Skip to content
Formwire
Legal

Privacy policy

Two kinds of data pass through Formwire: yours as a customer, and your visitors' as they fill in your forms. This policy covers both, and says which role we play for each.

Effective Last updated

The short version

  • Your account data (email, name, workspaces, forms) is ours to protect as a controller. We use it to run the service and nothing else.
  • Your visitors' submissions are your data. We process them on your instructions as a processor, keep them for the retention period you choose, and delete them when you tell us to or when that period runs out.
  • We do not sell personal data, run advertising or share data with anyone except the providers needed to run the service.
  • Account data is stored in the United States. Submissions and their files are stored in the US or the EU, as you choose per workspace.
  • This site sets no cookies. The dashboard uses one cookie to keep you signed in.

Who we are

Formwire ("we") runs the service at formwire.com. For your account data, we are the controller. For the submissions your forms receive, you are the controller and we are your processor under the data processing agreement. Privacy questions go to support@formwire.com.

Data about you as a customer

When you sign up and use Formwire we hold:

  • Your email address and name.
  • How you sign in: a password is stored only as a salted hash, a passkey gives us its public key only, and if you sign in with Google or GitHub we receive the email and name that provider shares.
  • The organizations, workspaces, forms, recipients, API keys, webhooks and settings you create.
  • Usage counters (submissions per month, spam blocked) that drive limits and the dashboard.
  • An audit log of actions taken in your account (who created a form, who revoked a key), with the IP address they came from. It never contains submission content.
  • Support emails you send us.

On a paid plan, Paddle takes the payment and holds your billing details as a separate controller under its own privacy policy. We see your plan, its status and the invoices, never your full card details.

We use this data to run your account, send the email the service needs (sign-in codes, invitations, notices about changes to your account, a bounced recipient or a webhook we had to switch off), bill paid plans, answer support, enforce the terms and acceptable use policy, and keep the service working. The legal bases under the GDPR are performance of our contract with you and, for security and abuse prevention, our legitimate interest in running a service that is not abused.

We send no marketing email.

Data your forms collect

When someone submits one of your forms, we store the fields they sent, the time, the form it came from and, for spam filtering and rate limiting, the IP address and browser user agent of the request. Files are stored if your form accepts uploads. We email the submission to the recipients you chose, deliver it to the webhooks you configured, and send a confirmation email to the visitor if you turned that on.

You decide what your form asks for, you tell your visitors why, and you decide how long we keep it. We never use submission content for anything other than delivering it to you, filtering spam and responding to your support or abuse requests. Honeypot and captcha fields are removed before storage.

If you are a visitor who submitted a form and want your data changed or deleted, contact the owner of the website you submitted to; they control it. If you cannot reach them, email us and we will pass the request on or act on it where we can.

How long we keep data

  • Submissions and their files: for the retention period set on each form, 30 days unless you change it, up to 365 days. A daily job deletes older ones.
  • Spam and the trash: 30 days, then deleted for good. You can empty the trash sooner.
  • Delivery records for email and webhooks: deleted with the submission they belong to.
  • The audit log: 365 days.
  • Invoices and billing records: for as long as tax and accounting law requires.
  • Account data: for as long as you have an account. Deleting your account removes your sign-in details at once, and organizations you own alone are deleted for good after 30 days.
  • Backups: the database is exported every night and each export is kept for 30 days, plus the first export of each month for 12 months. Our database host also keeps 30 days of history for recovery. Uploaded files are not backed up. Data deleted from the service leaves the backups as they age out.

Where data is stored

Account data (users, organizations, workspaces, forms and settings) is stored by Cloudflare in the United States. Submissions and their files are stored by Cloudflare in the region you choose when you create a workspace: the United States, or the European Union, where they stay in an EU-only database, file store and backup store. Submissions never move between regions. Email, including notifications of submissions to EU workspaces, is sent from the United States by Amazon Web Services and Resend. Other nightly backups are stored by Cloudflare in the United States. Billing details for paid plans are held by Paddle (United Kingdom). For customers in the EEA, UK and Switzerland, transfers rest on the standard contractual clauses in our DPA and the providers' own transfer terms.

Who else sees it

Only the providers we need to run the service, each bound by a contract that limits them to doing so: Cloudflare (hosting, database, file storage, bot checks on sign-in, Turnstile captchas on forms that use it), Amazon Web Services (submission notification and confirmation email), Resend (account email such as sign-in codes), hCaptcha and Google reCAPTCHA (only for forms that use them), Paddle (payments for paid plans) and Google or GitHub if you sign in with them. The full list, with what each does and where, is on the subprocessors page. We will disclose data if the law requires it, and we will tell you first unless we are forbidden to.

Cookies and analytics

formwire.com sets no cookies. It counts page views with Cloudflare Web Analytics, which sets no cookies and keeps nothing that identifies you. The dashboard at app.formwire.com sets one HttpOnly session cookie so you stay signed in, and a short-lived one during Google or GitHub sign-in. Neither is used for tracking or shared. Cloudflare Turnstile, which checks for bots when you request a sign-in code or sign in with a password, may set its own cookie. The dashboard has no analytics.

Security

TLS on every connection, encryption at rest, API keys stored only as hashes, scoped API keys, bot checks and rate limits on sign-in, nightly backups and an audit log. The security page has the detail.

Your rights

You can see, export, correct and delete your data from the dashboard: export submissions to CSV or over the API, and delete single submissions, a form, a workspace or your whole account. Under the GDPR, UK GDPR and CCPA you may also ask us to access, correct, delete, restrict or port your data, object to processing, and complain to your supervisory authority. Email support@formwire.com and we will answer within 30 days. We do not sell personal information and do not discriminate against anyone who exercises these rights.

Children

Formwire is for people aged 16 and over. We do not knowingly hold accounts for anyone younger, and we will delete one if we learn of it.

Changes

When this policy changes we update the date at the top and, for anything that matters, email account owners before it takes effect.

Related