Privacy Policy
Effective date: 13 October 2026
This Privacy Policy explains how DEFORM GEOSCIENCE LTD collects, uses, stores, shares and protects personal data when you use our websites, products and related services, including Faultwise and Deform.
We have written this policy to be clear and practical. If you have any questions, you can contact us at privacy@deform.app.
1. Who we are
DEFORM GEOSCIENCE LTD is the controller of personal data that we process for our own purposes, including account administration, desktop licensing and support. For some personal data in Faultwise Online customer content, we may instead act as a processor, as explained in section 4.
Company number: 16188177
Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
ICO registration reference: ZB928230
2. What this policy covers
This policy applies to:
- the Faultwise website and Faultwise Online — our web application, including accounts, uploaded files and AI-assisted features;
- Faultwise Desktop — our installed application, currently provided as a demo for evaluation, including the administration and checking of demo licences;
- the Deform website; and
- Online access requests, desktop demo requests, meetings, support, sales and customer administration.
Deform is not currently available as a product. Its website currently allows visitors to submit enquiries and request early access. We will update this policy before Deform begins processing any additional personal data.
The sections below distinguish Faultwise Online from Faultwise Desktop because they handle project data differently:
| Product | How project data is handled | What we receive |
|---|---|---|
| Faultwise Online | Files are uploaded to our servers for analysis. Optional AI chat sends the information described in section 5 to our AI provider | Account data, temporary customer content and service usage and technical data |
| Faultwise Desktop | Files and calculations are processed locally on your computer. The application contacts our licence server to check access | Desktop licence check data. We also hold licence administration records and information you separately provide for enquiries or support |
This policy covers desktop demo requests and use, as well as free and paid access to Faultwise Online, whether or not a separate customer agreement has been signed. The account, upload and AI descriptions for Faultwise Online do not apply to local work in Faultwise Desktop.
This policy explains how we handle personal data. It does not grant permission for commercial use or set the permitted uses of a demo. Those matters are addressed in the applicable terms of use or licence agreement. This policy does not replace any Terms of Service, Software Licence Agreement, Data Processing Agreement or other contract that applies to a customer’s use of our products.
3. What personal data we use and why
We collect only the personal data we reasonably need to provide and protect our services, communicate with business contacts and run our company. The information involved depends on which product or service you use.
3.1. Enquiries, support and company administration
| Data | Why we use it | Main lawful basis |
|---|---|---|
| Contact and enquiry data – name, email address, organisation, role, form responses, meeting details and messages | To respond to enquiries, manage Deform early-access requests, arrange meetings and discuss our products | Legitimate interests; steps requested before a contract where applicable |
| Support and feedback data – contact details, messages, screenshots, files and technical information you choose to provide | To answer questions, investigate problems and improve reliability | Legitimate interests; contract where necessary to provide agreed support |
| Billing and business records – business contact details, invoices, payment status, contracts and accounting records | To manage customers, payments, tax and accounting | Contract; legal obligation |
| Communication preferences – email address and opt-out status | To send relevant product updates and follow-ups and respect opt-out requests | Legitimate interests; consent where required |
3.2. Faultwise Online
| Data | Why we use it | Main lawful basis |
|---|---|---|
| Online account data – name, email, password hash, organisation, role, verification status and account settings | To create and administer accounts, authenticate users and provide Faultwise Online | Contract where applicable; legitimate interests where the user represents a business customer |
| Online customer content – uploaded geological or project files, prompts and generated outputs, which normally contain technical data but may incidentally contain personal data | To provide the analysis, visualisation and optional AI-assisted features requested by the user, subject to sections 4 and 5 | Contract where applicable; legitimate interests in providing the requested service; where we act as a processor, the customer determines the lawful basis |
| Online service usage and technical data – IP address, request time, request path and status, browser or device information, session information, authentication events, error details and limited usage records | To operate and secure the service, enforce usage limits, troubleshoot errors and investigate suspected account sharing or misuse | Legitimate interests; contract where necessary to provide the requested service |
| Online access and anti-abuse data – current and previous access types, access requests, usage allowances and related records | To manage access and prevent repeated misuse of free or restricted access | Legitimate interests; contract where necessary to provide the requested service |
3.3. Faultwise Desktop
| Data | Why we use it | Main lawful basis |
|---|---|---|
| Desktop licence administration records – licence number, customer name or organisation, access type, issue date, expiry date and whether access is enabled | To issue and administer demo licences, manage access and its term, extend or reissue licences and provide support | Legitimate interests in administering requested access and supporting users |
| Desktop licence check data – licence number, public IP address, time of the check, application version and the result of the check | To verify licence status, apply access permissions, troubleshoot licence checks and investigate suspected misuse | Legitimate interests in administering desktop access and maintaining service security |
Desktop licence checks do not include project files, file or surface names, calculation results, exports or your local profile. They do not send the complete signed licence string to our licence server.
