Privacy Policy

Last updated: 28 July 2026

What we collect

Account data: your email address and workspace/form configuration. Submission data: whatever your forms send us, stored on your behalf as a processor. Operational data: submitter IP address and user agent, kept for rate limiting and abuse prevention.

What we don't do

We don't sell data, don't use submission content for advertising or model training, and don't log submission payloads in application logs.

Storage & security

Data is stored in managed Postgres, encrypted at rest and in transit. Notification email is delivered via Postmark; payments are processed by Stripe (we never see card numbers).

Retention & deletion

Submissions are kept until you delete them or per your configured retention window. Deleting a form or workspace deletes its submissions immediately. Account deletion requests: email support and we'll complete deletion within 30 days.

Data residency

Data is currently hosted in US data centers. EU data residency is on the roadmap but not yet available — factor this into your GDPR assessment.

Your rights

Access, export (CSV), rectification, and erasure are available directly in the dashboard. For anything else, contact support.