Privacy Policy

1. Controller and Processor Roles

Formtorch handles personal data in two different roles:

• Formtorch as controller: we decide how and why we process your account, billing, usage, and support data, and data about visits to our marketing website (formtorch.com). This Privacy Policy describes that processing.
• Formtorch as processor: when someone submits a form built with Formtorch, the website owner who built the form is the controller of that data, and we process it on their behalf. Our handling of form submissions is governed by our Data Processing Addendum, which prevails over this Privacy Policy if the two conflict.

If you submitted a form on a website that uses Formtorch, please contact that website's owner first about your data, including requests to access, correct, or delete it. If we receive such a request directly, we will forward it to the website owner where we can identify them.

2. Information We Collect

We collect information you provide directly when you create an account, configure forms, or contact support. This includes:

• Account information: name, email address, and password (hashed).
• Billing information: payment method details processed by our payment provider; we do not store raw card numbers.
• Profile and workspace settings: notification email addresses, workspace name and logo.

We also collect information automatically when you use the Service:

• Usage data: pages visited, features used, timestamps, and session duration.
• Log data: IP addresses, browser type, operating system, and referring URLs.
• Cookies and similar technologies: session identifiers, authentication tokens, and analytics preferences.
• Website interaction data: on our marketing website, how you move, click, and scroll through pages, including session replays and heatmaps (see Section 10).

When people submit forms built with Formtorch, we receive the data they submit (e.g., names, email addresses, messages) as a processor on behalf of the website owner. See Section 1.

3. Google Account and Google Sheets Data

When you connect a Google account to Formtorch, we access only the Google data needed to provide the Google Sheets integration.

Formtorch may access:

• your Google Account email address to identify the connected account;
• Google Drive files you explicitly select through Google Picker;
• spreadsheet and worksheet names and identifiers; and
• the selected worksheet to append form submissions as new rows.

Formtorch does not browse or access unrelated files in your Google Drive.

We store the connected Google account identifier, selected spreadsheet and worksheet identifiers, and OAuth credentials needed to maintain the connection. OAuth tokens are encrypted at rest.

We use Google user data only to provide and maintain the Google Sheets integration. We do not sell it, use it for advertising, or use it to train generalized AI or machine-learning models. Our personnel may access it only when necessary to provide support requested by you, investigate security or abuse, comply with law, or operate the integration under confidentiality obligations.

You may disconnect Google through Formtorch's Integrations settings or revoke access through your Google Account. Disconnecting stops future access and delivery but does not delete form submissions already written to your Google Sheet.

Formtorch's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

4. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Service.
• Process transactions and send billing-related communications.
• Send transactional emails (submission notifications, onboarding) and, where opted in, product updates.
• Detect and prevent fraud, spam, and abuse.
• Respond to support requests and communicate with you.
• Comply with legal obligations.

We do not sell your personal information or the personal information of your form respondents to third parties.

We do not use form submissions for advertising or to train generalized AI or machine-learning models.

5. Data Sharing

We share your information only in the following circumstances:

• Service providers: We share data with third-party vendors who help operate the Service (cloud infrastructure, payment processing, email delivery, error monitoring, website analytics). These parties process data only as directed by us, except where an analytics provider such as Google Analytics or Microsoft Clarity also processes data under its own privacy statement (see Section 10). Our subprocessor list names each provider and its location.
• Legal requirements: We may disclose information if required by law, court order, or government authority.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction. We will notify you before your data is subject to a different privacy policy.
• With your consent: We share information with third parties when you explicitly authorize us to do so.

6. Data Retention

We retain your account information for as long as your account is active or as needed to provide the Service.

Form submissions are kept until you delete them or close your account. Your plan sets how far back submissions appear in the dashboard; older submissions are hidden, not deleted, and you can ask us to delete them at any time.

When you delete a form or close your account, we will delete associated data within 30 days, except where retention is required by law or for legitimate business purposes such as resolving disputes. Deleted data is removed from our backups as they expire, within 30 days.

