Privacy Policy

Effective date: 31 July 2026

This Privacy Policy explains how DEFORM GEOSCIENCE LTD collects, uses, stores, shares and protects personal data when you use our websites, products and related services, including Faultwise and Deform.

We have written this policy to be clear and practical. If you have any questions, you can contact us at privacy@deform.app.

1. Who we are

DEFORM GEOSCIENCE LTD is the controller of personal data that we process for our own purposes. For some personal data in Faultwise customer content, we may instead act as a processor, as explained in section 4.

Company number: 16188177
Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
ICO registration reference: ZB928230

2. What this policy covers

This policy applies to:

the Faultwise website, accounts, web application, uploaded files and AI-assisted features;
the Deform website; and
requests for a Trial, Academic Access or Full Access, as well as meetings, support, sales and customer administration.

Deform is not currently available as a product. Its website currently allows visitors to submit enquiries and request early access. We will update this policy before Deform begins processing any additional personal data.

This policy does not replace any Terms of Service, Software Licence Agreement, Data Processing Agreement or other contract that applies to a customer’s use of our products.

3. What personal data we use and why

We collect only the personal data we reasonably need to provide and protect our services, communicate with business contacts and run our company.

Data	Why we use it	Main lawful basis
Contact and enquiry data – name, email address, organisation, role, form responses, meeting details and messages	To respond to enquiries, manage Deform early-access requests, arrange meetings and discuss our products	Steps requested before a contract; legitimate interests
Faultwise account data – name, email, password hash, organisation, role, verification status and account settings	To create and administer accounts, authenticate users and provide Faultwise	Contract; legitimate interests where the user represents a business customer
Customer content – uploaded geological or project files, prompts and generated outputs, which normally contain technical data but may incidentally contain personal data	To provide the analysis, visualisation and AI-assisted features requested by the user, subject to section 4	Contract; where we act as a processor, the customer determines the lawful basis
Service usage and technical data – IP address, request time, request path and status, browser or device information, session information, authentication events, error details and limited usage records	To operate the service, maintain security, enforce usage and access limits, detect account sharing and repeated misuse, investigate errors and prevent abuse	Contract; legitimate interests
Access and anti-abuse data – current and previous access types, access requests, usage allowances and related records	To manage access and prevent repeated misuse of free or restricted access	Contract; legitimate interests
Support and feedback data – contact details, messages, screenshots, files and technical information you choose to provide	To answer questions, investigate problems and improve reliability	Contract; legitimate interests
Billing and business records – business contact details, invoices, payment status, contracts and accounting records	To manage customers, payments, tax and accounting	Contract; legal obligation
Communication preferences – email address and opt-out status	To send relevant product updates and follow-ups and respect opt-out requests	Legitimate interests; consent where required

We may also use relevant information where necessary to comply with law, respond to lawful requests, resolve disputes or establish, exercise or defend legal claims.

We do not sell personal data or customer project data.

4. How Faultwise handles customer content

Faultwise is designed for geological and technical project data. It is not intended for the deliberate processing of personal data about identifiable individuals.

Users must not intentionally upload or submit personal data in project files or AI prompts unless we have first agreed the relevant data-processing terms in writing, including a Data Processing Agreement where required. Users must not upload special category personal data, criminal offence data or other sensitive personal data unless we have expressly agreed to that processing in writing.

Faultwise allows users to upload geological and technical data, including GOCAD TSurf (.ts), paired CSV geometry files and surface images such as GeoTIFF, PNG or JPEG. These files normally contain project data rather than personal data. However, limited personal data may appear incidentally in file names, surface names, headers, image metadata or AI prompts.

When Faultwise processes personal data in customer content solely on behalf of an organisation, that organisation decides why the data is processed and is the controller. We act as its processor for that specific processing and use the data only to provide Faultwise. Where this processing is intentional, the relevant data-processing terms must be agreed before the data is uploaded.

Faultwise currently:

stores uploaded files temporarily while the workspace is active;
deletes temporary workspace files normally within 35 minutes after a session becomes inactive, or when the session is reset or the service is restarted or redeployed;
does not provide long-term customer project storage;
keeps uploaded project files within the temporary Faultwise workspace and does not copy them into our general business systems; and
does not use customer files, prompts or outputs to train or fine-tune AI models or for general product training, benchmarking or internal datasets.

Authorised personnel may access limited customer content when reasonably necessary to provide support, investigate a technical or security problem, comply with law or protect the service. Access is limited to what is needed for that purpose.

