Privacy Policy.Plainly written.

SpaceForm is an online form builder operated by Sourav Kumar Verma, an individual based in Greater Noida, Uttar Pradesh, India (“SpaceForm”, “we”, “us”). For your account data, we are the “Data Fiduciary” under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), and the “controller” under the EU and UK General Data Protection Regulation (“GDPR”) where it applies. You can reach us at souravkumarverma56@gmail.com.

SpaceForm handles two different kinds of data, and our responsibility differs between them:

• Account data: information about the people who sign up and use SpaceForm to build forms (“creators”). We decide how this is used, and this policy governs it.
• Form responses: the answers, files and payments that people (“respondents”) submit through a creator’s form. The creator decides what the form asks, why, and what happens to the answers. The creator is the Data Fiduciary (or controller) for that data, and SpaceForm processes it only on the creator’s behalf, to provide the service. The creator’s own privacy policy governs how they use responses.

We don’t review, endorse or control the content of forms that creators make, and we are not responsible for how a creator collects, uses or shares the responses they receive.

• To create and run your account, sign you in and keep your sessions secure.
• To provide the service: build, host and display forms, receive responses, and show results, summaries, analytics and exports to the form's creator.
• To run AI features when you use them.
• To process subscriptions, apply your plan, and handle failed payments, renewals and cancellations.
• To send service emails: email confirmation, password resets, team invites and important notices about your account, billing or this policy. We don't send marketing email without your consent.
• To prevent fraud, abuse, spam and security incidents, and to enforce our Terms of Service.
• To fix problems and improve SpaceForm, using aggregated or anonymous information where possible.
• To comply with the law, respond to lawful requests from authorities, and establish, exercise or defend legal claims.

We do not sell or rent personal data, we do not use it for advertising, and we do not use form responses or your content to train AI models.

India (DPDP Act): we process account data on the basis of your consent, given when you create an account (or buy a plan without one) after being shown this policy, and for legitimate uses the Act allows, such as complying with the law and responding to legal obligations. You can withdraw your consent at any time by writing to us to delete your account. Withdrawal doesn’t affect processing that already happened, and we may no longer be able to provide the service.

EU and UK (GDPR): we rely on performance of our contract with you (running your account and the service), our legitimate interests (security, fraud prevention, improving the service), legal obligations (tax, accounting, lawful requests), and your consent where we ask for it.

For form responses, the creator is responsible for having a valid legal basis and for obtaining any consent their form requires.

We share personal data only with the service providers below, who process it on our behalf to run SpaceForm and are bound by their own terms and data-protection commitments. We give each only what its job needs.

AI features: when you use one, the relevant text, questions, answers or files are sent to OpenAI to generate the result. Under OpenAI’s API terms, this data is not used to train its models by default. AI follow-up questions on a form send the respondent’s answer to that question to OpenAI, and only when the creator has turned the feature on.

Payments in forms: if a creator adds a payment question, the payment is handled by the creator’s own Stripe or Razorpay account. The payment goes to the creator, not to SpaceForm, and that provider’s privacy policy applies to it.

We may also disclose information:

• To the creator of a form: everything submitted to their form.
• To members of your organisation, according to the roles and workspace access you give them.
• When required by law, court order or a lawful request from a government authority, or when needed to protect the rights, property or safety of SpaceForm, our users or the public.
• In connection with a merger, acquisition or sale of all or part of SpaceForm, in which case the new owner will be bound by this policy for existing data and we'll tell you before your data becomes subject to a different policy.

Our application servers are in India and our database is in Singapore. Some providers listed above process data in other countries, including the United States. By using SpaceForm, you understand that your information may be transferred to and processed in these countries, whose data-protection laws may differ from yours. We transfer data only as permitted by the DPDP Act, and for GDPR transfers we rely on our providers’ standard contractual clauses or other lawful mechanisms.

SpaceForm uses only what it needs to work. We use no advertising, analytics or third-party tracking cookies.

• Sign-in cookie (essential): keeps you signed in for up to 30 days. It is marked HttpOnly, so page scripts can’t read it.
• Google sign-in cookie (essential): a random value kept for 5 minutes during Google sign-in, to protect it against forgery.
• Typeform import cookies (essential, only if you import from Typeform): a random value kept for 10 minutes while you approve access on Typeform, to protect it against forgery, and your Typeform access, encrypted, kept for an hour so you can import a few forms without approving again.
• Browser storage on your device: a respondent’s unfinished answers, when a creator turns on saved progress (kept until the form is submitted); the random ID for a form visit, kept for one tab; the workspace you last opened; and the page to return to after signing in. This stays in your browser and is not a cookie.

