Skip to content
Create a Form

Privacy Policy

This policy is a starting point written for the Create a Form software. Operators must review it with legal counsel and adapt it to their company, jurisdiction and sub-processors before publishing.

Who we are

Create a Form (“we”, “us”) provides an online form builder. For data you collect with your forms, you are the controller and we act as your processor. For your account data, we are the controller.

Data we process

  • Account data: name, email address and authentication data, processed by our identity provider Clerk.
  • Billing data: subscription status; payment details are handled by Clerk Billing and Stripe and never reach our servers.
  • Form content: the forms you build and their settings.
  • Responses: answers and files submitted to your forms, encrypted at rest with AES-256-GCM.
  • Technical data: keyed hashes of IP addresses, truncated user agents and security logs for abuse prevention.

Why we process it

  • To provide the service you signed up for (contract).
  • To keep the service secure and prevent abuse (legitimate interest).
  • To meet legal obligations such as tax records (legal obligation).

Retention

Responses are kept until you delete them, delete the form, configure automatic retention, or close your account. Uploads that are never attached to a submission are deleted after 24 hours. Audit logs are kept for up to 400 days.

Your rights

You can access, export, correct and delete your data from the dashboard at any time. Respondents should contact the owner of the form they answered. For anything else, write to support@createaform.app.

Security

See our security page for details about encryption, access control and our responsible disclosure program.

Changes

We will notify account holders of material changes to this policy by email or in the dashboard.