Privacy Policy

Last updated: 29 July 2026

Who we are

FormDock is operated from Switzerland. We process personal data under the Swiss Federal Act on Data Protection (FADP) and, where it applies to you or your form submitters, the EU GDPR. Contact for privacy matters: support@formdock.app.

What we collect

Account data: your email address and workspace/form configuration. Submission data: whatever your forms send us, stored on your behalf as a processor. Operational data: submitter IP address and user agent, kept for rate limiting and abuse prevention.

What we don't do

We don't sell data, don't use submission content for advertising or model training, and don't log submission payloads in application logs.

Storage & security

Data is stored in managed Postgres, encrypted at rest and in transit. Notification email is delivered via Postmark; payments are processed by Stripe (we never see card numbers). Where Stripe Managed Payments applies, Stripe is the merchant of record for your purchase and collects your billing and tax details directly under its own privacy policy.

Retention & deletion

Submissions are kept until you delete them or per your configured retention window. Deleting a form or workspace deletes its submissions immediately. Account deletion requests: email support and we'll complete deletion within 30 days.

Cookies & analytics

We set only strictly necessary cookies: a session cookie and a CSRF token used for signing in to the dashboard. We use no advertising or cross-site tracking cookies — which is why you don't see a cookie banner here.

For page analytics we use Vercel Web Analytics, which is cookieless: it counts aggregated, anonymized page views and cannot identify or track individual visitors across sites. Form submission contents are never included in analytics.

Data residency & international transfers

FormDock is operated from Switzerland; data is currently hosted in US data centers by our subprocessors (see the DPA). Transfers from Switzerland and the EU/EEA to the US rely on recognized safeguards — the EU/Swiss–US Data Privacy Framework where the subprocessor is certified, and standard contractual clauses otherwise. EU/Swiss data residency is on the roadmap but not yet available — factor this into your own GDPR/FADP assessment.

Your rights

Access, export (CSV), rectification, and erasure are available directly in the dashboard. For anything else, contact support.