01 Summary
- We never sell or rent personal data.
- If you build forms with Formcraft, we are the controller of your account data.
- If you respond to someone else's form, the form owner is the controller of your answers; Formcraft processes them on the owner's behalf.
- You can export or delete your data at any time.
02 Who is responsible
Form owners. For your account, billing and website data, Formcraft Inc. is the data controller, and this policy describes our own practices directly.
Respondents. For data you submit when answering someone else's form, the form owner is the controller and Formcraft acts only as their processor, under our Data Processing Addendum, available to form owners on request. If you have a question about a specific form, please contact the person or business that sent it to you; see the Your rights section below for what to do if you cannot reach them.
03 What we collect
From form owners (account holders)
- Name, email address, business name, time zone and password hash.
- Billing details processed by Stripe; we store only the card brand, last four digits and expiry.
- Form designs, logic rules, branding settings and usage of the dashboard.
From respondents
- Whatever answers you submit in the fields the form owner created, which may include your name, email, file uploads or payment confirmation.
- Technical data such as submission time and, if the form owner enables it, IP address and browser type, used to prevent spam and duplicate submissions.
Automatically, from all visitors
- Log data such as IP address, browser type and pages visited, used for security and reliability.
- Privacy-friendly, cookie-less product analytics in aggregate form.
04 How we use it
- To provide the Service: build and publish forms, accept responses, show results and send notifications.
- To bill account holders and prevent fraud.
- To answer support requests and send important service notices.
- To improve the product using aggregated, de-identified usage statistics.
- To send product updates to account holders, only if they opt in. They can unsubscribe in one click.
Our legal bases are performance of a contract, our legitimate interests in running a secure service, compliance with legal obligations and, for marketing, consent.
06 Retention
We keep account and response data while the related account is active. After an account holder closes their account, data is deleted within 30 days, and removed from backups within a further 60 days. Invoices are kept as long as tax law requires.
07 Security
Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Access to production systems is limited to staff who need it, protected by multi-factor authentication and logged. If we become aware of a breach affecting your data, we will notify affected account holders without undue delay.
08 Your rights
Depending on where you live, including under the GDPR and the CCPA, you can request access to, correction, deletion or a portable copy of your personal data, and object to or restrict certain processing. Email [email protected] and we will respond within 30 days.
If you responded to a form built by one of our customers, please contact that business first, since they control your answers. If you cannot reach them or are not satisfied with their response, write to us and we will help them fulfil your request. You may also complain to your local data protection authority.
10 Changes
If we make material changes to this policy we will email account holders at least 14 days before they take effect and update the date at the top of this page.
11 Contact
For any privacy question or request, write to [email protected].
Still have questions?
Email our support team at [email protected]. A real person replies within one business day.
Hours: Monday to Friday, 9:00 to 18:00 (UTC+7)