Privacy Policy

Last updated 1 November 2026

This policy explains what personal data collects when you use , why, and what you can do about it. It's written for India's Digital Personal Data Protection Act, 2023.

Two kinds of data. Your account data (your name, email, billing) is ours to look after: we are its Data Fiduciary. Form responses belong to the person who made the form: they are the Data Fiduciary and we only process responses on their instructions. If you answered someone's form, contact them about your answers.

What we collect from account holders

Data	Why	Kept for
Name, email, password (stored only as a secure hash)	To create and secure your account	Until you delete your account
Plan and payment records (Razorpay handles card and UPI details; we never see them)	Billing, invoices and tax records	8 years, as tax law requires
Notification email addresses you add	To send you form responses	Until you remove them
Login session cookie	To keep you signed in. It's the only cookie we set, and there's no advertising or tracking.	30 days
Server logs (IP address, browser, time)	Security and fixing faults	30 days

What we process for form owners

Answers people submit, stored until the form owner deletes them, deletes the form, or closes their account. Email-only forms aren't stored: answers pass to our email provider and are then discarded.
Basic context with each stored response: the browser name, the page it was sent from, and a scrambled code made from the IP address, used to stop spam. We don't keep the raw IP address with responses.
Counts of views and starts, without personal data.

We don't sell personal data, use it for advertising, or use form responses to train AI models.

Who we share data with

Only service providers that help us run the service, under contracts that protect the data:

Provider	Purpose	Location
[Hosting provider, e.g. DigitalOcean]	Servers and backups	[Region, e.g. Bengaluru, India]
[Email provider, e.g. Amazon SES or Resend]	Notification and confirmation emails	[Region]
Razorpay	Payments	India

Form owners can also send responses to their own webhooks or Google Sheets. That's their choice and their responsibility. We may disclose data when the law requires it.

Security

Connections use HTTPS. Passwords are stored only as hashes, and mobile numbers used for the one-time trial check are compared as hashes. Access to production systems is limited to people who need it. If a breach affects your personal data, we'll tell you and the Data Protection Board of India as the law requires.

Your rights

You can ask to see, correct or delete your personal data, withdraw consent, and nominate someone to act for you. You can delete your account yourself under Account. For anything else, email . We reply within 30 days.

Grievance officer

[Name], , . Email: . If you're not satisfied with our reply, you can complain to the Data Protection Board of India.

Children

The service isn't meant for anyone under 18. Form owners must not use it to collect children's data without verifiable parental consent.

Changes

We'll post changes here and email account holders about important ones at least 30 days before they apply.