Acceptable use policy

What is not allowed

Do not use Formwire, directly or through someone else, to:

• Phish or impersonate. Forms that pretend to be a bank, a government body, a company you do not represent, or a sign-in page for another service.
• Collect credentials or payment details. Passwords, one-time codes, full card numbers, bank logins or government identifiers through a plain form.
• Send spam. Using confirmation emails, recipients or webhooks to send unsolicited mail, or submitting to your own forms to generate email to third parties.
• Harass or threaten. Content that targets a person with abuse, or forms built to flood someone's inbox.
• Distribute malware or illegal content. Including through file uploads.
• Break the law. Fraud, intellectual property infringement, content that is illegal where you or your visitors are, or processing children's data without the rights to do so.
• Attack the service. Probing other customers' forms or data, evading rate limits or quotas with multiple accounts, scraping, or reselling the Free plan.

What you are responsible for

• What your forms ask for, and telling visitors why in your own privacy notice.
• Having consent or another lawful basis for every address you add as a recipient and every confirmation email you send.
• Keeping API keys secret and rotating an access key that is being abused.
• Turning on the spam protection your situation needs: honeypot, spam scoring and rate limits are always on, and you can add a captcha (hCaptcha, Cloudflare Turnstile or Google reCAPTCHA), block words and limit a form to your own domains.

How we find out

Every submission notification and confirmation email carries a "Report abuse" link, and anyone can write to us from the report abuse page. We also watch bounce and complaint rates per workspace, because a workspace whose mail is being marked as spam puts every other customer's delivery at risk. We do not read submission content as a matter of course; we look at a specific form when a report or an alert points at it.

What we do

• For clear phishing, credential theft or malware we suspend the form or workspace immediately, then email the owner.
• For everything else we email the owner first, explain the problem and give a reasonable time to fix it before we suspend anything.
• A suspended form answers every submission with an error and sends nothing. Suspension deletes nothing; if you need an export, ask us.
• Repeated or serious breaches close the account under the terms.
• If you think we got it wrong, reply to the email or write to support@formwire.com and a person will look again.

Changes

We update the date at the top when this policy changes, and email account owners about anything that narrows what is allowed.