Privacy Policy

1. Information We Collect

We collect information you provide directly to us when you create an account, build a form, submit a form, or communicate with us. This may include your name, email address, password, organization name, and any other information you choose to provide.

2. How We Use Your Information

We use the information we collect to provide, maintain, and improve our services, to process transactions, to send you related information including confirmations, invoices, and technical notices, and to monitor and analyze trends and usage.

3. Data Processing for Form Respondents

When you respond to a form created by one of our users, Formora acts as a data processor. The creator of the form is the data controller. We only process respondent data according to the instructions of the form creator. If you have questions about a specific form, please contact the form creator directly.

4. Data Security

We implement technical and organizational measures designed to protect the personal information we process. Secrets such as webhook signing keys and two-factor seeds are encrypted at rest with AES-256-GCM, traffic is served over TLS, access is scoped to a single organization and checked on every request, and administrative actions are recorded in an audit log. A full description is on our security page, including an explicit list of the certifications we do not hold. No transmission over the internet can be guaranteed completely secure.

5. Data Retention

We keep your account and workspace data for as long as the account exists. Responses are kept until you delete them or delete the form they belong to; deletion removes them from the live system, and they age out of routine backups afterwards. You can export responses to CSV at any time without contacting us.

6. Your Privacy Rights (GDPR / CCPA)

Depending on where you are, you may have the right to request access to, correction of, or deletion of your personal information, and the rights to portability and to object to or restrict processing. Much of this you can exercise yourself from within the product — profile details, response export and response deletion. For anything else, write to privacy@formora.app and we will respond within the period the applicable law allows.

If you are a respondent rather than an account holder, the organization that created the form decides what is collected and why. We act on their instructions, so requests about a specific form are best directed to them first; if you cannot reach them, contact us and we will help you identify who to ask.

7. Service Providers

We rely on third parties to host the application and its database, store uploaded files, and deliver transactional email. They process data on our instructions only, and we do not sell personal information or share it for cross-context behavioural advertising. Ask us and we will tell you who our current providers are and where they operate.

8. Cookies and Tracking

Formora uses strictly necessary cookies for authentication and session management. We do not use advertising cookies and do not track individuals across other websites.

9. Contact Us

Questions about this Privacy Policy can go to privacy@formora.app, or through our contact page.