This privacy policy explains how FormNX handles your personal information and data. It applies to all products, services and websites offered by FormNX, referred to together as the "services".

In this policy, "you" refers to users and anyone interacting with our products, services and websites, while "we", "us" and "our" refer to FormNX. "Customer" (or "Customers") refers to those using FormNX to create forms. "Form Responders" are the individuals who fill in and submit forms created by our Customers.

Who We Are

FormNX is operated by The Web Fosters, a firm based in India, GSTIN 21AVVPA3897K1Z3. The Web Fosters is the data controller for the personal information you provide to us as an account holder, and acts as a data processor for the form responses our Customers collect. You can reach us about any privacy matter at [email protected].

Information We Collect

From Our Customers

1. Registration information. When you register for an account to create and use forms, we collect your name, email address and a password. Passwords are stored only in irreversibly hashed form — we never store, and cannot access, your plain-text password.
2. Billing information. If you make a payment to FormNX, you must provide billing details, including name, address, email address and information relating to your chosen payment method. If you provide a billing address, we will treat that as your location for tax and compliance purposes. Our integration with our payment gateway is solely for processing purposes. We do not store or log any sensitive cardholder data provided by you or by the people who fill in your forms. We follow industry-standard practices to protect cardholder data during processing and transmission.
3. Form data. We store our Customers' form data — questions and responses — on our hosting infrastructure, described under "Where Your Data Is Stored" below.
4. Data you use to create forms is owned by you. FormNX treats your forms as private unless you make them publicly available. We do not sell your forms or make them available to anyone, and we do not use the responses you collect for purposes unrelated to you or to providing our services.

From Visitors to Our Websites

1. Usage data. We collect usage data when you interact with our services: which pages you visit, what you click on, and when. Our web servers also maintain log files recording each access, including originating IP addresses, internet service providers, the files viewed, operating system versions and timestamps.
2. Device data. We collect data from the device and application you use to access our services, such as your IP address, operating system version, device type, system and performance information, and browser type. We may also infer your approximate geographic location from your IP address.
3. Referral data. If you arrive at a FormNX website from an external source, such as a link on another website or in an email, we record information about the source that referred you.
4. Analytics and page tags. We use third-party analytics services that set cookies on our marketing website and in the logged-in dashboard. These are described in detail under "Cookies and Analytics" below.

From Form Responders

When you fill in or complete a form created by one of our Customers, we collect information relating to you and your use of our services:

1. Form responses. We collect and store the form responses you submit, on behalf of our Customers. The form creator (the Customer) is responsible for that data and manages it. A form may ask you to provide personal information. If you have any questions about a form a Customer has sent you or given you access to, or about the data requested in it, please contact the form creator directly — FormNX is not responsible for the content of that form. The form creator may have their own privacy policy.
2. Are your form responses anonymous? You will need to ask the form creator, as it depends on how that individual, company or organization has chosen to configure the form. We provide form creators with information on how to collect responses anonymously. However, even where a form creator has followed those steps, specific questions in the form may still ask you for personal information or data that could identify you.

How We Use Your Information

We use the information described above for the following purposes:

1. To provide the services — creating and hosting your forms, collecting and storing responses, and running the integrations you enable.
2. To create and manage your account, and to authenticate you when you sign in.
3. To process payments and manage subscriptions, invoices and renewals.
4. To send you transactional messages such as confirmation emails, submission notifications, billing notices and important service announcements.
5. To provide customer support and respond to your requests.
6. To maintain, secure, troubleshoot and improve the services, including understanding how our website and dashboard are used.
7. To send marketing communications about FormNX to account holders, where permitted. You can opt out at any time using the unsubscribe link in any such message.
8. To enforce our Terms & Conditions.
9. To prevent potentially illegal activity.
10. To screen for and prevent undesirable or abusive activity. For example, we operate automated systems that screen content for phishing, spam and fraud.
11. To comply with our legal obligations, including tax and accounting requirements, and to respond to lawful requests from authorities.

Legal Bases for Processing

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR:

• Performance of a contract — to provide the services, manage your account, process payments and provide support.
• Legitimate interests — to secure our platform and prevent abuse and fraud, to understand and improve how our services are used, and to market our own services to existing account holders. We balance these interests against your rights and freedoms.
• Consent — for optional analytics cookies where consent is required, and for optional features such as AI generation and third-party integrations that you choose to enable. You can withdraw consent at any time.
• Legal obligation — to retain billing and tax records and to respond to lawful requests.

Where FormNX acts as a processor for form responses, the Customer who created the form determines the legal basis for collecting that data.

Cookies and Analytics

No analytics or session-recording tool runs on the forms you publish. A form you share with respondents loads only FormNX's own code. The services described below run on our marketing website and inside the logged-in dashboard only.

• Google Analytics — aggregate traffic and usage statistics for our marketing website and dashboard.
• Microsoft Clarity — usage analytics and session replay on our marketing website and dashboard, used to find usability problems. Clarity is configured to mask text entered into input fields. Where you are signed in, we pass your user ID, name and email address to Clarity so that sessions can be linked to an account for support and debugging.

These services set cookies and process technical identifiers such as IP addresses and device identifiers, which may constitute personal data. You can block cookies through your browser settings, opt out of Google Analytics using Google's browser opt-out add-on, and opt out of Microsoft Clarity through Microsoft's opt-out page.

