Privacy Policy

This policy describes how Vellform handles personal data. It is written against what the software actually does — where it says a thing is not stored, that is because no code stores it.

1. Who is responsible for what

Two different relationships run through this product, and they carry different duties.

Your account is ours to look after. When you sign up, we are the controller of your own data — your email, your username, your plan.

The responses your forms collect are yours. You decide what to ask, why, and who to ask. For that data you are the controller and we are your processor: we store and process it on your instruction and do not use it for our own purposes. If you publish a form, you are responsible for telling the people who fill it in why you are asking and what you will do with their answers.

2. The account data we hold

• Your email address, username and display name.
• A hash of your password, if you set one. We never store the password itself.
• Your profile picture URL, if you signed in with Google.
• Your plan, your credit balance and your usage history.
• The forms you build and their settings.

3. What a form collects when somebody answers it

Whatever that form asks for. We do not add to it — with two exceptions, both of which are recorded alongside the response:

• How long they took to complete the form, in seconds.
• The referring page, if the browser sent one, truncated to 500 characters.
• If the form uses scoring, the score that was calculated.

We do not store the respondent's IP address with their response. An address is read from the request to apply a rate limit and is used as a short-lived counter key; it is never written to the response record.

4. Unfinished forms are saved

If a form has more than one page, answers are saved as the respondent moves through it, before they press submit. That means a form abandoned halfway still leaves a partial response in the owner's inbox, marked as unfinished. If you publish a form, this is one of the things worth telling people.

Progress is tied to a session identifier minted in the respondent's browser. It identifies a visit, never a person, and it is not linked to any identity.

5. Files and signatures

Uploads and drawn signatures are stored in a private bucket. They are not publicly readable and have no guessable URL: reaching one requires a signed link that the form's owner has to be authenticated to request, and that expires after five minutes.

Brand assets you upload yourself — a logo, a background image — are the one exception. Those are served publicly, because they are painted on a form that anonymous people open.

6. Artificial intelligence — what is sent, and when

The assistant runs on Google's Gemini models through Google Cloud Vertex AI. This is the section worth reading closely.

When you build or edit a form, we send your instruction, the form's current structure and theme, and any file or link you attached. That is your own content, not your respondents'.

Responses are a separate question, and the answer is: only if you ask. The assistant can summarise what people said, and to do that it has two tools:

• One returns aggregate statistics only — counts and distributions, no free text.
• One returns the raw text of a single open-text question, capped at 60 answers. It refuses any question holding personal data — email, phone, name, address, uploads or a signature — and that refusal is enforced in code, not by instruction.

So a name, an email address, a phone number, an uploaded file or a signature is never sent to the model as response data. Nothing is sent to the model unless you ask the assistant a question, and no response data is used to train anything.

7. Payments

Subscriptions and credit purchases are handled by Dodo Payments, who act as merchant of record. Checkout happens on their page. Card details are never sent to Vellform and never touch our servers. We receive confirmation that a payment succeeded, along with the subscription and payment identifiers we need to apply it to your account.

8. Cookies and local storage

Vellform sets no advertising cookies and runs no third-party analytics or tracking scripts. Your sign-in session is kept by Firebase Authentication in your browser's own storage, which is what keeps you signed in between visits.

Some interface preferences — which columns you hid in a table, which form you last opened — are stored in your browser and never leave it.

9. Security

• Every request that touches your data is checked against a verified sign-in token, and access is scoped to the workspace you belong to.
• The database uses the service key on the server only. The keys shipped to the browser cannot read tenant tables.
• Uploaded files are stored privately and reached only through short-lived signed links.
• Passwords are stored as hashes, never in plain text.
• Rate limits are applied to submissions, uploads, AI runs and account actions.

We do not hold a security certification, and this policy does not claim one.

10. Sub-processors

These are the third parties that process data on our behalf.

11. How long we keep things

Until you delete them. There is no automatic expiry: a response collected today is still there in a year unless you remove it, the form, or your account. That is deliberate — a form owner should not lose their results to a timer — but it means deletion is your decision to make.

Deleting your account from Settings removes your workspaces and everything in them: your forms, every response, every uploaded file, every export, and your account record. It does not remove workspaces belonging to somebody else that you were merely a member of.

Deletion is scheduled, not immediate. For 30 days it can be undone by signing in again, which cancels it automatically; during that window your data is retained solely so it can be restored to you. When the window closes the data is erased and cannot be recovered. If you want your data gone sooner than that, write to us and we will action it by hand.

Forms can also carry a retention period. When one is set, responses older than it are deleted automatically by a scheduled job — so you can collect answers without keeping them indefinitely. No retention period is set by default; nothing is ever deleted unless you ask for it.

12. Your rights, and how to use them

Depending on where you live you may have the right to access, correct, export or delete your personal data, to object to processing, or to complain to a data protection authority.

• Access and export: your responses can be exported to CSV from the Inbox at any time, without asking us.
• Correction: your name and username are editable in Settings.
• Deletion: Settings → delete account. It is scheduled rather than immediate: signing in within 30 days cancels it, and after that window it is irreversible.
• Anything else: write to [[ OWNER TO SUPPLY — privacyEmail ]]. We aim to respond within [[ OWNER TO SUPPLY — rightsResponseDays ]] days.

13. If you filled in somebody's form

Your answers belong to the person or organisation whose form you filled in, not to us. We store them on their behalf and cannot amend or delete them on your request — please contact whoever asked you for them. If you cannot reach them, write to [[ OWNER TO SUPPLY — privacyEmail ]] and we will help you identify them where we can.

14. Children

Vellform is not intended for children. You must be at least [[ OWNER TO SUPPLY — minimumAge ]] years old to create an account. If you believe a child has created one, write to [[ OWNER TO SUPPLY — privacyEmail ]].

15. Changes to this policy

If this policy changes materially we will update the date at the top of the page. Continuing to use Vellform after a change means you accept the updated policy.

16. Contact

This service is operated by [[ OWNER TO SUPPLY — legalEntityName ]], registered at [[ OWNER TO SUPPLY — registeredAddress ]].

Privacy enquiries: [[ OWNER TO SUPPLY — privacyEmail ]]. Security reports: [[ OWNER TO SUPPLY — securityEmail ]]. Everything else: the contact page.

This policy is not ready to publish. The operator details above are unset — fill them in at src/lib/site/site-identity.ts. Have a qualified adviser review this document before you rely on it.