Privacy Policy

This Privacy Policy explains how [Registered business name] ("we", "us", "our"), the operator of Formcrest, handles personal data when you use our website, dashboard, and form-backend service. We act as the data controller for your account data and as a data processor for the form submissions you collect from your own website visitors. If you have any questions, contact us at info@formcrest.com.

Who we are

Formcrest is operated by [Registered business name], a sole proprietorship run by [Founder full name], established in Greece. Our registered address is [Registered business address, Greece] and our EU VAT number is [EU VAT number]. For any privacy matter you can always reach us at info@formcrest.com.

What we collect

We keep the data we collect to the minimum needed to run the service:

• Account email address. Required to create and identify your account, send service emails, and recover access.
• Optional display name. Defaults to the local part of your email if you do not set one.
• Submitter metadata on form submissions. When a visitor submits one of your forms, we store the IP address and user-agent of that submission, along with referer, origin, and an approximate country derived from the IP. This helps with spam filtering, abuse handling, and your own analytics.
• OAuth provider IDs. If you sign in with Google or GitHub, we store the provider account identifier and encrypted tokens so we can authenticate you. We never receive or store your provider password.
• Payment metadata. Billing is handled by Stripe. We hold only Stripe customer and subscription identifiers; full card details are processed and stored by Stripe, never by us.
• Tax and invoicing data. For paid plans we store your billing country and, optionally, your VAT/tax ID and business name, collected at checkout for VAT-compliant invoicing.
• Security and audit data. We log security-sensitive events (logins, password changes, plan changes, account deletion) with the associated IP and user-agent.

Lawful basis for processing

We rely on the following lawful bases under Article 6 of the GDPR:

• Performance of a contract for paid plans — processing necessary to provide the service you have subscribed to.
• Legitimate interest and consent for the free plan — your acceptance of our Terms of Service covers the processing required to deliver the free service, with our legitimate interest in operating, securing, and improving it.
• Legal obligation for tax records, invoicing, and retention of abuse reports.

Data residency

Formcrest is EU-resident by default, which keeps the service GDPR-friendly for our EU-targeted positioning:

• Database (Cloudflare D1) is configured with a primary region of Western Europe (weur), so the primary copy of your data is EU-resident.
• Outbound email (AWS SES) is sent from the eu-west-1 region (Ireland).
• Website and dashboard hosting (Vercel) runs in the fra1 (Frankfurt) and cdg1 (Paris) regions.

Where any sub-processor operates globally, transfers are governed by appropriate safeguards such as Standard Contractual Clauses. See our sub-processors page for the full list.

Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, and port your personal data, and to object to certain processing. Several of these are available self-serve in your dashboard:

• Access and portability. Export all of your account data as machine-readable JSON from the dashboard at any time.
• Rectification. Edit your profile, email, and form configuration directly in the dashboard.
• Erasure. Delete your account from the dashboard. This starts the deletion process described under Retention below.

To exercise any right that is not self-serve, or to raise a concern, email info@formcrest.com. You also have the right to lodge a complaint with your local data protection authority.

Data retention

We retain data only as long as needed for the purpose it was collected:

• Form submissions: retained according to your plan — 30 days on Free, 90 days on Pro, and indefinitely on Agency. A nightly job deletes submissions older than your plan's window.
• Security audit log: 12 months.
• Email bounce and complaint records: 24 months, to protect deliverability.
• Abuse reports: 5 years, to meet our legal and liability obligations.
• Deleted accounts: when you delete your account it is first soft-deleted and you are logged out. After a 30-day grace period the account and its associated data are permanently (hard) deleted.
• Billing records held by Stripe are retained per Stripe's own retention schedule and as required by tax law.

Sub-processors

We use a small number of trusted third parties to deliver the service — for hosting, the database, email delivery, payments, and error monitoring. The complete, up-to-date list, with each provider's purpose and location, is published on our sub-processors page. We give at least 30 days' notice before adding a new sub-processor.

Cookies and analytics

• Dashboard: we use essential session cookies only. These keep you signed in and are required for the service to function. We do not run third-party analytics on the dashboard.
• Marketing site: we use Plausible, a privacy-friendly analytics tool that sets no cookies and does not track you across sites or collect personal data.

Breach notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users without undue delay and within 72 hours of becoming aware of it, in line with Article 33 of the GDPR.

Security

We protect data in transit and at rest, encrypt sensitive tokens, hash passwords, and follow the practices described on our security page.

Children

Formcrest is not intended for use by children under 13. We do not knowingly collect data from children; accounts found to belong to a child under 13 will be terminated and the associated data deleted.

Changes to this policy

We may update this Privacy Policy as the service evolves or the law changes. Material changes will be announced in advance where practicable, and the "last updated" date above will always reflect the current version.

Contact

For any privacy question or to exercise your rights, contact us at info@formcrest.com. You can also review our related policies: Terms, Acceptable Use, Sub-processors, and Report abuse.