and are stored nowhere — the AI model’s provider never receives them.
• Our servers store your account identifier, your name and email address, formatting preferences, a structural change log (style and font names, never document text), usage statistics (section 5), support metadata, and detection reports you choose to send.
• No document text in anything we collect. This website uses Google Analytics for aggregate visit statistics (section 7) — with advertising features switched off, and never involving documents, because no document ever touches this site.

1. Who this policy covers

This policy applies to the Formidify Word add-in, the Formidify service that supports it, and this website (formidify.ai). During the beta, Formidify is offered only to U.S. law firms. Access is granted firm by firm: a firm receives the add-in only after entering into a beta agreement with us, and it is then deployed to that firm’s users by the firm’s own Microsoft 365 administrator. We are not inviting or onboarding firms in the European Union or the United Kingdom during the beta.

The service is provided, and the data described in this policy is controlled, by Formidify, Inc., 200 S. Andrews Ave., Ste. 600, Fort Lauderdale, FL 33301, USA.

If we begin offering Formidify outside the United States, or if the way applicable privacy laws apply to us changes, we will update this policy before that change takes effect.

2. Your documents

Formatting checks run on your machine

When you click Analyze, Formidify reads your document through Microsoft Word’s add-in interface and runs its formatting checks locally, in the Word task pane on your computer. Detecting typed section numbers, mixed fonts, numbering conflicts, and broken cross-references does not require any network connection, and no part of your document is uploaded to do it.

With AI analysis off: nothing from your document’s text leaves

AI analysis is optional and off in offline mode. When it is off, Formidify sends nothing from your document’s text and none of the structural tokens described below. What still travels is only what sections 3 and 5 describe: the corrections log’s before-and-after values (style and font names, typed section numbers) when you apply a fix, and the usage statistics (counts and numbering shapes). You can use the core of the product — analysis, review, and applying fixes — entirely offline.

With AI analysis on: limited structural tokens only

Some findings are ambiguous enough that rules alone can’t resolve them — for example, suggesting the correct target for a broken cross-reference. If you enable AI analysis, Formidify sends those specific findings to our server for AI processing. Before anything is sent, the finding is limited to these structural tokens:

• Style names — e.g. “Heading 2”, “List Paragraph”
• Section-number tokens — e.g. “Section 5.3”
• Font names — e.g. “Times New Roman”
• Short defined-term phrases — e.g. a defined term such as “Confidential Information” when a finding concerns it. A defined-term phrase is sent as the phrase itself. It is not hashed, masked, stripped of entities, or checked for names, so it can include a party name and may include personal data if the party is a natural person.
• Section headings, when you ask Formidify to add a section — the section numbers, levels and headings of the document’s outline, sent when you describe a section to add in the section map (section 4, “Section requests”), so the AI can work out where the section you describe belongs. A heading is sent as it reads; like a defined-term phrase, it can include a party name.

The sentences, clauses, paragraphs, file names, and document text are never part of this payload. This is enforced in the product’s design, and our automated test suite includes a check that raw paragraph text can never appear in the document-derived payloads — analysis, usage statistics, and detection reports. The support chat, the feedback form, and section requests carry text you chose to type, and are described in section 4.

What Formidify writes into your document

Three small records live inside the Word file itself, in the add-in’s own settings area. They never leave your computer and are not sent to our servers.

• Conversion record — written when you convert or restyle numbering: the Formidify version, the date, the name of the numbering style you chose, Word’s internal list identifier for the outline, the section count, and whether the change was made with Track Changes on. No document text. The next time you analyze, Formidify checks the record against the document and only relies on it if the numbering it describes is still there.
• Scan scope — the paragraph ranges you told Formidify to skip or include, remembered as a short text anchor (the first few words of the first and last paragraph of each range) and a short label, so they can be found again next time.
• Skipped issues — the issue cards you pressed Skip on, remembered as the kind of issue, its current value and a short text anchor (the first few words of the paragraph), so the next analysis can set them aside as “skipped last time” instead of presenting them as new. Accepting a card removes its entry.

Word’s Document Inspector and most firm metadata cleaners remove these records along with other add-in data. Formidify works without them; it just forgets what it did.

3. What our servers store

Our server logs record only the request method, the request path, response status, and timing — never request contents. (The path of a preferences request contains your account identifier, as it must to key your settings.) Our error handling is written so that request bodies are never written to logs.

