Privacy Policy

At Static Forms, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our form to email service. Please read this privacy policy carefully. If you disagree with the terms of this privacy policy, please do not access the service.

Data Controller

Static Forms (operated by Qualascend) is the data controller responsible for your personal data. For any privacy-related inquiries, please contact us at info@staticforms.dev.

Information We Collect

We collect information that you provide to us when you:

• Register for an account
• Update your account information
• Process form submissions through our service
• Contact our support team
• Subscribe to our newsletter

This information may include:

• Email address
• Name (optional)
• Website URL (optional)
• API keys
• Form configurations
• CAPTCHA settings (reCAPTCHA, Cloudflare Turnstile, or Altcha)
• Payment information (processed by Stripe)
• Form submission data processed through our service
• Signup source, recorded when you create an account. If you sign up with email, this is the path of the sign-up page, the campaign tags (utm_*) in its address, the domain name of the external website that linked to it, and the label agent-setup if you arrived through a setup link from a coding agent. If you allowed analytics cookies, it also includes the same details for the first page of your visit, including when you sign up with Google (see the Cookie Policy). We do not record full referring addresses or query strings, and drop values that look like email addresses

Legal Basis for Processing (GDPR)

We process your personal data under the following legal bases:

• Contract Performance: Processing necessary to provide you with our services, including account management, form processing, and email delivery.
• Consent: For optional features like analytics cookies, marketing communications, and form submission storage.
• Legitimate Interest: For service improvement, security monitoring, fraud prevention, and customer support.
• Legal Obligation: When required by law to retain or disclose data.

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process and deliver form submissions to your specified email address
• Monitor and analyze usage patterns and trends (with consent)
• Prevent fraudulent form submissions using CAPTCHA verification
• Communicate with you about service-related issues
• Send product updates and marketing communications (with consent)
• Process payments and manage subscriptions
• Enforce our terms, conditions, and policies

Form Submission Data

When your website visitors submit forms through our service, we process this data to deliver it to your specified email address. We act as a data processor for this information, while you (our customer) act as the data controller.

Storage of submissions: Form submissions are delivered to your email address and are also stored as records in your account dashboard. Storage applies on all plans:

• Form submissions are stored securely in your account and can be viewed through your dashboard
• Stored submissions are retained for the retention period for your plan — up to 1 year on the Free plan, enforced automatically at the database level; paid plans retain submissions indefinitely by default. Every plan can configure a shorter period per form, from 30 days upward — or until you delete them, whichever comes first
• You can export (CSV) or delete stored submissions individually or in bulk at any time, and you can delete your entire account and its stored data
• Operational metadata and logs are retained separately as described in our Data Processing Agreement (Section 3.5)

Because Static Forms stores the submissions your forms collect, you are responsible for ensuring you have appropriate consent from your form submitters. See our Data Processing Agreement for more details on our processor obligations.

Agent and Connector Access

On paid plans, you can connect an external AI agent or MCP client to one Static Forms workspace through OAuth. You choose the workspace and permissions during connection. Static Forms applies your current workspace role and form access to every request, and you can revoke the connection from Agent access at any time.

When you ask a connected agent to use Static Forms, we send the requested tool result to the agent provider you selected. Depending on the permissions and action, this can include form configuration, workspace and team details, submission fields, sender information, delivery status, and links back to signed-in Static Forms pages. We exclude passwords, access tokens, API keys, verification codes, payment details, stored integration secrets, and attachment contents from agent tool results.

• We process tool requests and results to provide the action you requested, enforce authorization, prevent abuse, diagnose failures, and keep a bounded activity record.
• The selected agent provider receives the tool inputs and results needed for your request and handles its copy under its own privacy policy and account settings.
• OAuth connection records include the provider-supplied client identity, granted permissions, workspace, user, expiry, and revocation state. Access ends when the connection expires, you revoke it, your workspace access changes, or your account is deleted.
• Form submissions retain the same Static Forms retention period whether you read them in the dashboard or through an authorized agent.

