Privacy Policy

Last updated: July 29, 2026  ·  Effective immediately

1. Who we are

FormflowX ("we", "our", "us") is an online form-building platform. Our registered contact email for data matters is tech@sendit.co.in.

2. What data we collect

Account data: When you sign up, we collect your email address and name. You may optionally add an avatar photo.

Form response data: When a person fills out a form you created, we store their answers, the submission timestamp, and optionally their email address (if your form asks for it). We do not store raw IP addresses of respondents.

Usage data: We store browser user-agent strings with form submissions for abuse prevention. This is technical metadata, not used for profiling.

Integration tokens: If you connect Google Sheets, Notion, or other services, we store OAuth tokens encrypted in our database. These are never exposed to other users.

Billing data: Payment is processed by Stripe. We do not store card numbers or banking details.

3. Legal basis for processing (GDPR)

• Contract performance — processing account data to provide the service you signed up for
• Legitimate interests — abuse prevention (user-agent logging), security, and fraud detection
• Consent — any optional features you explicitly opt in to (e.g. marketing emails)

4. How we protect your data

• All data is stored on Supabase (hosted on AWS), which encrypts data at rest and in transit
• Row-Level Security (RLS) policies are enforced at the database layer — users can only access their own workspace data
• All API calls require a valid JWT token; tokens expire and are verified on every request
• OAuth tokens are stored server-side only and never sent to the browser
• All traffic is served over HTTPS via Vercel's global edge network

5. Data sharing

We do not sell your data. We share data only with:

• Supabase — database and authentication infrastructure
• Vercel — serverless hosting and edge delivery
• Stripe — payment processing
• Resend — transactional email delivery
• Third-party integrations you explicitly connect (Google Sheets, Slack, Notion, etc.) — only the data you configure is sent

6. Your rights (GDPR Articles 15–22)

• Right of access (Art. 15) — you can export all your data from Account Settings → Export data
• Right to rectification (Art. 16) — update your name and profile at any time in Account Settings
• Right to erasure (Art. 17) — permanently delete your account and all associated data from Account Settings → Delete account
• Right to portability (Art. 20) — your exported data is delivered as machine-readable JSON
• Right to object (Art. 21) — contact us at tech@sendit.co.in to object to any specific processing

7. Data retention

We retain your account data for as long as your account is active. Form responses are retained until you delete them or delete the form. When you delete your account, all data is permanently removed within 30 days of deletion (to allow for backup expiry).

8. Cookies

FormflowX uses only first-party session cookies required for authentication. We do not use third-party advertising or tracking cookies.

9. International transfers

Your data is stored on servers in the United States (AWS us-east-1) via Supabase. Supabase participates in the EU-US Data Privacy Framework, providing adequate protection for transfers from the EU/EEA.

10. Changes to this policy

We may update this policy as our service evolves. Material changes will be communicated by email. The "Last updated" date at the top of this page reflects the most recent revision.

11. Contact

For any privacy-related questions or to exercise your rights, contact us at tech@sendit.co.in. We respond within 72 hours.