Privacy

If you built a form, you have an account with us. We are the data fiduciary for your account, and you are the data fiduciary for the answers your form collects.

If you filled in a form, we have never met you. Your answers belong to the person whose form it was — they decide what to collect, how long to keep it, and what to do with it. We store it on their behalf as a data processor. Requests about that data should go to them; we will help them act on it, but we will not overrule them about their own respondents.

• Your email address, and a user ID from our authentication provider. We never see or store your password — that is handled entirely by Clerk.
• Your forms: their questions, settings and published versions.
• Whether you are on the Free or Pro plan.
• If you connect Razorpay: your public key ID in plain text, and your key secret encrypted with AES-256-GCM. The secret is never displayed back to you, never logged, and is scrubbed from error reports.

• The answers you typed, exactly as submitted, against the questions you were asked. Answers to questions that were hidden from you by conditional logic are discarded and never stored.
• Any files you attached, in a private storage bucket. They are never publicly linked — the form's owner reaches them through a link that expires after five minutes.
• Your email address, if the form asked for one, so a receipt can be sent.
• If the form took a payment: the amount, the Razorpay order and payment identifiers, and whether it succeeded. Never your card number, UPI PIN, or bank credentials — those go straight to Razorpay and never reach us.
• Your IP address, transiently, to rate-limit submissions. It is used as a counter key and is not stored against your response.
• If you leave without submitting: how many questions in you got, as a number. Never what you had typed, and with nothing that identifies you. It tells us whether a form is too long or whether the payment step puts people off — two problems that look identical otherwise.

We use a small number of services to run Formpey. Each sees only what its job requires.

• Supabase — the database and file storage. Holds everything above.
• Clerk — authentication for owners. Holds email addresses and login credentials. Respondents never touch it.
• Razorpay — payments. Sees what a payer enters at checkout; we never do.
• Resend — outgoing email: submission notifications and payment receipts.
• Upstash — rate limiting. Sees a hashed request key, not answers.
• Sentry — error reports, with credentials and tokens scrubbed before anything is sent.
• Vercel — hosting.

• We do not sell your data, or anybody's.
• We do not run advertising trackers, and there are no third-party analytics scripts on a published form. The one thing we measure there is described above: how far into a form someone got before leaving, as a number, first-party, with no identifier attached.
• We do not build a profile of you, and nothing we record about a form follows you to another site.
• We do not read form responses except when a form's owner asks us to help with a specific problem.
• We do not train anything on your data.

Responses are kept until the form’s owner deletes them or deletes their account. We do not expire them on a schedule, because a registration list is often needed months later.

Deleting an owner’s account deletes everything with it — their forms, and every response to those forms, immediately and by database cascade rather than by a cleanup job that might not run. That includes the record of payments that really happened, so an owner who may need those records should export them first.

Under India’s Digital Personal Data Protection Act 2023 you can ask for access to your data, correction of it, or its erasure.

Owners: write to support@formpey.com, or delete your account, which does all three at once.

Respondents: contact the organiser whose form you filled in. They control that data and can delete your response. If they do not respond, write to us and we will pass the request on — but the decision remains theirs, because it is their data, not ours.

• Everything travels over HTTPS.
• Razorpay credentials are encrypted at rest with AES-256-GCM, using a key held by the application and never stored in the database alongside the data it protects.
• Uploaded files sit in a private bucket and are never given a permanent public URL.
• Our error reporting strips tokens, keys and credentials before a report leaves the server.

No system is perfectly secure, and we would rather say that than imply otherwise. If you find a vulnerability, please write to support@formpey.com before disclosing it publicly.

[legalName — not set, see lib/legal.ts]
[address — not set, see lib/legal.ts]
support@formpey.com