AI Policy

At ToWebForm, we believe in complete transparency about how we use artificial intelligence. This policy explains the specific ways AI technology is used in our platform, what data is processed during each workflow, how your data is protected, and what human-review safeguards are in place.

1. How We Use AI

ToWebForm uses enterprise-grade vision and language models for four clearly defined, task-specific workflows:

• PDF Field Detection and Structural Mapping: When you upload a flat or scanned PDF (or run Vision Analysis alongside AcroForm extraction), our system converts each page into an image and analyzes the layout to identify headings, static instructions, and fillable input fields (text boxes, checkboxes, radio groups, tabular grids, address blocks, date fields, and signature lines). The structured layout output is used to generate a responsive web form overlay.
• Multilingual Form and Bidirectional Answer Translation:When an organization enables additional workspace languages and syncs translations in the Form Builder, AI translates form titles, section headings, field labels, placeholders, helper text, and selection options into the selected languages. On eligible plans with Bidirectional Answer Translation enabled, when a respondent completes a form in a non-primary language, open-ended text responses are automatically translated back into the PDF's primary language before coordinate stamping, and both the translated text and the respondent's exact verbatim original-language response are recorded side-by-side in a Bilingual Verification Log appended to the PDF.
• Submission and Contract Executive Overviews: On eligible plans, authorized workspace members can generate or view a structured internal overview of a completed submission or executed agreement. The AI synthesizes an executive summary, categorized key terms (such as parties, financial terms, obligations, and termination clauses), and verbatim source quotes from the document to help staff review records faster.
• Contract Metadata, Deliverable, and External PDF Extraction: When a contract is completed through ToWebForm or when an organization uploads an externally signed PDF contract into the Contracts Vault, AI analyzes the document (including optical character recognition on scanned pages) to suggest the contract monetary value, effective date, expiration date, renewal notice window, and actionable deliverables, accompanied by verbatim source citations for staff confirmation.

We do not use AI for behavioral profiling, advertising targeting, credit or eligibility scoring, or automated decision-making with legal or similarly significant effects on end users.

2. Enterprise AI Providers and Zero Training Commitment

ToWebForm accesses commercial foundation models exclusively through paid enterprise cloud APIs governed by strict commercial data-processing terms. Under these enterprise API agreements, data submitted through our platform is never used to train, fine-tune, or improve any foundational AI models, and is never shared with other customers or third parties.

3. What Data Is Sent to the AI

Only the minimum data required to perform the specific feature you invoke is transmitted to the AI API:

• During PDF Field Detection: Visual page renders of your uploaded template PDF and a fixed structural detection system prompt.
• During Form Label Translation:Your form's field labels, section headers, helper text, and option strings (excluding any locked custom translations) along with the target language codes.
• During Bidirectional Answer Translation: Only the open-ended text strings entered by the respondent in a non-primary language and the corresponding field labels needed for translation context.
• During Contract and Submission Overviews or Vault Extraction: The template structure, submitted field values (decrypted ephemerally in server memory solely for the duration of the API request), or the uploaded external contract PDF pages, paired with a structured extraction schema requiring verbatim source quotes.

We do not send your account passwords, payment or Stripe billing credentials, unrelated workspace documents, or uninvited account metadata to any AI service.

4. When AI Processing Occurs

• Template Upload and Translation Sync: PDF field detection runs once when you upload a PDF document. Form label translation runs only when you explicitly sync translations for your enabled workspace languages in the Form Builder. Standard form viewing and rendering for respondents do not invoke live AI calls; translated form labels are served directly from pre-generated, cached schema definitions.
• Submission and Contract Processing: Bidirectional answer translation runs at submission time only when a respondent submits a form in a non-primary language on an eligible plan. Contract metadata extraction and executive overviews run when a submission or external contract PDF is processed or when an authorized team member requests or refreshes an overview in the dashboard.

5. Data Storage, Encryption, and Retention

All uploaded PDFs, generated submission PDFs, and AI-generated overviews or extracted contract metadata stored in ToWebForm are protected within our cloud infrastructure (Supabase Database and Storage, hosted on AWS). Sensitive submission payloads, personally identifiable information (PII), and signature audit trails are encrypted at the application layer using AES-256-GCM before being written to the database.

Temporary page images or ephemeral decrypted buffers created in server memory during an AI API request are discarded immediately after the request completes. Under our commercial AI provider agreements, API payloads are not retained for model training.

6. Demo Mode

ToWebForm offers an interactive public demo that allows visitors to upload a sample PDF and preview automated field detection without creating an account. Demo uploads follow the same encrypted server-side processing pipeline described above, and temporary demo assets are automatically cleaned up.

7. AI Output Accuracy and Mandatory Human Review

Generative and vision AI outputs are probabilistic and may occasionally misidentify field types, misalign bounding boxes, mistranslate specialized terminology, or misinterpret complex contract clauses, dates, or monetary figures. ToWebForm builds human verification directly into every AI workflow:

• Visual Form Editor: You can inspect, move, resize, and reconfigure every detected field before publishing a form.
• Translation Review and Phrase Locking: You can inspect translated labels in the Form Translation Drawer, manually override phrasing on eligible plans, and rely on the Bilingual Verification Log to compare translated answers against the respondent's verbatim original text. AI translations are machine-generated conveniences and are not certified human or court-certified translations.
• Verbatim Citations and Confirmation Controls: AI contract overviews, contract values, expiration dates, and deliverable checklists include verbatim source quotes from the document and allow authorized staff to accept, edit, or dismiss suggested values. AI summaries and extractions are informational productivity tools, not legal advice or a substitute for review by qualified legal counsel.

8. No Training on Your Data

To be explicit:

• ToWebForm does not train any AI models on customer data. We do not use your uploaded PDFs, form schemas, respondent submissions, or contracts to train or fine-tune proprietary or third-party models.
• Our enterprise AI providers do not train on paid API traffic. Commercial API terms strictly prohibit using your payloads to train or improve underlying foundation models.
• Strict tenant isolation. AI outputs generated for your workspace (translations, overviews, and extracted contract fields) are scoped exclusively to your organization and are never shared across tenants.

9. Security Measures

All communication between ToWebForm servers and enterprise AI APIs occurs over encrypted HTTPS (TLS 1.2+) connections. API credentials are isolated in server-side environment variables and are never exposed to client browsers. All sensitive customer submission data remains encrypted at rest with AES-256-GCM.

10. Changes to This Policy

We may update this AI Policy from time to time to reflect new platform capabilities, security practices, or legal requirements. When we make changes, we will update the "Last updated" date at the top of this page.

11. Contact Us

If you have questions about how ToWebForm uses artificial intelligence or how your data is protected, please contact us at:

Foresight Technologies LLC
Email: Legal@ToWebForm.com