Privacy policy

This policy explains what OurForms collects, why, and what you can do about it. Text in [square brackets] needs filling in before this page goes live.

Who we are

OurForms is run by [Company legal name], [registered address] ("OurForms", "we"). For anything about your data, write to [privacy contact email].

Two kinds of data

• Your account and workspace. When you or your team use OurForms, we decide how that data is used. This policy covers it.
• Answers people send to your forms. Your workspace collects them and decides what to do with them; we store and process them for you, on your instructions. If you filled in a form built with OurForms, the organisation that published it is responsible for your answers. Ask them first about your data.

What we collect

• Account details: your name, email address, role, time zone and a hashed password (we never see the password itself).
• Workspace content: forms, pages, themes, settings, routing rules, decisions, comments and helpdesk tickets.
• Billing: your plan and invoices. Card details are handled by our payment provider, Stripe; we only keep the card brand and last four digits.
• Security and audit records: sign-ins and important changes, with the IP address and browser they came from, so we and your workspace admins can see who did what. These are kept for a year.
• Form answers: what visitors submit, including uploaded files and signatures, which are stored privately.
• Form statistics: visits, starts, submits and how far people get, with the traffic source, device type, browser and country. No IP addresses or answers are used for statistics, and the raw events are deleted after 90 days.

Cookies and browser storage

We only use what OurForms needs to work:

• A session cookie and a security token, so you stay signed in and forms can't be submitted from other sites.
• Your browser's local storage, for your light or dark preference, the sidebar sections you've folded, saved progress on a form ("save and finish later") and a random token for "one response per person" forms. We only ever store a keyed hash of that token, never the token itself.

We don't use advertising or third-party tracking cookies.

How we use it

To run OurForms for you: sign-in, building and publishing forms, delivering responses and notifications, billing, support, and keeping the service secure and free of abuse. We don't sell personal data or use it for advertising.

Who we share it with

Only the providers that run parts of OurForms for us, under contracts that protect your data:

Provider	What for
Stripe	Payments and invoices
[Email provider]	Sending notifications, receipts and digests
[Hosting provider]	Running OurForms and storing its data, in [region]

We disclose data to authorities only when the law requires it.

How long we keep it

We keep your data while your workspace is active. When a workspace is closed, we delete its data within [30] days, except invoices and records we must keep by law. Your workspace's admins can delete individual responses at any time.

Your rights

You can ask us for a copy of your data, to correct it, or to delete it, and you can object to how we use it. Workspace admins can export responses as CSV themselves. Write to [privacy contact email]; we reply within [30] days. You can also complain to your local data protection authority.

Keeping it safe

Each workspace's data is kept separate, files are only available to signed-in members of the workspace, passwords are hashed, and connections are encrypted.

Changes

When this policy changes, we update the date at the top of this page and tell workspace owners about significant changes in advance.