The customer name or organisation in our licence records is supplied when a licence is requested or issued. It is not read from your local desktop profile. Related contact details and communications are handled as described in section 3.1.
3.4. How we apply lawful bases
We rely on contract only where processing is necessary to perform an agreement with the individual whose personal data is involved, or to take steps that individual has requested before entering into an agreement. An agreement does not necessarily require a separately signed document. Where someone uses our services on behalf of an organisation, we do not assume that the organisation’s agreement also provides this basis for all processing of that person’s data.
Our legitimate interests include responding to requested enquiries, administering access, providing support, maintaining service security and investigating suspected misuse. Where we rely on this basis, we assess whether the processing is necessary and proportionate and balance our interests against the individual’s rights and interests. Free demos and Trials are subject to the same assessment; issuing a licence does not by itself establish a contractual lawful basis.
We may also use relevant information where necessary to comply with law, respond to lawful requests, resolve disputes or establish, exercise or defend legal claims.
We do not sell personal data or customer project data.
4. How Faultwise handles customer content
Both Faultwise products are designed for geological and technical project data. Files normally contain technical data, but personal data may appear incidentally in file names, surface names, headers or image metadata. What we receive depends on the product you use.
4.1. Faultwise Online: files processed on our servers
Users must not intentionally upload or submit personal data in project files or AI prompts unless we have first agreed the relevant data-processing terms in writing, including a Data Processing Agreement where required. Users must not upload special category personal data, criminal offence data or other sensitive personal data unless we have expressly agreed to that processing in writing.
Faultwise Online allows users to upload geological and technical data, including GOCAD TSurf (.ts), paired CSV geometry files and surface images such as GeoTIFF, PNG or JPEG. Personal data may also appear incidentally in AI prompts.
When Faultwise Online processes personal data in customer content solely on behalf of an organisation, that organisation decides why the data is processed and is the controller. We act as its processor for that specific processing and use the data only to provide Faultwise Online. Where this processing is intentional, the relevant data-processing terms must be agreed before the data is uploaded.
Faultwise Online currently:
- stores uploaded files temporarily while the workspace is active;
- deletes temporary workspace files normally within 35 minutes after a session becomes inactive, or when the session is reset or the service is restarted or redeployed;
- does not provide long-term customer project storage;
- keeps uploaded project files within the temporary Faultwise workspace and does not copy them into our general business systems; and
- does not use customer files, prompts or outputs to train or fine-tune AI models or for general product training, benchmarking or internal datasets.
Authorised personnel may access limited customer content when reasonably necessary to provide support, investigate a technical or security problem, comply with law or protect the service. Access is limited to what is needed for that purpose.
4.2. Faultwise Desktop: files processed on your computer
Faultwise Desktop imports files, performs calculations and generates visualisations and exports locally. It does not upload project files or calculation results to us. The server storage and 35-minute deletion period in section 4.1 apply only to Faultwise Online.
Desktop workspaces are temporary local working copies and are normally removed when the application closes. Working copies left after a crash are cleaned up on a later launch. Your original files and exports saved outside the temporary workspace remain under your control. You should export the results you want to keep before closing the application.
The optional desktop profile — name, organisation and avatar — is stored locally and can be used to identify the author in exported presentations. It is not synchronised with Faultwise Online or included in licence checks. You do not need an Online account to use a desktop licence.