5. Faultwise AI-assisted features

Faultwise includes an optional AI chat that answers questions about calculated fault metrics and related geological concepts. Nothing is sent to our AI provider unless a user submits a question in the chat. Uploading or analysing files does not by itself send data to the AI provider.

The AI chat provides explanations only. It does not make decisions about a user’s account, access, pricing or legal rights.

For each question, Faultwise sends:

the question;
a text table containing the name and calculated metrics for each fault in the current workspace – derived values, not the uploaded files themselves; and
instructions needed to generate the answer.

Faultwise does not automatically send raw uploaded files or account, authentication or billing data to the AI provider.

Our AI inference provider is Cerebras. Cerebras processes the request and returns the answer without persistently storing the input or output or using either to train or fine-tune models. Its automatic prompt cache may temporarily hold part of the input in isolated, non-persistent memory for up to one hour, after which it expires automatically. The cache is isolated to our Cerebras account and is not available to other Cerebras customers.

Faultwise does not save the text of AI questions or answers to our servers or database. Messages are displayed only on the current page and disappear when it is reloaded or closed. Previous messages are not included in later requests.

We keep a technical usage record for up to 24 months to manage usage allowances, monitor costs and reliability and investigate misuse. This record includes technical details about the request but does not contain the question or answer.

6. Cookies and technical data

Faultwise uses two cookies that are necessary for sign-in:

faultwise_auth keeps users signed in for up to 30 days or until they sign out; and
faultwise_2fa_pending is used only during two-factor sign-in and expires after five minutes.

On faultwise.app, these cookies are sent only over HTTPS and cannot be read by scripts running on the page.

The Deform website uses an embedded form provided by Tally. Tally states that its service uses only essential cookies.

We do not currently use website analytics, advertising cookies, tracking pixels, session replay tools or cross-site tracking.

Because we use only essential cookies, we do not ask for cookie consent. If we introduce non-essential cookies in the future, we will request consent where required.

Our servers keep limited technical logs, such as IP address, request time, request path and status, browser information, authentication or session information and error or security details. We use these logs only to operate, secure and troubleshoot our services, enforce access and usage limits and investigate account sharing or misuse. They are normally deleted within 30 days.

7. Service providers

We use a limited number of third parties to operate our products and business.

Provider	What it does	Personal data that may be involved	Where it processes data
Hetzner	Hosts Faultwise infrastructure, databases, technical logs and rolling backups, and hosts the Deform website	Account data, temporary customer content, service usage and technical data, and Deform website visitor technical data	Finland
Cerebras	Provides AI inference for Faultwise	The user’s question, calculated fault metrics and generated response	United States
Resend	Sends Faultwise account and service emails	Recipient email address, content of outgoing emails and delivery metadata	Ireland and the United States
Tally	Provides enquiry, early-access and feedback forms	Form responses and related technical data	European Union
Cal.com	Provides an external meeting-booking page	Name, contact details, booking information and related technical data	United States
Google	Provides business email, document storage, calendar and video meetings through Google Workspace	Business contact details, communications, documents and meeting information	Various countries, including the United States
ANNA	Supports invoicing, payments and accounting	Business and billing records	United Kingdom

We may also disclose relevant personal data:

to accountants, lawyers and other professional advisers where necessary;
to an investor, buyer or other counterparty during a genuine financing, sale or corporate transaction, subject to appropriate confidentiality protections; or
to regulators, courts, law enforcement or other authorities where required by law.

We do not disclose customer project files or confidential project data for marketing, investment or corporate discussions unless the customer has expressly agreed in writing to the specific use or disclosure, or disclosure is required by law.

8. International transfers

We are based in the United Kingdom, but some of the providers listed in section 7 process personal data in other countries. When this happens, we use safeguards recognised under UK data protection law.

Where personal data is processed in the European Economic Area, we rely on the UK’s adequacy regulations. For transfers to US providers covered by the UK Extension to the EU-US Data Privacy Framework, we rely on that framework. Where adequacy does not apply, we use contractual safeguards approved for UK transfers, including the UK Addendum to the EU Standard Contractual Clauses.

You can contact privacy@deform.app for more information or to request a copy of the safeguards used for a specific transfer.

9. How long we keep personal data

We keep personal data only for as long as it is reasonably needed for the purpose for which it was collected, including legal, security and accounting requirements.