Sign in with Google

You can create a Static Forms account, or sign in to one, with your Google account. When you do, we request only Google's standard sign-in scopes: openid, email and profile. Signing in with Google does not give us access to your Gmail, Google Drive, contacts, calendar or any other data in your Google account, and we do not request offline access to your Google account.

What we receive and store:

• Email address. It becomes the email address of your Static Forms account, or matches the existing account with the same address. We accept a Google sign-in only when Google reports the email address as verified, and we then treat your account email as verified.
• Name. Saved to your account profile when the account is created through Google. Signing in with Google to an existing account does not change its profile name.
• Google account ID. Saved in a record that links your Google account to your Static Forms account, so you can sign in with Google again. The record also keeps a copy of your account email address.
• Sign-in tokens. We do not store the tokens Google returns when you sign in. A link record keeps only the token type and the granted scopes. Older link records, created before we stopped storing tokens, still hold the tokens from the first sign-in with Google, including the ID token, which contains your Google account's name, email address and profile picture URL. We have not used these tokens to call Google APIs.

Link records are stored in our database (Amazon DynamoDB), which encrypts all stored data at rest. The tokens in older link records have no additional encryption by Static Forms.

How we use it:

• We use this information to create your account, sign you in, and keep your Google sign-in linked to your account.
• Once your account exists, your email address and name are your account details. We use them as described in How We Use Your Information, for example to send service emails, and they are part of the account profile information described under Analytics.
• We do not sell information received from Google or use it for advertising. We share it only with the service providers listed under Third-Party Services & Data Processors that help us operate Static Forms, or when required by law.

Retention and deletion:

• We keep this information while your account is active.
• Disconnect Google: Disconnect in the Security section of your Account page deletes the link records for every Google account linked to your Static Forms account, including any stored tokens. Your Static Forms account stays, and you can keep signing in with your email address. Disconnecting does not block Google sign-in: if you sign in with Google again, the link is created again.
• Delete your account: Deleting your account from your Account page deletes the link records together with the rest of your account data, as described under Data Retention.
• Revoke access at Google: You can remove Static Forms' access at any time from your Google account at myaccount.google.com/permissions. Revoking removes every permission you gave Static Forms on that Google account: Sign in with Google, and every form connected to Google Sheets with that Google account, not only one. Those forms stop adding rows until they are connected again. You can still sign in with Google afterwards; Google asks for your consent again. Revoking access at Google does not delete the information we already store; to remove it, disconnect Google or delete your account.
• Log copies: Our operational logs record your email address when you sign up or sign in with Google, and your email address when you disconnect it. Older disconnect log lines, still within the retention period, also record your Google account ID. These logs are stored with Axiom, and warnings and errors are also sent to Rollbar for error diagnostics. Disconnecting or deleting your account does not remove these log copies. They expire under the log retention periods in Section 3.5 of our Data Processing Agreement: up to 365 days for operational request logs and up to 30 days for error diagnostics.

Static Forms' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google Sheets integration

Separately from sign-in, you can connect Google Sheets to a form in that form's Delivery settings so its submissions are added to a spreadsheet. Connecting requests two scopes: https://www.googleapis.com/auth/drive.file, which lets us use only the files you create or open with Static Forms, and https://www.googleapis.com/auth/userinfo.email, which tells us which Google account you connected. We request offline access so submissions can be added when you are not signed in. We also ask Google to include permissions you granted Static Forms earlier, so the granted scopes Google reports can include the sign-in scopes.

What we write to Google:

• When you connect, we create a new spreadsheet in your Google Drive, titled "Static Forms" followed by the form's name (or its delivery email address if the form has no name), with a tab called "Submissions". We do not open or change any other file in your Drive.
• For each submission, we add a row to that spreadsheet with the submission time, the submission ID and the form's fields, and we add new fields to the spreadsheet's header row as columns. A test, from the form's Delivery settings or through our API, adds a test row with the time and a test submission ID. It can also add the submission time and ID columns to the header row, or create the tab if it does not exist.
• If the tab we write to is changed, or a form rule sends submissions to another tab of the same spreadsheet, we create that tab in the same spreadsheet if it does not exist.

