Privacy Notice

1. Two roles

• Your account. For the people who sign up and the members of their workspaces, we decide how the data is used: we are the Data Fiduciary.
• Form submissions. When a visitor fills in a form that one of our customers connects to GetYourForms, the customer decides what is collected and why. The customer is the Data Fiduciary and we process the submission on their behalf. If you sent a form to a website, contact that website about your data; we will help them answer.

2. What we collect

• Account data: your name, email address and password (stored only as a salted hash). If you sign in with Google, the name, email address and profile picture Google shares with us.
• Workspace data: workspaces, members and their roles, invitations, forms, projects and their settings. Captcha secret keys you add are stored encrypted and are never shown again.
• Consent records: which version of these terms you accepted, when, and from which IP address, and whether you opted in to product emails.
• Form submissions: the fields and files a visitor sends, plus the time, IP address, approximate country, browser, operating system, device type, referring page and the site the form was on.
• Security and usage data: IP addresses, browser details and request identifiers in our logs, a record of security-relevant actions (such as sign-ins, role changes and deletions), rate-limit counters and email delivery records.
• Cookies: only the cookies needed to keep you signed in and to protect sign-in. We don’t use advertising or cross-site tracking cookies.

3. Why we use it

• To run the service: store submissions, show them in your inbox, send notifications and exports.
• To secure it: verify email addresses, stop bots and abuse, enforce rate limits and investigate incidents.
• To apply your plan: count submissions and storage, and lock submissions above your plan’s quota until there is room. Locked submissions are kept, never discarded.
• To tell you about your account: verification, password reset, quota, retention and security emails.
• Product news and offers, only if you opted in. You can opt out at any time.

We don’t sell personal data, and we don’t use form submissions for advertising or to train models.

4. Who helps us

These service providers process data for us, under contract and only for the purposes above:

• Google Cloud (Mumbai, India): runs our servers, stores uploaded files and exports, and keeps our logs.
• PlanetScale (Amazon Web Services, Mumbai, India): our database.
• Cloudflare: delivers the website, protects it from attacks, and runs the Turnstile check that tells people from bots on sign-in forms.
• Resend: sends our emails, including submission notifications. To deliver an email, the message and its recipient pass through Resend’s systems, which may be outside India.
• Google: signs you in if you choose “Continue with Google”.
• Have I Been Pwned: when you choose a password, we check whether it has appeared in a data breach by sending only the first five characters of its hash, never the password.

We may also disclose data when Indian law requires it, or to protect our users and the service from fraud or abuse.

5. Where it is stored

Our servers, database and file storage are in Mumbai, India. Email delivery and the protection services above may process data outside India, as permitted by Indian law.

6. How long we keep it

• Account and workspace data: until you delete your account or the workspace.
• Form submissions and their files: as long as your plan keeps them (Free: 90 days, Starter: 1 year, Pro and Business: until you delete them). Locked submissions follow the same rule. We email the workspace owner at least 7 days before anything is deleted automatically, so it can be exported first.
• A submission or file you delete is deleted permanently. Exports are deleted after 7 days.
• Security records: at least one year, as Indian law requires. Server logs: about 30 days.

7. Your rights

Under the Digital Personal Data Protection Act, 2023, you can:

• get a summary of the personal data we process about you and who we share it with;
• have it corrected, completed, updated or erased;
• withdraw a consent you gave, as easily as you gave it;
• nominate someone to act for you if you die or can no longer act yourself;
• raise a grievance with us, and then with the Data Protection Board of India.

You can change your details, your email preferences and delete your account from the Account page. For anything else, email privacy@getyourforms.com.

8. Grievances

Send privacy questions and complaints to our grievance contact at privacy@getyourforms.com. We acknowledge every request and reply within the time the law allows.

9. Security

All traffic uses HTTPS. Data is encrypted at rest, passwords are stored only as hashes, captcha secrets are encrypted with keys kept apart from the database, and access to production systems is limited to the people who run the service.

10. Children

GetYourForms is meant for people aged 18 and over. We don’t knowingly create accounts for children.

11. Changes

When we change this notice in a way that matters, we update the version above and tell account holders by email before the change applies.