Privacy Policy

Formkove is a service provided by our team. For privacy-related requests, data subject requests, or security concerns: Email: contact@formkove.com We aim to respond promptly and will respond within the timeframe required by applicable law.

Formkove handles different kinds of data in different ways: As controller (account, billing, and service data): We determine how to process account information, billing records, support communications, security logs, and usage metadata. This processing is for operating Formkove as a business — providing the service, billing, support, and security. As processor / service provider (your form submissions): When your users submit forms, we process that content on your behalf and on your instructions. You decide what fields your forms collect and what happens with the data. We act as a sub-processor or service provider for your form submission data. This distinction matters for your legal obligations as a form owner: you are likely the primary controller for the personal data collected through your forms, and you are responsible for providing appropriate privacy notices and lawful bases for that collection.

We collect different types of information depending on how you use Formkove: Account data — email address, name, password (hashed), and account preferences you provide when you sign up. Authentication and session data — session tokens, API keys, and login records used to keep your account secure. Form submission data — the content your users submit through your embedded forms. This is determined entirely by you: you design the form fields and decide what to collect. We store this data on your behalf. Form configuration and integration settings — your form settings, notification rules, webhook URLs, integration connections (like Zapier, Slack, or Google Sheets), and any AI feature preferences you enable. Billing and subscription data — records processed by our billing provider (Dodo Payments), including plan type, usage counts, and payment method references. We do not store full payment card numbers. Transactional email data — email addresses and message content used to send you Formkove notifications about new submissions, alerts, and account-related communications. Support communications — records of any support requests you send us, and our responses. Technical and security logs — IP addresses and user agents associated with form submissions and API activity, retained for abuse prevention and security purposes. Log retention periods vary; see the retention section below. AI analysis outputs (when enabled) — when you enable AI features, Formkove may analyze submission content using Cloudflare Workers AI to generate spam scores, tags, sentiment indicators, or triage categories. These outputs are stored alongside your submissions. AI processing is optional and controlled per-form.

We use the information we collect to:

• Store and deliver your form submissions
• Send you email notifications when forms are submitted (if you configure them)
• Provide and improve the Formkove service
• Process billing and manage subscriptions
• Detect and prevent spam, abuse, and security threats
• Respond to support requests
• Run AI analysis on submissions when you enable AI features
• Notify you about service changes, security notices, or billing events

We do not use your form submission data for advertising or any purpose unrelated to providing Formkove.

This section applies to the extent relevant to your jurisdiction. The legal bases we rely on depend on the type of data: Contract: Processing account data, form submissions, authentication, and billing data is necessary to perform the service contract between Formkove and you. Without this data, we cannot provide the service. Legitimate interests: We process usage metadata, technical logs, and security data to operate, secure, and improve Formkove, detect abuse, and protect our infrastructure. This processing is limited to what is necessary and does not override your rights. Legal obligations: We may retain certain data as required by applicable law, including billing and tax records. Consent: Where we process data based on consent — for example, marketing emails — you can withdraw that consent at any time by contacting us or using any unsubscribe link in our emails. Customer instructions: Form submission data is processed on your instructions. You are responsible for ensuring you have the lawful basis (such as consent or legitimate interest) to collect that data from your form visitors.

When you use Formkove, you decide what fields your forms contain and what data they collect. Formkove processes submissions on your behalf, but:

• You are responsible for ensuring your forms include appropriate privacy notices (such as a link to your privacy policy) and that you have a lawful basis to collect the information you request.
• You are responsible for the data you collect. If you collect personal information, you likely need a privacy policy, a lawful basis for collection, and mechanisms for data subject requests from your form's visitors.
• Form submitters should contact you — the form owner — with questions about how their data is used. Formkove is the processor; you are the controller for your form submissions.

If you are unsure about your obligations, consult a qualified privacy or legal professional.

Formkove offers optional AI features that analyze form submission content using Cloudflare Workers AI. These features are:

• Optional: AI features can be enabled or disabled per form.
• Accuracy: AI outputs may be inaccurate or incomplete. Do not rely on AI analysis for legal, financial, medical, or other high-stakes decisions.
• Accuracy: AI outputs may be inaccurate or incomplete. Do not rely on AI analysis for legal, financial, medical, or other high-stakes decisions.

AI processing is performed by Cloudflare Workers AI, which is listed in our subprocessor section.

Formkove lets you connect to third-party services — webhooks, Zapier, Slack, Discord, Google Sheets via Apps Script, and others — by configuring those integrations in your account. When you enable an integration, your form submission data is sent to that destination. This means:

• You control which integrations are connected and what data is sent.
• You are responsible for reviewing and accepting the terms and privacy policies of those third-party services.
• Formkove is not responsible for how third-party services handle your data after it is sent.

When you send data to a third-party service, that service's privacy policy applies to their handling of your data.