7. Security

We implement industry-standard security measures to protect your data, including encryption in transit (TLS) and at rest, access controls, and regular security reviews.

Our security measures are listed in Annex II of our Data Processing Addendum. If a security breach affects form submission data, we notify the affected customers within 48 hours of becoming aware of it.

No method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. We encourage you to use a strong, unique password and to notify us immediately of any suspected unauthorized access.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal information, subject to certain exceptions.
• Portability: Receive your data in a structured, machine-readable format.
• Objection or restriction: Object to certain processing or request that we restrict how we use your data.
• Withdrawal of consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@formtorch.com. We will respond within 30 days.

If you submitted a form on a website that uses Formtorch, contact that website's owner first (see Section 1).

9. Cookies

We use cookies and similar tracking technologies to maintain your session, remember preferences, and analyze Service usage. You can control cookies through your browser settings, but disabling certain cookies may affect Service functionality.

We do not use cookies to serve you ads, and we do not sell data to ad networks. Some third-party analytics providers, including Google Analytics and Microsoft Clarity, set their own cookies; see Section 10 for details.

10. Website Analytics and Session Replay

We use Google Analytics and Microsoft Clarity to understand how visitors use and interact with our marketing website (formtorch.com). We use this data for site optimization, to understand the popularity of our products and content, and for fraud and security purposes. We do not use it to serve you ads.

Both tools run only on our public marketing website. They do not run in the Formtorch dashboard or documentation, and they do not capture form submissions that your respondents send to your Formtorch endpoints. You can block or delete their cookies through your browser settings.

Google Analytics collects aggregated traffic and usage statistics, including:

• Pages you view, how long you stay, and how you arrived (such as the referring website or search engine).
• Device and browser data: browser type, operating system, screen size, and approximate location derived from your IP address.

Google Analytics uses first-party cookies (such as _ga and _ga_<ID>) to distinguish visitors and sessions. Google processes this data on our behalf and may also use it as described in its own privacy policy. You can opt out of Google Analytics across all websites by installing the Google Analytics Opt-out Browser Add-on.

For more information about how Google uses data from sites that use its services, see How Google uses information from sites or apps that use our services and the Google Analytics Opt-out Browser Add-on.

Microsoft Clarity captures behavioral metrics, heatmaps, and session replays so we can see which pages are useful, where visitors get stuck, and how to improve our website and products. Clarity may collect:

• Interaction data: mouse movements, clicks, taps, scrolling, and the pages you view.
• Session replays: a reconstruction of your visit based on page content and your interactions. Text you type into form fields is masked by default and is not recorded.
• Device and browser data: browser type, operating system, screen size, approximate location derived from your IP address, and referring URL.

Clarity collects this data using first-party and third-party cookies (such as _clck, _clsk, and MUID) and similar tracking technologies. Microsoft processes Clarity data on our behalf and may also use it as described in its own privacy statement.

For more information about how Microsoft collects and uses your data, see the Microsoft Privacy Statement.

11. Children's Privacy

The Service is not directed to children under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware that we have collected such information, we will take steps to delete it promptly.

12. International Transfers

Formtorch is based in Canada. If you access the Service from outside Canada, your information may be transferred to and processed in Canada or other countries where our service providers operate. By using the Service, you consent to this transfer.

Our service runs mainly in the United States: form submissions and uploaded files are stored in AWS us-west-2 (Oregon), and most of our service providers are located in the US. Our subprocessor list shows each provider's location.

We rely on appropriate safeguards (such as standard contractual clauses) when transferring data internationally in compliance with applicable law.

If you are a Formtorch customer, we process the personal data your form respondents submit on your behalf under our Data Processing Addendum, which sets out our commitments as your processor, including the safeguards for international transfers.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or via a notice in the dashboard before the changes take effect. We encourage you to review this page periodically.

14. Contact

If you have questions or concerns about this Privacy Policy or how we handle your data, please contact us at privacy@formtorch.com.