Legal
Last updated: 30 July 2026
HelloForms provides an online form builder that lets customers create forms, publish them and collect responses. This policy explains what we do with personal data both for our customers (account holders) and for people who fill in a customer's form (respondents).
Account data: your name, email address, password hash, plan tier and billing status. Usage data: forms created, submissions received, quota periods and product events needed to enforce plan limits. Submission data: whatever a customer chooses to collect in their own forms. Technical data: IP address, browser type and timestamps used for security and abuse prevention.
To operate your account, render and deliver your forms, store submissions, enforce plan limits, send transactional and notification emails you configure, take payment for subscriptions, and keep the service secure and reliable. We do not sell personal data and we do not use submission content for advertising.
For form responses, the customer who created the form is the data controller and HelloForms acts as a processor on their behalf. If you filled in someone's form and want your data changed or removed, contact that organisation first; we will support them in honouring your request.
Data is stored in managed, access-controlled infrastructure with row-level security so one account can never read another's records. Passwords are hashed and never stored in plain text. Submissions are retained until the customer deletes them or closes the account; deleted accounts are purged within 30 days, subject to legal retention duties.
We rely on a small number of vendors to run the service: managed database, authentication and storage hosting; a payment provider for subscription billing; and an email delivery provider for transactional and notification messages. Each is bound by a data processing agreement.
We use strictly necessary cookies and local storage to keep you signed in and to remember interface preferences. Published forms do not set marketing or tracking cookies on respondents.
Depending on where you live you may request access, correction, deletion, restriction, portability or objection regarding your personal data. Account data can be exported or deleted from the workspace, or by emailing us. We respond to verified requests within 30 days.
Where data is transferred outside your region, we rely on standard contractual clauses or an equivalent recognised safeguard with each sub-processor.
We will update this page when our practices change and revise the date below. Questions or requests: hello@helloforms.net.