We use a set of trusted service providers to run Formkove. All subprocessors process data only to provide their specific services and are bound by appropriate data handling terms. Current subprocessors:

• Cloudflare, Inc. — Cloudflare Workers (edge runtime), Cloudflare D1 (database), Cloudflare KV (key-value store), Cloudflare R2 (file storage for exports), Cloudflare Queues and DLQs (async work), and Cloudflare Workers AI (optional AI analysis). Cloudflare's privacy policy applies to data processed by these services.
• Amazon Web Services (AWS) via AWS SES — transactional email delivery (notifications, alerts, account emails). AWS SES processes only the email content and recipients necessary for delivery.
• Dodo Payments — billing and subscription management. Dodo Payments handles payment method information and billing records. Their privacy policy governs their handling of that data.
• Zapier, Slack, Discord, Google Apps Script — only when you configure those integrations in your Formkove account. These services process data you choose to send to them.

Future subprocessors: We may add new subprocessors as the service evolves. We will update this policy and, where appropriate, notify you of material changes. Data Processing Agreement: If you need a formal DPA with Formkove's subprocessors, contact us at contact@formkove.com.

We retain data only as long as needed for the purposes described in this policy. Specific retention periods:

• Account data: Retained while your account is active. After account deletion, we retain data as needed to fulfill legal and billing obligations, then delete or anonymize it.
• Form submissions: Retained until you manually delete them, delete the form, or delete your account.
• Generated exports: Generated exports are temporary and expire automatically after a limited period.
• Webhook and delivery logs: Retained for operational, debugging, and security purposes for a limited period. We do not retain these indefinitely.
• Queue and DLQ messages: Retained according to Cloudflare Queue settings and our operational needs.
• Billing records: Retained as required for tax, accounting, and legal compliance obligations.
• Support records: Retained as needed to resolve support requests and maintain records.
• Security and audit logs: Retained as needed for abuse prevention, fraud detection, and security monitoring.

When data is deleted, it is removed from our active systems. Residual copies may persist for a limited period in backups, consistent with standard data recovery practices.

Formkove and our subprocessors process data in Canada, the United States, and other countries where our infrastructure providers operate. If you are located in certain jurisdictions, this means your data may be transferred across borders. We take reasonable steps to ensure that such transfers are conducted in accordance with applicable law. We do not claim that Formkove's infrastructure is EU-hosted or that data is processed exclusively in any specific jurisdiction.

We take security seriously. Formkove is built on Cloudflare's infrastructure and benefits from their security controls, including:

• TLS encryption in transit on all connections
• Access controls limiting who and what can access our systems and your data
• Encrypted storage and secrets handling for sensitive credentials
• Rate limiting and abuse controls to prevent automated abuse

No service can guarantee complete security. While we implement reasonable technical and organizational measures, you use Formkove at your own risk. If you discover a security vulnerability, please contact us at contact@formkove.com.

Depending on your jurisdiction, you may have rights over your personal data, including:

• Access: Request a copy of the personal data we hold about you.
• Export: Download your data in a portable format.
• Correction: Request that inaccurate or incomplete data be corrected.
• Deletion: Request that your data be deleted, subject to legal and billing retention requirements.
• Objection or restriction: Object to or request restriction of certain processing in applicable circumstances.
• Portability: Where applicable, receive your data in a structured, commonly used, machine-readable format.
• Withdrawal of consent: Where we rely on consent, withdraw it at any time (this does not affect processing already performed).
• Complaint: File a complaint with your local data protection authority, where applicable.

To exercise any of these rights, contact us at contact@formkove.com. We will respond within the timeframe required by applicable law.

If you are a Formkove account holder, you can access, export, correct, or delete most of your data directly through your account settings or by contacting us. If you are a visitor to someone else's form (a form submitter), you should direct your privacy request to the owner of that form — they are the controller of that data, not Formkove. Formkove does not have a direct relationship with your form's visitors in most cases. If a form owner receives a data subject request from their form submitter and needs assistance from Formkove, they can contact us at contact@formkove.com and we will assist within reasonable limits.

Formkove is not intended for children under the age of 13 (or the minimum age required by applicable law in your jurisdiction). We do not knowingly collect data from children without appropriate verified parental consent where required.

Customers must not use Formkove to knowingly collect personal information from children without appropriate lawful basis. If we become aware that data from a minor has been collected without lawful basis, we will delete it.

We send two types of emails: Transactional emails are required to operate the service: new submission notifications, account security alerts, billing receipts, and similar service-related messages. You cannot opt out of these if you have an active account. Marketing emails are occasional updates about Formkove features, news, or promotions. We only send these if you have opted in or if we have a legitimate interest and you have not opted out. Every marketing email includes an unsubscribe link. To opt out of marketing, click unsubscribe or contact us at contact@formkove.com.

We update this privacy policy when our practices change. If the change is material, we will update the effective date at the top of this page and, where appropriate, notify you by email. Continued use of Formkove after any change constitutes acceptance of the updated policy. If you do not agree with a change, you can delete your account.

For privacy questions, data subject requests, security disclosures, or DPA requests: contact@formkove.com We aim to respond promptly and will respond within the timeframe required by applicable law.