What we store:

• With the form's settings: the spreadsheet's ID and link, the tab name, the column headers, the email address of the Google account you connected (shown under Connected as in the form's Delivery settings to you and team members who can open the form, and to AI agents you authorize with Read configuration access), the granted scopes, the time you connected, the time of the last successful sync and the last error.
• Google's refresh token and access token, which Static Forms encrypts before storing them. We use them only to create the spreadsheet, find out which Google account you connected, and read and write that spreadsheet as described above.
• When you connect, our operational logs and our product analytics (PostHog, described under Analytics) record the form ID and the spreadsheet ID. PostHog also receives events when you test, change or disconnect the connection. These record the form ID, the test result and your plan, or which settings changed and whether the connection is enabled. They carry no Google data. Log lines and analytics events from before we stopped recording the connected Google account's email address can still contain it until they expire or are deleted.

Disconnecting:

• Disconnect in the form's Delivery settings removes the stored connection, including the tokens, and stops new rows. Deleting the form removes it too.
• Deleting your account removes the connections on forms in your own workspace. If you connected Google Sheets to a form in someone else's workspace, that connection stays with their form after you delete your account. Disconnect it first, or revoke access at Google.
• Disconnecting does not delete the spreadsheet or the rows already in it. They stay in your Google Drive under your control.
• Log and analytics copies: The form ID and spreadsheet ID recorded when you connected, and the Google account's email address in older records, stay in our operational logs (Axiom) after you disconnect or delete the form or your account. Warnings and errors about the connection, which include the form ID, also go to Rollbar. These copies expire under Section 3.5 of our Data Processing Agreement: up to 365 days for operational logs and up to 30 days for error diagnostics. The PostHog events about the connection are not removed when you disconnect or delete the form. When you delete your account, we ask PostHog to delete your analytics profile and its events, which include these; if that request fails or isn't made, the events stay. Neither this policy nor our DPA sets a retention period for PostHog data.
• Disconnecting in Static Forms does not revoke our access at Google. To revoke it, remove Static Forms at myaccount.google.com/permissions. Revoking removes every permission you gave Static Forms on that Google account: Sign in with Google, and every form connected to Google Sheets with that Google account, not only one. Those forms stop adding rows until they are connected again. You can still sign in with Google afterwards; Google asks for your consent again.

Static Forms' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Third-Party Services & Data Processors

We use the following third-party services to operate our business. Each service has their own privacy policy governing how they handle data:

Infrastructure & Hosting

• Amazon Web Services (AWS) - Cloud hosting, database (DynamoDB), and email delivery (SES). Data is stored in AWS data centers. Transactional email is delivered from AWS SES in the United States, with Singapore (AWS SES ap-southeast-1) configured as the regional failover. Privacy Policy
• Vercel - Website hosting and edge network. Privacy Policy
• Axiom - Operational log storage and monitoring. Logs are stored in the United States. Privacy Policy
• Rollbar - Error monitoring and diagnostics. Data is processed in the United States. Privacy Policy

Analytics

For anonymous visitors, analytics are loaded only after explicit cookie consent. For authenticated users, analytics are processed under our legitimate interest in operating, securing, and improving the service (and were disclosed at the time you accepted our Terms). You may opt out at any time by contacting us.

• Google Analytics - Website analytics for understanding user behavior. Privacy Policy
• PostHog (EU) - Product analytics for understanding feature usage and improving the service. Data is processed in the European Union. We send account identifiers, profile information, subscription details, signup source, and product usage events; we do not send form-submission content. Privacy Policy

Security & Spam Prevention

• Google reCAPTCHA - Spam protection for forms. Processes IP addresses and browser data. Privacy Policy
• Cloudflare Turnstile - Privacy-friendly CAPTCHA alternative (optional).Privacy Policy
• Altcha - Privacy-focused CAPTCHA alternative (optional).Privacy Policy

Payments

• Stripe - Payment processing for subscriptions. We do not store your credit card information. Privacy Policy

International Data Transfers

Your data may be transferred to and processed in countries outside of your country of residence, including the United States and Singapore. These transfers are necessary to provide our services and are protected by appropriate safeguards such as Standard Contractual Clauses (SCCs) where required by law.