Data	Typical retention
Faultwise temporary workspace files	While the workspace is active; normally deleted within 35 minutes after the session becomes inactive, or when the session is reset or the service is restarted or redeployed. Deleted files may remain in rolling backups for up to seven days
Faultwise AI chat history	Not stored in the Faultwise database; available only in the current browser session
AI usage records	Up to 24 months; includes tokens used, estimated cost, timing and request status, but not the question or answer. Deleted earlier if the account is deleted
Product usage events	Up to 12 months; includes actions such as imports, calculations, exports and use of product features, but not uploaded file content. Deleted earlier if the account is deleted
Faultwise account and access records	While the account or customer relationship is active, followed by a limited period where needed for support, security, dispute resolution or prevention of repeated misuse
Technical and security logs	Usually up to 30 days, unless a record is needed to investigate a specific security incident
Faultwise rolling backups	Up to seven days; used only to restore the service after a failure and then overwritten
Resend email data	Up to 30 days under Resend’s standard service retention
Enquiry, Deform early-access, Faultwise Trial, Academic Access, Full Access and sales records	Usually up to 24 months after the last meaningful interaction, unless they become part of an active customer relationship
Support, privacy enquiries, complaints and feedback records	Usually up to 24 months after the last interaction, unless still needed for an active issue, investigation or legal matter
Billing, tax and accounting records	Usually six years, or longer where law requires
Do-not-contact records	For as long as needed to respect your opt-out request

10. Security

We use technical and organisational measures designed to protect personal data. Depending on the system, these include:

password hashing;
secure authentication cookies;
email verification and password reset controls;
optional two-factor authentication for all Faultwise user accounts;
access controls and multi-factor authentication for our administrative accounts;
limiting access to production servers and databases to authorised personnel;
HTTPS encryption when data is transmitted between users, Faultwise and its service providers;
temporary rather than long-term storage of uploaded Faultwise files;
logging, rate limiting and security monitoring; and
reviewing the data protection and security terms of providers that handle personal data.

No system can be guaranteed to be completely secure. If a personal data breach occurs, we will assess it, record it and notify the ICO and affected individuals where UK data protection law requires us to do so.

11. Product and marketing communications

We may contact business users, existing customers, academic users and relevant professional contacts about their access, product updates, meetings or related services where this is appropriate in the context of our relationship. We use consent where required for marketing by email.

You can object to direct marketing at any time by replying to the message or contacting privacy@deform.app. We will stop sending marketing messages and may keep a limited do-not-contact record to make sure we respect your request.

Service and account emails – such as verification, password reset and important service or security notices – are not marketing and may still be sent where needed to operate Faultwise.

12. Your data protection rights

Depending on the circumstances, UK data protection law may give you the right to:

access personal data we hold about you;
correct inaccurate or incomplete data;
request deletion of personal data;
restrict or object to processing;
receive certain data in a portable format;
withdraw consent where we rely on consent; and
request human review of, and contest, a significant decision made solely by automated means.

These rights apply in different circumstances. For example, if you ask us to delete your data, we may still need to keep records required for tax or accounting, information needed for a legal claim or a minimal record of a marketing opt-out.

You can also ask us to delete your Faultwise account. When an account is deleted, its associated AI usage and product usage records are deleted with it. Residual copies may remain in backups for up to seven days.

To exercise a right, email privacy@deform.app. We may ask only for information reasonably needed to confirm your identity or clarify your request. We normally respond within one month. Complex requests may take longer, and we will tell you if an extension is needed.

13. Complaints

You can send a data protection complaint to privacy@deform.app.

We will acknowledge a complaint within 30 days, investigate it and provide updates and an outcome without undue delay.

You may also complain to the Information Commissioner’s Office at any time. You do not need to wait for us to complete our review.

Information Commissioner’s Office (ICO)

Website: https://ico.org.uk/

Telephone: 0303 123 1113

Depending on where you are located, you may also have the right to complain to your local data protection authority.

14. Automated decision-making

We do not currently make solely automated decisions that produce legal or similarly significant effects.

15. Children

Our websites, products and services, including Faultwise and Deform, are intended for people aged 18 and over. They are not directed at children, and we do not knowingly collect personal data from anyone under 18.

16. Changes to this policy

We may update this policy when our products, providers or processing activities change. We will change the effective date and provide additional notice where a change materially affects how we use personal data.

We will update this policy before introducing additional personal data processing for the Deform product.

17. Contact us

For questions, rights requests or complaints, contact:

DEFORM GEOSCIENCE LTD
71-75 Shelton Street
Covent Garden
London
United Kingdom
WC2H 9JQ

Email: privacy@deform.app