Effective Date: June 2, 2026
Last Updated: June 23, 2026
Form Orah is operated by Pure Grace AI, LLC (“we,” “us,” or “our”). This Privacy Policy explains how we collect, use, and protect your information when you use our platform at app.formorah.com and formorah.com.
If you are a Washington resident, please also see our Consumer Health Data Privacy Policy, which describes how we handle consumer health data under the My Health My Data Act.
1. Information We Collect
We collect information you provide directly, including your name, email address, and any data you enter into forms you create or submit through our platform. We also collect usage data such as IP address, browser type, device information, pages visited, and actions taken within the platform.
2. How We Use Your Information
We use your information to provide and improve our services, send transactional emails (such as form submission notifications and account alerts), process payments, and communicate with you about your account. We do not sell your personal information to third parties.
3. Cookies and Tracking
We use cookies and similar technologies to maintain your session, analyze usage, and improve platform performance. You can control cookie preferences through your browser settings.
4. Bot Protection — Cloudflare Turnstile
Form Orah uses Cloudflare Turnstile to protect our forms from automated bot submissions. Turnstile operates invisibly and does not require visitors to solve a CAPTCHA challenge. By using Form Orah, you acknowledge that Cloudflare Turnstile may process data as described in the Cloudflare Turnstile Privacy Addendum.
5. Third-Party Services
Our platform integrates with third-party services including Stripe (payment processing), Resend (transactional email), Neon (database hosting), Vercel (hosting infrastructure), and Twilio (SMS/text messaging). Each of these services has its own privacy policy governing how they handle your data.
6. SMS / Text Messaging
If you provide your phone number on a form built with Form Orah and consent to SMS contact, you may receive text messages from the business you contacted, sent through Form Orah on its behalf. These may include confirmation that your inquiry was received, appointment or booking confirmations, and replies to your questions. Message frequency varies. Message and data rates may apply. You can opt out at any time by replying STOP, and reply HELP for assistance.
SMS messaging is delivered through our messaging provider, Twilio. No mobile information (including phone numbers and SMS consent) will be shared with or sold to third parties or affiliates for marketing or promotional purposes. Phone numbers collected for SMS are used solely to deliver the messages you consented to receive.
7. Data Retention
We retain your data for as long as your account is active or as needed to provide our services. You may request deletion of your account and associated data by contacting us at the address below.
8. Security
We implement industry-standard security measures including encryption in transit (TLS), encrypted storage for sensitive tokens, and rate limiting to protect against unauthorized access.
9. HIPAA
If you are on an Agency or Enterprise plan and have executed a Business Associate Agreement (BAA) with us, we will handle Protected Health Information (PHI) in accordance with HIPAA requirements.
10. Your Privacy Rights
Depending on your state of residence, you may have some or all of the following rights regarding your personal information: the right to know or access the personal information we hold about you; to correct inaccurate information; to delete your information; to obtain a portable copy; to opt out of the “sale” or “sharing” of personal information and of targeted (cross-context behavioral) advertising; to limit the use or disclosure of sensitive personal information; and to not receive discriminatory treatment for exercising these rights. These rights apply to residents of California, Virginia, Colorado, Connecticut, Texas, Oregon, and other states with comprehensive consumer privacy laws, subject to each law’s requirements and exceptions.
How to exercise your rights. You, or an authorized agent acting on your behalf, may submit a request by emailing privacy@formorah.com. We will verify your request using information associated with your account or submission and respond within the time required by applicable law (generally 45 days, extendable where permitted). We will not discriminate against you for exercising your rights.
Appeals. If we decline to act on your request, you may appeal by emailing privacy@formorah.com with the subject line “Privacy Appeal.” We will respond within the period required by applicable law (generally 45 to 60 days) and explain our decision. If you remain unsatisfied, you may contact your state attorney general.
Opt-out preference signals (Global Privacy Control). We recognize opt-out preference signals, including the Global Privacy Control (GPC), as a valid request to opt out of the sale or sharing of personal information and of targeted advertising for the browser or device from which the signal is sent, where required by applicable law.
Sale, sharing, and targeted advertising. We do not sell your personal information, and we do not share it for cross-context behavioral advertising in exchange for money. Where a customer connects optional marketing integrations, personal information is processed only as the customer directs and subject to consent where required.
Sensitive information. We do not use or disclose sensitive personal information for purposes that would require an additional opt-out or opt-in right beyond providing the service. Where you collect sensitive information through forms you build, you are responsible for obtaining any required consent.
Categories of personal information. The categories of personal information we collect, the sources, and the purposes are described in Sections 1 and 2; the service providers and third parties that may receive personal information are described in Sections 4 through 6 and in our Data Processing Addendum.
Form data collected by our customers. For personal information you submit through a form built by one of our customers, that customer is the controller of your information; please direct your request to that business. For accounts and information we control directly, contact us at privacy@formorah.com.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a new effective date.
12. Contact Us
If you have questions about this Privacy Policy, please contact us at:
Pure Grace AI, LLC
privacy@formorah.com