Privacy policy
Last updated: 29 October 2026
FormDoc (“we”) is run by Vage Digital Ventures, Bengaluru, Karnataka, India. Questions about this policy or your data: support@formdoc.dev.
This policy covers two groups of people:
- Customers: people who create forms and accounts on FormDoc. For their account data we are the data controller (a “data fiduciary” under India’s DPDP Act).
- Submitters: people who fill in a form on a website that uses FormDoc. For submission data, the website owner decides what to collect and why. We process it for them as a data processor, under our data processing agreement. Contact the website owner first about your submission; we will help them answer you.
What we collect
From customers
- Email address and, if you sign in with Google, your name.
- Form settings: form names, recipient email addresses, redirect URLs, captcha keys (encrypted).
- Workspace, team and billing details when paid plans open (billing country, GST details for Indian invoices). Card and UPI details are handled by our payment providers, never stored by us.
- A session cookie on app.formdoc.dev that keeps you signed in. It is necessary for the service and is not used for advertising.
From submitters, on behalf of website owners
- The fields of the form, as the website designed it.
- Technical details sent with the request: the page address (Origin and Referer), browser user agent, the country Cloudflare reports for the request, and a hashed form of the IP address. The hash changes daily and is used only for rate limits and abuse checks; we don’t store raw IP addresses.
- Cloudflare Web Analytics counts page views without cookies or cross-site tracking.
- The contact form sends your name, email and message to us through FormDoc.
How we use it
- To receive, store and deliver form submissions to the recipients a customer chose, and to the integrations they connect.
- To run accounts, sign-in and, when paid plans open, billing.
- To block spam and abuse (rate limits, spam scoring, captcha checks) and keep the service secure.
- To send service emails: verification links, notifications, usage warnings and important changes. We don’t send marketing email without your consent.
We don’t sell personal data and don’t use submission content for advertising or to train AI models.
Security and storage
- Submissions are encrypted at rest (AES-256-GCM) before they are stored.
- Our database is in Mumbai, India (ap-south-1). Requests are processed by Cloudflare at the location nearest the visitor, and some sub-processors operate outside India (see below).
- Staff can’t read submission content in normal operation; any exceptional access is recorded in an audit log.
How long we keep it
- Submissions: deleted automatically after the plan’s history period (30 days on Free, 1 year on Pro, 3 years on Agency), or sooner if the customer deletes them.
- Accounts: when you delete your account we remove it from the app immediately and delete its data within 30 days.
- Email delivery records and suppression lists (bounces, complaints): kept as long as needed to protect email delivery.
Sub-processors
| Sub-processor | What for | Where |
|---|---|---|
| Cloudflare | Hosting, network, caching, page-view analytics | Global edge network |
| Supabase (on AWS) | Database | Mumbai, India |
| Resend | Sending email | Tokyo, Japan |
| Google sign-in; Google Sheets when a customer connects it | United States and other locations | |
| Slack | Slack alerts, when a customer connects it | United States |
| Meta (WhatsApp) | WhatsApp alerts, when a customer turns them on | Global |
| Razorpay, Stripe | Payments, when paid plans open | India (Razorpay); United States (Stripe) |
Your rights
You can ask to access, correct, export or delete your personal data, withdraw consent, or nominate someone to act for you, as the DPDP Act and GDPR allow. Customers can export and delete their data from the app. Email support@formdoc.dev; we reply within 30 days. If you’re not satisfied, you can complain to the Data Protection Board of India or your local data protection authority.
Children
FormDoc is not meant for children under 18, and customers must not use it to collect children’s data without verifiable parental consent.
Changes
We will post changes here and email customers about significant ones before they take effect.