The application keeps local diagnostic logs about its version, operating system, startup and errors. These logs are not sent to us automatically. They exclude project file content and names, your profile and the licence string. If you choose to send a log, screenshot or project file to support, the information we receive is handled under section 3.1.
4.3. Desktop licence checks
Faultwise Desktop checks its licence with our server during activation, when the application starts and periodically while it runs. Internet access is required for these checks; local project processing does not make the application fully independent of our licence service.
The server receives and records the check data listed in section 3.3. It uses the licence record to determine the permitted access, expiry and access status. A public IP address can be shared by several people or devices; it is not, by itself, proof that a licence is being misused.
After successful activation, the application can store the licence string in your operating system’s protected credential storage so that you do not have to paste it at each launch. This local storage does not send your profile or project data to us.
5. Faultwise Online AI-assisted features
This section applies only to Faultwise Online. AI chat is currently disabled in Faultwise Desktop. The desktop application does not send project data to our cloud AI provider.
Faultwise Online includes an optional AI chat that answers questions about calculated fault metrics and related geological concepts. Nothing is sent to our AI provider unless a user submits a question in the chat. Uploading or analysing files does not by itself send data to the AI provider.
The AI chat provides explanations only. It does not make decisions about a user’s account, access, pricing or legal rights.
For each question, Faultwise Online sends:
- the question;
- a text table containing the name and calculated metrics for each fault in the current workspace – derived values, not the uploaded files themselves; and
- instructions needed to generate the answer.
Faultwise Online does not automatically send raw uploaded files or account, authentication or billing data to the AI provider.
Our AI inference provider is Cerebras. Cerebras processes the request and returns the answer without persistently storing the input or output or using either to train or fine-tune models. Its automatic prompt cache may temporarily hold part of the input in isolated, non-persistent memory for up to one hour, after which it expires automatically. The cache is isolated to our Cerebras account and is not available to other Cerebras customers.
Faultwise Online does not save the text of AI questions or answers to our servers or database. Messages are displayed only on the current page and disappear when it is reloaded or closed. Previous messages are not included in later requests.
We keep a technical usage record for up to 24 months to manage usage allowances, monitor costs and reliability and investigate misuse. This record includes technical details about the request but does not contain the question or answer.
6. Website cookies and technical data
The Faultwise website and Faultwise Online use two cookies that are necessary for sign-in:
faultwise_authkeeps users signed in for up to 30 days or until they sign out; andfaultwise_2fa_pendingis used only during two-factor sign-in and expires after five minutes.
On faultwise.app, these cookies are sent only over HTTPS and cannot be read by scripts running on the page.
The Deform website uses an embedded form provided by Tally. Tally states that its service uses only essential cookies.
We do not currently use website analytics, advertising cookies, tracking pixels, session replay tools or cross-site tracking.
Because we use only essential cookies, we do not ask for cookie consent. If we introduce non-essential cookies in the future, we will request consent where required.
Our website and Online servers keep limited technical logs, such as IP address, request time, request path and status, browser information, authentication or session information and error or security details. We use these logs to operate, secure and troubleshoot these services, enforce access and usage limits and investigate suspected account sharing or misuse. They are normally deleted within 30 days.
Faultwise Desktop does not use the website sign-in cookies or send product usage analytics to us. Its local profile, diagnostic logs and server licence checks are described separately in sections 3.3 and 4.2–4.3. If you open our website from the desktop application, the website provisions apply to that visit.
7. Service providers
We use a limited number of third parties to operate our products and business.
| Provider | What it does | Personal data that may be involved | Where it processes data |
|---|---|---|---|
| Hetzner | Hosts Faultwise Online, the Faultwise Desktop licence service, their databases and server backups, and the Deform website | Online account data, temporary Online customer content, Online service usage and technical data, desktop licence records and check data, and Deform website visitor technical data | Finland |
| Cerebras | Provides AI inference for Faultwise Online only | The user’s question, calculated fault metrics and generated response | United States |
| Resend | Sends Faultwise Online account and service emails | Recipient email address, content of outgoing emails and delivery metadata | Ireland and the United States |
| Tally | Provides enquiry, early-access and feedback forms | Form responses and related technical data | European Union |
| Cal.com | Provides an external meeting-booking page | Name, contact details, booking information and related technical data | United States |
| Provides business email, document storage, calendar and video meetings through Google Workspace | Business contact details, communications, documents and meeting information | Various countries, including the United States | |
| ANNA | Supports invoicing, payments and accounting | Business and billing records | United Kingdom |
We may also disclose relevant personal data:
- to accountants, lawyers and other professional advisers where necessary;
- to an investor, buyer or other counterparty during a genuine financing, sale or corporate transaction, subject to appropriate confidentiality protections; or
- to regulators, courts, law enforcement or other authorities where required by law.