Because these are strictly necessary, we don’t ask for cookie consent. You can block or delete them in your browser settings, but signing in won’t work without the sign-in cookie.

• Account data and your forms: for as long as your account exists.
• Form responses: for as long as the creator keeps the form. Deleting a form deletes all of its responses, and they are also deleted with the creator's account. Creators can ask us to delete individual responses.
• After you ask us to delete your account, we delete your account data, forms and their responses within 30 days. Copies in backups are overwritten within a further 30 days.
• Records we must keep by law, such as tax and billing records, and information needed to resolve disputes, prevent fraud or enforce our terms: for as long as the law requires or allows.
• Anonymous visit statistics: until the form they belong to is deleted.
• Sign-in session records and technical logs: only as long as needed for security and troubleshooting.
• Records of actions we take on accounts: kept after the account is deleted, as long as needed to show what was done and why, for security and to enforce our terms.

Dodo Payments, Stripe and Razorpay keep their own records under their own retention policies.

We use reasonable security practices to protect personal data, as required by the Information Technology Act, 2000 and the DPDP Act. These include encryption in transit (HTTPS) for every connection, salted password hashing, encrypted storage of payment provider keys, revocable sign-in sessions, rate limiting against abuse, access checks that limit each account to its own organisation’s data, and restricted access to our servers.

No method of transmission or storage is completely secure, so we can’t guarantee absolute security. You are responsible for keeping your password safe and for the activity on your account. If we become aware of a personal data breach, we will notify the Data Protection Board of India and affected users as the law requires.

Depending on where you live, you have the right to:

• Get a summary of the personal data we hold about you and how we process it, and a list of who we have shared it with.
• Correct, complete or update inaccurate or incomplete data. You can change your name and password in Settings yourself.
• Have your personal data erased, including your whole account.
• Withdraw your consent at any time.
• Nominate another person to exercise your rights if you die or become incapable (DPDP Act).
• Have a grievance addressed by us, and then complain to the Data Protection Board of India if you aren't satisfied.
• Under GDPR, additionally: object to or restrict processing, receive your data in a portable format, and complain to your local data-protection authority.

To exercise any right, email souravkumarverma56@gmail.com from the address on your account. We may need to verify your identity first. We will respond within 30 days, or sooner where the law requires. We won’t charge you or treat you differently for exercising your rights.

The person or organisation that made the form controls your answers. To access, correct or delete them, contact the form’s creator directly. If you can’t reach them, or you believe a form is being used to collect data unlawfully or for phishing, email souravkumarverma56@gmail.com with the form’s link. We will pass your request to the creator and may take action against forms that break the law or our rules.

Never enter passwords, card numbers or other sensitive information into a form unless you trust who made it. SpaceForm will never ask for your password through a form.

If you use SpaceForm to collect information from others, you are responsible for:

• Having a lawful basis for collecting the data, and obtaining any consent your form requires, including under the DPDP Act and GDPR where they apply.
• Telling respondents who you are, why you collect their data and how you use it, for example by linking your own privacy policy in your form.
• Not collecting data you aren't allowed to collect, such as children's data without verifiable parental consent, or passwords, card numbers, government ID numbers, health or other sensitive data without a clear legal basis and adequate safeguards.
• Not using forms for phishing, fraud, spam, or anything illegal.
• Responding to requests from your respondents to access, correct or delete their data.

We may suspend or remove forms and accounts that violate these responsibilities or the law.

You must be at least 18 years old to create a SpaceForm account. We do not knowingly collect personal data from children to create accounts. If you believe a child has given us personal data, contact us and we will delete it. Creators must not use SpaceForm to collect children’s personal data without verifiable consent from a parent or lawful guardian, as the DPDP Act requires.

We may update this policy as SpaceForm or the law changes. We will post the new version here and change the effective date above. If a change materially affects how we use your personal data, we will notify you by email or in the app before it takes effect. Continuing to use SpaceForm after a change takes effect means you accept the updated policy.

For questions, requests or complaints about privacy, contact our Grievance Officer, as required by the Information Technology Act, 2000, its rules, and the DPDP Act:

We will acknowledge your grievance within 24 hours and resolve it within 15 days of receiving it. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

This policy is governed by the laws of India. Subject to any rights you have under the laws of your own country, the courts at Gautam Buddh Nagar, Uttar Pradesh, India have exclusive jurisdiction over any dispute arising from it.