Accounts that select European Union data residency when they sign up have their form data — submissions, file attachments, webhook delivery logs and AI reply logs — stored in the EU (AWS eu-central-1, Frankfurt) rather than the United States. Account and billing data and operational request logs remain US-processed for every account. Transactional email is delivered from AWS SES in the United States, with Singapore (AWS SES ap-southeast-1) configured as the regional failover. The exact scope is set out in Section 8 of our Data Processing Agreement.

Cookies and Tracking

We use cookies and similar tracking technologies to enhance your experience. For detailed information about the cookies we use and how to manage your preferences, please see our Cookie Policy.

Security

We implement appropriate technical and organizational measures to protect the security of your personal information, including:

• Encryption of data in transit (TLS/HTTPS)
• Encryption of sensitive data at rest
• Regular security assessments
• Access controls and authentication
• Employee security training

However, please be aware that no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee the absolute security of your data.

Data Retention

We retain your account information for as long as your account is active or as needed to provide you services. We may retain certain information as required by law or for legitimate business purposes.

Form Submission Data: Form submissions your forms collect are stored as records in your account on all plans:

• Stored form submissions are retained for the retention period configured for your plan (up to 1 year on the Free plan, enforced automatically at the database level; paid plans retain submissions indefinitely by default; every plan can configure a shorter period per form, from 30 days upward), or until you delete them, whichever comes first
• How long submissions are retained is separate from how far back the dashboard displays them: the inbox, its CSV export and the submissions API show the most recent 30 days on the Free plan and the full stored history on paid plans. Submissions outside the display window are retained, not deleted, and a data subject access request or account export always returns everything stored
• You can delete individual submissions or all submissions at any time through your dashboard
• If you downgrade to the Free plan, stored submissions come under the Free retention period: each is kept until 1 year after it was received, and anything already older than that is deleted shortly after the downgrade. You can export your data at any time from Settings

Account Deletion: When you delete your account, we will delete all your personal data within 30 days, except copies in our operational logs and error diagnostics, which expire under the retention periods in Section 3.5 of our Data Processing Agreement (up to 365 days for operational request logs and up to 30 days for error diagnostics); a Google Sheets connection you made on a form in someone else's workspace, which stays with that form until it is disconnected; analytics data in PostHog, which we ask PostHog to delete but which stays if that request fails or isn't made (see Analytics); and data we are required to retain for legal or regulatory purposes.

Your Rights (GDPR & CCPA)

Depending on your location, you have the following rights regarding your personal data:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data
• Right to Restriction: Limit how we process your data
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time for consent-based processing
• Right to Lodge a Complaint: File a complaint with a supervisory authority

Exercising Your Rights: You can exercise most of these rights directly through your account settings:

• Export your data via the settings page
• Delete your account via the settings page
• Manage email preferences via settings or unsubscribe links
• Manage cookie preferences via the cookie settings in the footer

For other requests, please contact us at info@staticforms.dev. We will respond within 30 days.

California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected
• Right to know if your personal information is sold or disclosed
• Right to opt-out of the sale of personal information
• Right to non-discrimination for exercising your rights

We do not sell your personal information.

Children's Privacy

Our service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you learn that a child has provided us with personal information, please contact us so we can take steps to delete such information.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last updated" date
• Sending an email notification for significant changes (if you have an account)

You are advised to review this Privacy Policy periodically for any changes.

Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:

• By visiting our contact page
• By email: info@staticforms.dev

If you are in the European Union and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection authority.