Privacy Policy | Formbase

This Privacy Policy describes how Formbase ("we," "us," or "our") collects, uses, stores, and protects your personal information when you use our form submission service. We are committed to protecting your privacy and complying with applicable data protection laws, including GDPR and CCPA.

Information We Collect

Account Information

When you create a Formbase account, we collect:

Email address
Name (if provided)
Password (encrypted)
Company name (optional)
Billing and payment information

Form Submission Data

When forms are submitted through your Formbase endpoints, we process and store:

All data submitted through your forms (field names and values)
Submission timestamps
IP addresses of form submitters
User agent information (browser and device details)
Referring URLs

Usage and Technical Data

We automatically collect:

API usage statistics and request logs
Service performance and error data
Device and browser information
Cookies and similar tracking technologies

How We Use Your Information

We process your personal data based on the following legal grounds:

Contract Performance: To provide form submission services, process payments, and manage your account
Legitimate Interests: To improve our services, prevent fraud, and ensure security
Consent: For marketing communications and optional features (you can withdraw consent anytime)
Legal Compliance: To comply with legal obligations and respond to lawful requests

Specifically, we use your information to:

Process and deliver form submissions to your designated email or webhook endpoints
Send submission notifications and service alerts
Provide customer support and respond to inquiries
Monitor and analyze service performance and usage patterns
Detect, prevent, and address security issues or fraudulent activity
Send important service updates and account information
Improve and develop new features (with aggregated, anonymized data)

How We Store and Protect Your Data

We implement industry-standard security measures to protect your information:

Encryption: Data is encrypted in transit (TLS/SSL) and at rest using AES-256 encryption
Access Controls: Strict access controls limit who can access your data
Secure Infrastructure: We use secure, SOC 2 compliant cloud hosting providers
Regular Backups: Automated backups ensure data availability and recovery
Monitoring: 24/7 security monitoring and incident response procedures

Data Retention: We retain your account data and form submissions for as long as your account is active. Form submission data is retained according to your plan limits (typically 30-90 days, or longer for premium plans). After account deletion, we retain minimal data for legal compliance purposes for up to 90 days before permanent deletion.

Data Sharing and Third Parties

We do not sell your personal data. We share data only in the following circumstances:

Service Providers

We work with trusted third-party service providers who process data on our behalf:

Email Delivery: To send form submission notifications and service emails
Payment Processing: To process subscription payments securely
Cloud Hosting: To store and process data securely
Analytics: To understand service usage and improve features
Customer Support: To provide technical assistance

All service providers are bound by data processing agreements and are required to protect your data according to GDPR and other applicable standards.

Your Form Submissions

Form submissions are delivered to the email addresses or webhook endpoints you configure. You are responsible for ensuring proper handling and protection of submission data after delivery.

Legal Requirements

We may disclose your information if required by law, court order, or government regulation, or to protect our rights, property, or safety.

Your Privacy Rights

Depending on your location, you have the following rights regarding your personal data:

Right to Access: Request a copy of the personal data we hold about you
Right to Rectification: Request correction of inaccurate or incomplete data
Right to Erasure: Request deletion of your personal data ("right to be forgotten")
Right to Data Portability: Receive your data in a structured, machine-readable format
Right to Restrict Processing: Request limitation of how we process your data
Right to Object: Object to processing based on legitimate interests
Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent
Right to Lodge a Complaint: File a complaint with your local data protection authority

To exercise these rights, contact us at privacy@formbase.tech. We will respond within 30 days (GDPR) or 45 days (CCPA) of receiving your request.

California Residents (CCPA/CPRA)

California residents have additional rights including the right to know what personal information is collected, sold, or disclosed, and the right to opt-out of the sale or sharing of personal information. We do not sell personal information. You may designate an authorized agent to make requests on your behalf.

Cookies and Tracking Technologies

We use cookies and similar technologies for:

Essential Cookies: Required for account authentication and security
Performance Cookies: Help us understand how users interact with our service
Analytics Cookies: Provide insights into usage patterns and service improvements

You can control cookies through your browser settings. Disabling essential cookies may affect service functionality.

International Data Transfers

Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, to protect your data during international transfers.

Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you and relevant authorities within 72 hours as required by GDPR and other applicable laws. Notifications will include the nature of the breach, potential consequences, and measures taken to address it.

Children's Privacy

Formbase is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately, and we will delete it.

Your Responsibilities

As a Formbase user collecting data through forms, you are responsible for:

Obtaining proper consent from form submitters before collecting their data
Providing your own privacy notice to form users explaining how you use their data
Complying with applicable data protection laws in your jurisdiction
Implementing appropriate security measures for data you receive
Not collecting sensitive personal data (health, financial, etc.) without proper safeguards

Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will notify you of material changes via email or through the service at least 30 days before they take effect. The "Last Updated" date at the top indicates when changes were last made.

Contact Us

For questions, concerns, or to exercise your privacy rights, please contact us:

Email: privacy@formbase.tech

Website: https://formbase.tech

Data Protection Authority

If you are located in the European Economic Area (EEA), you have the right to lodge a complaint with your local supervisory authority if you believe our processing of your personal data violates applicable law.