We do not disclose customer project files or confidential project data for marketing, investment or corporate discussions unless the customer has expressly agreed in writing to the specific use or disclosure, or disclosure is required by law.
8. International transfers
We are based in the United Kingdom, but some of the providers listed in section 7 process personal data in other countries. When this happens, we use safeguards recognised under UK data protection law.
Where personal data is processed in the European Economic Area, we rely on the UK’s adequacy regulations. For transfers to US providers covered by the UK Extension to the EU-US Data Privacy Framework, we rely on that framework. Where adequacy does not apply, we use contractual safeguards approved for UK transfers, including the UK Addendum to the EU Standard Contractual Clauses.
You can contact privacy@deform.app for more information or to request a copy of the safeguards used for a specific transfer.
9. How long we keep personal data
We keep personal data only for as long as it is reasonably needed for the purpose for which it was collected, including legal, security and accounting requirements.
9.1. Faultwise Online and website records
| Data | Typical retention |
|---|---|
| Online temporary workspace files | While the workspace is active; normally deleted within 35 minutes after the session becomes inactive, or when the session is reset or the service is restarted or redeployed. Deleted files may remain in server backups for up to seven days |
| Online AI chat history | Not stored in the Faultwise Online database; available only in the current browser session |
| Online AI usage records | Up to 24 months; includes tokens used, estimated cost, timing and request status, but not the question or answer. Deleted earlier if the Online account is deleted |
| Online product usage events | Up to 12 months; includes actions such as imports, calculations, exports and use of product features, but not uploaded file content. Deleted earlier if the Online account is deleted |
| Online account and access records | While the account or customer relationship is active, followed by a limited period where needed for support, security, dispute resolution or prevention of repeated misuse |
| Website and Online technical and security logs | Usually up to 30 days, unless a record is needed to investigate a specific security incident |
9.2. Faultwise Desktop licence records held by us
| Data | Typical retention |
|---|---|
| Desktop licence check records | In the live licence service, records older than 30 days are deleted during hourly clean-up. Residual copies may remain in backups for up to seven further days |
| Desktop licence administration records | While the licence is within its issued term and for up to 24 months after its expiry date, to handle renewals, reissues and support. After that, personal data is deleted or anonymised unless a specific legal obligation, investigation or dispute requires longer retention |
These periods apply to desktop demo licences. Extending a licence changes its expiry date and therefore the end of its retention period. A licence does not remain in our records indefinitely merely because it was issued to a customer.
9.3. Backups and shared company records
| Data | Typical retention |
|---|---|
| Faultwise server backups and separate desktop licence database backups | Up to seven days from creation, for recovery after a failure; older copies are deleted or overwritten. Backups can contain records already deleted from the live service during that period |
| Resend email data | Up to 30 days under Resend’s standard service retention |
| Enquiries, Deform early-access requests, Faultwise Online access requests, desktop demo requests and sales records | Usually up to 24 months after the last meaningful interaction, unless they become part of an active customer relationship |
| Support, privacy enquiries, complaints and feedback records | Usually up to 24 months after the last interaction, unless still needed for an active issue, investigation or legal matter |
| Billing, tax and accounting records | Usually six years, or longer where law requires |
| Do-not-contact records | For as long as needed to respect your opt-out request |
If a backup is restored, the applicable retention and deletion rules must also be applied to the restored data. We do not use backups to continue ordinary processing of records that should have been deleted.
Where a specific legal obligation, investigation or dispute requires us to retain particular records for longer, retention is limited to what is needed for that purpose. This does not extend the routine retention period for all records.
