Privacy Policy

How Formiary collects, uses, and protects your data — and the data your forms collect on your behalf.

Effective date: July 10, 2026

Formiary ("Formiary", "we", "us") provides a form backend: our customers point the forms on their websites at a Formiary endpoint, and we validate, store, and route the submissions those forms receive. This policy explains what data we collect, why, and the choices you have. It covers our marketing site (www.formiary.com), the dashboard (app.formiary.com), and the API (api.formiary.com).

Two kinds of data

We handle personal data in two distinct roles, and your rights differ depending on which applies to you:

Account data — we are the controller. If you create a Formiary account, we decide how the data described below is used and this policy applies to it directly.
Submission data — we are a processor. The people who fill out a form on a customer's website ("submitters") are sharing their data with that customer, not with us. The customer controls what their forms collect, how long it's kept, and who it's shared with; we store and route it on their instructions. If you submitted a form on someone else's website, please direct questions or requests about your data to the owner of that website.

Data we collect

Account data

Account details — name, email address, and password (stored hashed), plus team and project names you choose.
Billing data — handled by Stripe, our payment processor. We never see or store full card numbers; we keep your plan, invoices, and billing status.
Support and messages — conversations you have with us via the in-app messenger or email.
Usage and technical data — logs, error reports, and metadata (such as IP address and browser type) generated as you use the dashboard, used for security, debugging, and abuse prevention.

Submission data

Form submissions — the field values (and any file uploads) sent to a form's submission endpoint, stored on behalf of the customer who owns the form.
Submission metadata — technical details of each submission, including the submitter's IP address, used for spam detection and rate limiting on the customer's behalf.

How we use data

To provide the service: receiving, validating, storing, and routing form submissions; sending the notification and auto-response emails our customers configure.
To operate accounts: authentication, billing, support, and service emails (such as verification, invitations, and usage warnings).
To keep the service safe: spam protection, rate limiting, abuse detection, and debugging.
We do not sell personal data, and we do not use submission data for advertising or to train machine-learning models.

Subprocessors

We use a small number of service providers to run Formiary. Each processes data only as needed to provide their service to us:

Provider	Purpose
DigitalOcean	Cloud hosting and file storage
Stripe	Payment processing and billing
Resend	Transactional email delivery
Intercom	Support messaging
Sentry	Error monitoring
Axiom	Log management

Data retention

Submission data is retained until the customer who owns the form deletes it or closes their account — every plan includes unlimited retention, so we don't delete your data on a schedule.
Account data is retained while your account is active and deleted or anonymized within a reasonable period after account closure, except where we must keep records (for example, invoices) to meet legal obligations.

Your rights

If you have a Formiary account, you can access and update your account details in the dashboard, export your form submissions, and delete forms, projects, or your entire account. Depending on where you live, you may also have legal rights to access, correct, delete, or port your personal data, and to object to or restrict certain processing. To exercise any of these, contact us.

If you're a submitter, contact the owner of the website whose form you filled out; we'll assist them in fulfilling your request.

Security

Data is encrypted in transit (TLS) and at rest, access to production systems is restricted and audited, and passwords are stored using industry-standard hashing. No system is perfectly secure — if we learn of a breach affecting your personal data, we'll notify affected customers without undue delay.