4. AI processing

When AI analysis is enabled, the limited structural tokens described above are sent from our servers — never directly from your computer or browser — to Amazon Bedrock, an AWS service that runs AI models entirely inside AWS’s own infrastructure. During the beta, AI analysis is controlled at the user level: the first time an online scan finds AI-eligible issues, Formidify asks you before sending anything, remembers a decline, and lets you change the choice in Preferences. A tenant-wide administrator control to disable AI is planned but is not available yet. We use Bedrock with its zero-data-retention configuration: AWS does not store these inputs or outputs — nothing is written to durable storage, and nothing is used to train any model.

A distinctive property of Bedrock is that the AI model’s provider is never in the data path: the model runs in AWS-operated accounts that the model provider cannot access, so the provider does not receive, see, or retain anything Formidify sends. There is no third-party AI company holding your data, because none ever gets it.

All AI processing occurs within AWS’s United States regions (requests are served via AWS’s US-only inference routing and never leave the country). We keep Bedrock’s optional invocation-logging feature switched off, so no copy of AI requests or responses accumulates anywhere — not at AWS, and not with us. AWS processes this data as our subprocessor under the AWS Data Processing Addendum, which is incorporated into the AWS Service Terms.

Putting the layers together: your document’s text never leaves your machine (section 2); the limited structural tokens that support AI analysis exist only in transit and are retained nowhere; and the usage statistics we do keep are the counts and categories listed in section 5.

Ask Formidify (support chat)

The task pane includes an optional support chat for questions about using Formidify. When you type a question, the text you type and the chat’s earlier answers in this session — and nothing else from your document or computer — are sent to our servers. Your question is processed by the same zero-retention AWS Bedrock configuration described above: it is not stored by AWS or by us, and the AI model’s provider never receives it. We do not log the text of support-chat questions on our servers, and the conversation exists only in your task pane for the duration of your session. Answers come only from Formidify’s user manual and support knowledge base. We keep a count of chat questions asked (a number, never the text) as part of the usage statistics in section 5.

Please don’t include client names, matter details, or document text in a support question — the chat never needs them to help you.

Section requests (Add sections)

When a document’s sections are numbered automatically — converted by Formidify, or numbered by Word itself — the task pane’s section map lets you describe a section to add in plain language — for example “a new section after 2.1 called Renewal terms”. This feature needs AI analysis to be on; with it off, the map’s buttons still add sections and nothing is sent. When you press Preview, the sentence you type and the document’s outline — its section numbers, levels and headings — are sent to our servers and on to the same zero-retention AWS Bedrock configuration described above. The AI answers with one instruction (which section the new one follows, at what level, and a title if you gave one) or a question; the add-in shows you a preview, and nothing changes in your document until you press Insert. We do not log or store the sentence, the outline, or the answer. We keep counts of how requests turn out (a number, never the words) as part of the usage statistics in section 5.

5. Usage statistics

To improve Formidify — and to know whether it is actually saving you time — the beta add-in reports usage statistics to our servers as part of beta participation. There is not currently an individual user control for non-essential telemetry. These statistics are counts and categories only, never text. We publish the complete list here, so you can judge for yourself:

• Analysis results — how many issues of each type were found, whether AI-assisted analysis was switched on for the scan, and the document’s overall shape: its approximate size, the share of numbering that is automatic versus typed by hand, whether it counts as mostly manual, mixed, or mostly clean, how many sections appear to have no number, and whether the scan was focused on a part you highlighted.
• Review outcomes — how many suggestions of each type you accepted, skipped, or applied on the spot, and, when a one-click clean-up pre-accepted fixes (Fix this section, Clean up converted PDF), which clean-up it was and how many fixes arrived already accepted. (A frequently-skipped suggestion is a false alarm we need to fix.)
• Numbering conversion — the shape of the numbering pattern detected (for example “ARTICLE 1 / Section 1.1 / (a)”), whether it matched one of our built-in styles, whether the Convert offer was shown, whether you opened the preview and went ahead with the conversion, whether you kept your saved default scheme, which target style you chose, how many rows and sections converted, how many sections with no number we offered to number and how many you accepted, how long the conversion took (overall and per internal step, in milliseconds), and the category (and an internal code location) of any failure. This is how we learn which numbering conventions we should add and where conversions run slowly.
• Numbering restyle — when you put a document that is already numbered onto one of your saved schemes: whether you opened the preview and went ahead, whether the scheme was a saved one or used just once (never its name), whether the document goes deeper than the scheme, how many levels and sections changed or were unchecked, whether separate outlines were found and included, how long the restyle took (overall and per internal step, in milliseconds), and the category (and an internal code location) of any failure. This is how we learn whether restyle works on real documents and where it runs slowly.
• Adding sections — when you add a section from the section map, or give a section that has no number one: how you started it (the + button, the cursor, a typed request, or a flagged row), whether the map came from a Formidify conversion or from numbering Word already had, how many sections the map lists, how many sections on the map had no number, whether a typed request came back as a plan, a question, could not be placed, or did not send, whether it named a title and whether headings were included, the level you chose and how many sections renumbered, whether the insert went ahead, was cancelled, or failed (and the category and internal code location of any failure), and how long the insert took in milliseconds. Never the request text, the headings, or the title. This is how we learn whether describing a section in words works better than the buttons, and where it does not.
• Reliability — how long analysis took, the add-in version, your Word version and platform (Windows, Mac, or web), and error codes.
• Support chat — the number of questions asked in Ask Formidify (a count only, never the question text).
• Identifiers — your account identifier (the same one that keys your preferences), your organization identifier (the Microsoft 365 tenant your account belongs to), and a random document identifier so we can count unique documents without knowing anything about them. It is a random value, computed from nothing in your document, and it is not written into your document.