9.4. Local desktop data under your control
Local project data is not stored in our server backups. Temporary desktop workspaces are normally removed when the application closes, with cleanup of abandoned working copies on a later launch. Original files and saved exports remain on your computer until you delete them.
Your local profile and saved licence string remain on your device until removed. Local diagnostic logs normally cover the most recent 20 application runs; logs belonging to running instances are kept until those instances close. These local records are not uploaded automatically. Your own device backup or synchronisation arrangements may retain additional copies and are under your control.
10. Security
We use technical and organisational measures designed to protect personal data. Depending on the system, these include:
- password hashing;
- secure authentication cookies;
- email verification and password reset controls;
- optional two-factor authentication for Faultwise Online user accounts;
- access controls and multi-factor authentication for our administrative accounts;
- limiting access to production servers and databases to authorised personnel;
- HTTPS encryption for Faultwise Online and desktop licence checks;
- temporary rather than long-term server storage of uploaded Faultwise Online files;
- local processing of desktop projects and protected operating-system storage for saved desktop licence strings;
- logging, rate limiting and security monitoring; and
- reviewing the data protection and security terms of providers that handle personal data.
No system can be guaranteed to be completely secure. If a personal data breach occurs, we will assess it, record it and notify the ICO and affected individuals where UK data protection law requires us to do so.
11. Product and marketing communications
We may contact business users, existing customers, academic users and relevant professional contacts about their access, product updates, meetings or related services where this is appropriate in the context of our relationship. We use consent where required for marketing by email.
You can object to direct marketing at any time by replying to the message or contacting privacy@deform.app. We will stop sending marketing messages and may keep a limited do-not-contact record to make sure we respect your request.
Service and account emails – such as Online verification and password reset emails, or important service and licence notices – are not marketing and may still be sent where needed to operate our services.
12. Your data protection rights
Depending on the circumstances, UK data protection law may give you the right to:
- access personal data we hold about you;
- correct inaccurate or incomplete data;
- request deletion of personal data;
- restrict or object to processing;
- receive certain data in a portable format;
- withdraw consent where we rely on consent; and
- request human review of, and contest, a significant decision made solely by automated means.
These rights apply in different circumstances. For example, if you ask us to delete your data, we may still need to keep records required for tax or accounting, information needed for a legal claim or a minimal record of a marketing opt-out.
You can also ask us to delete your Faultwise Online account. When an Online account is deleted, its associated AI usage and product usage records are deleted with it. Residual copies may remain in backups for up to seven days.
Desktop licence records are separate from Online accounts. You can request access, correction or deletion of personal data in those records without having an Online account; you may provide the licence number to help us find the relevant records. Online account deletion does not automatically delete desktop licence records. Information held only on your computer, such as local files, exports and your desktop profile, is under your control and cannot be deleted remotely by us.
To exercise a right, email privacy@deform.app. We may ask only for information reasonably needed to confirm your identity or clarify your request. We normally respond within one month. Complex requests may take longer, and we will tell you if an extension is needed.
13. Complaints
You can send a data protection complaint to privacy@deform.app.
We will acknowledge a complaint within 30 days, investigate it and provide updates and an outcome without undue delay.
You may also complain to the Information Commissioner’s Office at any time. You do not need to wait for us to complete our review.
Information Commissioner’s Office (ICO)
Website: https://ico.org.uk/
Telephone: 0303 123 1113
Depending on where you are located, you may also have the right to complain to your local data protection authority.
14. Automated decision-making
We do not currently make solely automated decisions that produce legal or similarly significant effects.
15. Children
Our websites, products and services, including Faultwise and Deform, are intended for people aged 18 and over. They are not directed at children, and we do not knowingly collect personal data from anyone under 18.
16. Changes to this policy
We may update this policy when our products, providers or processing activities change. We will change the effective date and provide additional notice where a change materially affects how we use personal data.
We will update this policy before introducing additional personal data processing for the Deform product.
17. Contact us
For questions, rights requests or complaints, contact:
DEFORM GEOSCIENCE LTD
71-75 Shelton Street
Covent Garden
London
United Kingdom
WC2H 9JQ
Email: privacy@deform.app