AI Features

FormNX offers optional AI features that help you build a form, for example by generating fields from a description you type. When you use them, the text you enter is sent to our AI provider, OpenAI, solely to generate your result. Your form submissions are never sent to any AI provider, and your content is not used to train AI models. These features are opt-in.

Where Your Data Is Stored

The FormNX application and database are hosted with DigitalOcean in Frankfurt, Germany. Files uploaded through forms are stored with Backblaze B2 in the EU Central region. All form data therefore resides within the European Union.

International Transfers

We are based in India, and some of our service providers are located outside the European Economic Area, including in the United States. This means personal data may be accessed from, or transferred to, countries that do not have an adequacy decision from the European Commission.

Where that happens, we rely on the European Commission's Standard Contractual Clauses, or on an equivalent transfer mechanism offered by the provider, together with appropriate technical and organizational safeguards.

Who We Share Your Information With

We do not sell personal information. We share it only in the following circumstances:

• Service providers (sub-processors) that help us operate the business — hosting, file storage, payments, email and analytics. The current list, including what each provider is used for and whether it touches your form data, is published on our GDPR page.
• Integrations you connect yourself. If you connect a third-party service to your form — for example Google Sheets, an email marketing tool, or a webhook — your form data is sent to that service because you chose to enable it. Those services process the data under their own terms and on your instructions, not ours.
• Legal disclosure — where we are required to do so by law, or where disclosure is necessary to protect our rights, our users, or the public.
• Business transfer — if FormNX is involved in a merger, acquisition or sale of assets, personal data may be transferred as part of that transaction. We will notify account holders before their personal data becomes subject to a different privacy policy.

Ownership of Form Responses

Personal information a Form Responder includes in a form belongs to the responder, unless the responder has granted rights in that information to the Customer who provided the form. Check with the Customer if you have questions about that. Form submission data is managed by the form creator. FormNX treats that information as private unless the responder or the Customer has made it publicly available. Please contact the form creator directly to understand how they use your responses. Some form creators provide a privacy policy or notice at the time you complete their form, and we encourage you to review it.

We do not sell personal information gathered from form responses. We will not use contact details collected in our Customers' forms to contact Form Responders.

If you are a Form Responder and you contact us about data you submitted through someone else's form, we will forward your request to the relevant form creator and assist them in responding to it.

Security

We protect your data with the following measures:

• Encryption in transit. All traffic to and from FormNX is encrypted using TLS.
• Encryption at rest for sensitive fields. Individual form fields can be marked as sensitive in the form builder. When you enable that option, the data captured by those fields is encrypted before it is stored. We recommend enabling it for any field that collects sensitive personal data.
• Password hashing. Account passwords are stored only as irreversible hashes.
• Access control. Access to production systems is restricted to the personnel who need it to operate and support the service.
• Backups. Data is backed up regularly so that it can be restored after a failure.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a personal data breach affecting your information, we will notify you and the relevant supervisory authority without undue delay, and within 72 hours of becoming aware of it where required by law.

How Long We Retain Your Information

We retain your information for as long as you have an account with us and for as long as it is needed to provide the services to you. Specifically:

• While your account is open — your account data and form data are retained so you can keep using the service. Losing a paid subscription does not delete your data; the account moves to the free plan.
• When you delete a form or a response — it is removed from our live systems straight away, and purged from our backups within 30 days.
• When you close your account — your personal information and form data are deleted from our live systems within 30 days, and purged from our backups within 30 days of that deletion.
• Billing and tax records — invoices and transaction records are retained for as long as tax and accounting law requires, even after an account is closed.

Your Rights

Depending on where you live, you have some or all of the following rights over your personal data:

• Access — obtain a copy of the personal data we hold about you.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — ask us to delete your personal data.
• Restriction — ask us to limit how we process your data.
• Portability — receive your data in a structured, machine-readable format, or have it transferred to another provider.
• Objection — object to processing based on our legitimate interests, and to direct marketing at any time.
• Withdraw consent — where processing is based on consent, withdraw it at any time. This does not affect processing carried out before withdrawal.

Many of these you can exercise directly from your account: you can edit your profile, export your form data, and delete forms, responses or your entire account. For anything else, email us at [email protected]. We will respond within one month.

If you are in the European Economic Area or the United Kingdom and you believe we have not handled your data properly, you have the right to lodge a complaint with your local data protection supervisory authority.

California Privacy Rights

If you are a California resident, the CCPA and CPRA give you the right to know what personal information we collect and how we use it, to request a copy of it, to request correction or deletion, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined under California law, and we do not use or disclose sensitive personal information for purposes other than those permitted by the CPRA. We will not discriminate against you for exercising any of these rights. To make a request, email [email protected].

Changes to This Policy

We may update this policy from time to time. The current version is always published on this page, and the "Last Updated" date at the top will change whenever we revise it. We do not send individual notifications of changes, so we recommend reviewing this page occasionally.

Contact

If you have any questions or concerns about this Privacy Policy or about how we handle your data, please contact us at [email protected].

Related

• Terms & Conditions — the agreement governing your use of FormNX
• Data Processing Agreement — pre-signed DPA for customers who need one
• GDPR — how FormNX supports GDPR compliance, including our sub-processors