Usage statistics never include: any text from your document, heading or section titles, defined terms, file names, or the names of your firm’s custom styles (a custom style is recorded only as “custom”).

How this is enforced. In full transparency: for a few technical fields — the numbering-pattern shape, internal error categories and code locations — the “categories and shapes, never text” guarantee is applied by the add-in on your device before anything is sent, and our servers additionally cap every value’s length so no sentence or paragraph can fit. For fields with a fixed set of valid values (such as the chosen numbering style), our servers also reject anything unexpected. We do not re-inspect the open-ended shape and error-category fields on the server, because they have no fixed list to check against — they are kept safe by that on-device step and the length limit.

Because statistics are keyed to your account, they are usage data tied to you, not anonymous data. Formidify does not currently provide customer-firm administrators with a per-user usage dashboard, but we may later provide firm administrators with per-user usage views such as “time saved” or adoption metrics. If we do, we will update this policy before that feature launches. When we publish or share statistics outside your firm, we only ever do so in aggregate.

During the beta, these usage statistics are always on and are part of beta participation. If Formidify changes the telemetry collected, adds a telemetry control, or changes the default after beta, we will update this policy before the change applies.

Detection reports (you choose to send these)

If Formidify’s detection ever looks wrong — say the count of numbered sections seems too low — the pane offers a “Report it” button. Nothing is sent unless you click it and then confirm. A detection report contains, for each paragraph: any leading section-number prefix (for example “1.1” or “Section 4.2”), the built-in style name (a firm’s custom style is recorded only as “custom”), numeric scores and true/false formatting flags, a word-count range, and the decision Formidify’s detector made — plus, for the document as a whole, the numbering shapes the detector inferred (number formats and level templates, never titles), which part of the document each paragraph fell in, whether it sits in a table, Word’s own rendered number where there is one, which pane screen you sent it from, and a few counts. You can add a problem category from a fixed list and, optionally, a number (roughly how many sections you expected). Each report carries a random reference code shown to you, so support can find it if you follow up.

A detection report never contains document text, heading or section titles, defined terms, or file names — the report format has no free-text field, so there is no way to type or include them. The full report is shown to you on screen before you send it. Reports are tied to your account identifier (like the usage statistics above), and if a report can’t be sent — you’re offline, say — it is saved on your computer and sent automatically later. We delete detection reports within 90 days of receiving them.

Feedback (you choose to send it)

The pane’s menu has a Send feedback form. Unlike everything above, the message is text you type — that is the point of the feature, and it is the one place free text is stored. If you use it, we store your message, the category you pick from a fixed list, and the add-in version, together with your account identifier so we can follow up. Nothing from your document is attached — the form sends only what you type, and it asks you not to include client names or confidential document details. The optional note on a detection problem report (section 4) is sent the same way, tagged with the report’s reference code, and stored and deleted on the same terms. We delete feedback messages within 90 days of receiving them.

6. What we deliberately don’t do

• No document text in usage statistics, logs, or anywhere else — the statistics above are counts and category labels, and our database has no column for document text.
• No document content in logs — anywhere, ever.
• No selling or sharing of data — we do not sell, rent, or share your data with third parties for their own purposes.
• No advertising trackers on this website — the site uses Google Analytics 4 for visit statistics only (section 7), with Google Signals and ad personalization disabled. No ad networks, no cross-site tracking pixels.

