1. Information We Collect
We collect the following types of information:
- Account Data: Name, email address, phone number, and company name provided during registration.
- Usage Data: Pages visited, features used, form creation and response statistics.
- Device Data: Browser type, device fingerprint, IP address, and operating system — collected for security and fraud prevention.
- Payment Data: Payment transactions are processed by Razorpay. We do not store your card details.
- Form Data: Form configurations, questions, and responses created by you and submitted by your users.
2. How We Use Your Information
- To provide, maintain, and improve the Service
- To authenticate your identity and secure your account
- To prevent fraud, abuse, and trial manipulation
- To send transactional emails (welcome, password reset, trial expiry, invoices)
- To communicate product updates and important notices
- To comply with legal obligations
3. Data Storage & Security
Your data is stored securely using Google Cloud infrastructure (Google Sheets and Google Drive). We implement the following security measures:
- Passwords are hashed using SHA-256 with unique salts — never stored in plain text
- All communication is encrypted via HTTPS/TLS
- Session tokens expire after 30 days
- Rate limiting protects against brute-force attacks
- Device fingerprinting prevents trial abuse
4. Data Sharing
We do not sell, trade, or rent your personal information. We may share data only in these situations:
- Service Providers: Payment processing (Razorpay), hosting (Vercel, Google).
- Legal Requirements: When required by law, court order, or government authority.
- Business Transfers: In the event of a merger, acquisition, or asset sale.
5. Your Rights
Under applicable data protection laws (including India's DPDP Act), you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your account and data
- Withdraw consent for marketing communications
- Export your form data
To exercise these rights, contact us at support@formcraft.in.
6. Cookies & Tracking
We use essential cookies for authentication (session tokens). We do not use advertising cookies or third-party trackers. Analytics data is collected server-side without cookies.
7. Form Respondent Data
When someone fills out a form created on FormCraft, the form creator (our client) is the data controller. We act as a data processor. Form respondents should refer to the form creator's privacy policy for details on how their data is used.
8. Data Retention
- Active accounts: Data retained while the account is active.
- Deleted accounts: Data deleted within 30 days of account deletion.
- Trial accounts: Inactive trial accounts are purged after 90 days.
- Payment records: Retained for 7 years as required by tax regulations.
9. Children's Privacy
The Service is not intended for children under 18. We do not knowingly collect data from children. If we become aware of such data, we will delete it promptly.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. The updated policy will be posted on this page with a revised date.
11. Contact Us
For privacy-related questions or requests, contact our Data Protection Officer at support@formcraft.in.