Privacy policy.

Who is responsible

FreelyForm (legal entity name not yet published), business address not yet published. Contact: [email protected].

For the data described below, that entity is the data controller unless this policy says otherwise. Where we handle form submissions on behalf of an account holder, the account holder is the controller and we are the processor — see Two roles below.

Two roles, and why the distinction matters

• We are the controller for your account: your name, email, password hash, sessions, API key metadata, billing records, and our own service logs.
• You are the controller, we are the processor for everything a visitor submits through your forms: field values, uploads, and the delivery records we keep so you can see what happened. We process that data on your instructions — you decide what to collect, how long to keep it, and who receives it.

In practice this means a visitor who wants their enquiry deleted asks you, the form owner, not us. We will help you answer it with export and delete operations, but we do not act on those requests directly.

Data we process

Categories, examples, and why

Category	Examples	Why
Account	Name, email address, password hash, session records, API key metadata	To create and secure the account
Form configuration	Form names, recipient addresses, notification templates, rules, webhook destinations	To run the forms you configure
Submission data	Field values, uploaded files, delivery attempts, error codes	To store and deliver what visitors send
Technical	IP address, user agent, referring source, device type, timestamps	Rate limiting, abuse prevention, attribution you asked for
Billing	Plan, period, invoice and transaction references from our merchant of record	To know which plan an account is on

We do not sell personal data, do not use submission content for advertising, and do not build profiles of visitors from form traffic.

Payments

No paid plan is on sale yet. When billing opens, orders will be processed by Paddle as merchant of record; we will never receive card numbers. Paddle is an independent controller for the payment data it collects and handles it under its own privacy policy and buyer terms. What we receive from Paddle is limited to what identifies the subscription: an account reference, the plan, the period, and transaction status.

Legal bases

Where the GDPR or an equivalent law applies, we rely on the following bases.

Purpose	Basis
Providing the service you signed up for	Performance of a contract
Payment, invoicing, tax records	Contract, and legal obligation for tax retention
Abuse prevention, rate limiting, security	Legitimate interests — keeping the service usable and safe
Diagnosing delivery failures	Legitimate interests, and contract when you ask for support
Service notices about the product	Contract, or consent where the law asks for it

Cookies and sessions

The dashboard sets one opaque session cookie so you stay signed in. The public pages and the ingest endpoint set no advertising cookies and require no consent banner. Optional third-party verification, such as Cloudflare Turnstile, may set its own cookies on forms where the form owner has enabled it — in that case the form owner decides to use it and their notice governs.

Processors we use

Processor	What it does
Cloudflare	DNS, caching, WAF and rate limiting in front of the service; Turnstile when a form enables it.
Our email delivery provider	Sends notifications and autoresponses. Currently a transactional email API; the current provider is named in the dashboard.
Paddle	Merchant of record for paid plans: payment processing, invoicing, tax, refunds.
Server hosting	Virtual servers we operate for the application and database, located in Germany.

Two destinations are not ours to choose: an account can configure its own SMTP credentials or webhook URLs, and in that case the account holder becomes the controller of what is sent there. We act as a conduit.

International transfers

Our infrastructure is in Germany, and processors may store data in other regions. Where personal data moves out of a jurisdiction with transfer restrictions, we rely on the transfer mechanism our providers put in place, such as standard contractual clauses. Ask us if you need the current specifics for a particular processor.

Retention

• Submissions: until you delete them, or until the retention window you configure removes attachments. Attachment retention defaults to 90 days.
• Delivery records: kept with the submission so a failed delivery stays diagnosable.
• Account data: until the account is deleted.
• Billing records: kept as long as tax law requires, which is a legal obligation rather than a choice.
• Backups: operational backups may hold deleted data for a limited period before they rotate out.

Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, port, or object to the processing of your personal data, and to withdraw consent where consent was the basis. To exercise any of these, email [email protected] from the address on the account. We answer within 30 days and do not charge for a first request.

If you are unhappy with our answer you can complain to your local data protection authority. If your data arrived as a form submission, ask the form owner first — they are the controller and we cannot act on their data without their instruction.

Security

Passwords are hashed, sessions are opaque random values, SMTP credentials are encrypted with AES-256-GCM, webhooks are signed, and access to production data is limited. No system is perfectly secure; report a suspected issue to [email protected] and we will respond.

Children

The service is meant for people running a website, not for children. We do not knowingly create accounts for anyone under 16. If a form collects data from children, that is the form owner's decision and their responsibility to obtain any consent the law requires.

Changes

This policy changes when a processor, a purpose, or a retention rule changes — for example when billing opens. The date at the top is the current version, and material changes are announced to account holders by email rather than silently.

Contact

FreelyForm (legal entity name not yet published), business address not yet published. Contact: [email protected].