7. Website analytics

This website (formidify.ai) uses Google Analytics 4 to give us visit statistics: how many people visit, which pages they view, and roughly where visits come from. The GA4 tag with measurement ID G-TEYPPJSDK9 is loaded asynchronously in the page head on every page, and it runs on page load. Google Analytics sets a first-party analytics cookie in your browser on page load so that a returning visitor is not counted as a new one.

We have configured it conservatively: Google Signals and ad personalization are disabled, so the data is not used for advertising or cross-site profiling. We do not currently use Consent Mode, a cookie banner, or a consent-management platform, and the site does not currently honor Global Privacy Control signals. GA4 runs without prior consent, and the site does not offer an in-site opt-out. GA4 uses its default IP-handling approach: your IP address is used to derive an approximate location and is not stored by Google Analytics. Granular location and device data collection is enabled. Analytics data is retained for 2 months. Analytics applies to this website only — the Formidify add-in reports the usage statistics described in section 5 and nothing else. And because this is a static informational site, analytics can never involve your documents: no document ever touches this website.

This website is publicly accessible from anywhere, including from outside the United States. This section describes analytics for every visitor to the site, and it is independent of the U.S.-only customer scope described in section 1 — a person may visit this website without ever becoming a Formidify user.

Google processes this data on our behalf, and Google’s own privacy policy applies to its processing. We treat GA4 website analytics as non-essential analytics. The site does not offer an in-product analytics opt-out; you can block analytics with your browser settings, a content blocker, or Google’s opt-out browser add-on, and the site works identically if analytics is blocked. GA4 is the only third-party script on the site. Video is self-hosted, and we do not use a third-party video player, fonts CDN, chat widget, heatmap, or client-side error tracker on the site.

8. Sign-in and authentication

Formidify uses Microsoft sign-in (via login.microsoftonline.com) to authenticate you. During sign-in your browser communicates directly with Microsoft; Formidify receives an authentication token that identifies your account, not your Microsoft credentials, and no document content is involved. From that token we keep the identifiers and account details listed in section 3, including your display name and email address. Microsoft’s own privacy statement governs the sign-in service itself.

9. Retention and deletion

• Your account identifier, preferences, corrections log, account-linked usage statistics, and support metadata are retained during beta participation and while your account is active. Specific post-beta and post-closure retention periods for account data, preferences, corrections logs, account-linked telemetry, support metadata, backups, and post-termination archives are being finalized, and will be stated in this policy before the beta ends.
• Detection reports (section 5) are deleted within 90 days of receipt.
• Feedback messages (section 5) are deleted within 90 days of receipt.
• AI analysis payloads are retained nowhere — see section 4.
• You can request deletion of your account data at any time by emailing support@formidify.ai; we will delete your stored preferences, corrections log, account-linked usage statistics, and support metadata, except where we are required or permitted to keep a record by law, need it to resolve a dispute or enforce our agreement with your firm, or need it to detect or prevent security incidents or fraud. A deleted record may also persist in our database’s routine point-in-time-recovery history for up to 180 days before it is overwritten. Statistics already folded into aggregate figures (which identify no one) remain in the aggregates.
• After an account is closed or the beta ends, we may retain limited account-linked records in backups or post-termination archives for security, legal, and operational purposes. The specific retention periods for those records are being finalized and will be reflected in an updated policy when set.

10. Your choices, and what is always on

• Keep AI analysis off. It is a user-level setting you control. With it off, no document text is transmitted — only the corrections log and the usage statistics described in sections 3 and 5 — and the rules-based checks still work. A tenant-wide administrator control to disable AI is planned but is not available yet.
• Work offline. In offline mode Formidify runs its rule-based checks with no connection at all.
• Know what you cannot switch off. The usage statistics described in section 5 are collected as part of beta participation, and there is currently no individual opt-out for them. They are listed in full in section 5 so you can see exactly what they are.
• Ask us anything. Questions about this policy or your data: support@formidify.ai.

11. Changes to this policy

We will update this page as the product evolves, and we will note the date of the latest change at the top. Material changes during the beta will be announced to beta participants by email. We will also update this policy before launching any customer-firm administrator usage dashboard, tenant-wide AI disable control, material telemetry change, or material post-beta retention period.

12. Contact

Formidify, Inc. · 200 S. Andrews Ave., Ste. 600 · Fort Lauderdale, FL 33301, USA · Email: support@formidify.ai · Website: https://formidify.ai/

Back to top ↑