Privacy Policy

Last updated: 15 September 2026

Who we are

FormDock is operated from Switzerland. We process personal data under the Swiss Federal Act on Data Protection (FADP) and, where it applies to you or your form submitters, the EU GDPR. Contact for privacy matters: support@formdock.app.

What we collect

Account data: your email address and workspace/form configuration. Submission data: whatever your forms send us, stored on your behalf as a processor. Operational data: submitter IP address and user agent, kept for rate limiting and abuse prevention.

What we don't do

We don't sell data, don't use submission content for advertising or model training, and don't log submission payloads in application logs.

Storage & security

Account and submission data are stored in a PostgreSQL database running on dedicated infrastructure in Nuremberg, Germany, operated by our subprocessor Hetzner Online GmbH. The database volume is encrypted at rest (AES-256 full-volume encryption) and all connections to the database are encrypted in transit (TLS). Backups are encrypted (AES-256) before they leave the database server and are kept in Helsinki, Finland. Access to the database is limited to the application and to FormDock operators. Notification email is delivered via Postmark; payments are processed by Stripe (we never see card numbers). Where Stripe Managed Payments applies, Stripe is the merchant of record for your purchase and collects your billing and tax details directly under its own privacy policy.

Retention & deletion

Submissions are kept until you delete them or per your configured retention window. Deleting a form or workspace deletes its submissions immediately. Account deletion requests: email support and we'll complete deletion within 30 days.

Cookies & analytics

We set only strictly necessary cookies: a session cookie and a CSRF token used for signing in to the dashboard. We use no advertising or cross-site tracking cookies — which is why you don't see a cookie banner here.

For page analytics we use Vercel Web Analytics, which is cookieless: it counts aggregated, anonymized page views and cannot identify or track individual visitors across sites. Form submission contents are never included in analytics.

Data residency & international transfers

FormDock is operated from Switzerland. Since 15 September 2026, account and submission data are stored in the EU: the database is hosted in Germany and its encrypted backups in Finland, and the application itself runs in Frankfurt, Germany. Some subprocessors remain US companies (see the DPA): Vercel operates the global edge network and analytics, Postmark delivers notification email, Stripe handles billing, and Cloudflare provides spam verification. Any personal data these subprocessors process may be transferred to the US; those transfers rely on the EU/Swiss–US Data Privacy Framework where the subprocessor is certified, and on standard contractual clauses otherwise. Submission data at rest is not transferred to the US. Before 15 September 2026, data was hosted in US data centers under the same safeguards.

Your rights

Access, export (CSV), rectification, and erasure are available directly in the dashboard. For anything else, contact support.