Static Forms - Secure form backend and form endpoint for contact forms

Privacy Policy

Last updated: December 27, 2025

At Static Forms, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our form to email service. Please read this privacy policy carefully. If you disagree with the terms of this privacy policy, please do not access the service.

Data Controller

Static Forms (operated by Qualascend) is the data controller responsible for your personal data. For any privacy-related inquiries, please contact us at info@staticforms.dev.

Information We Collect

We collect information that you provide to us when you:

  • Register for an account
  • Update your account information
  • Process form submissions through our service
  • Contact our support team
  • Subscribe to our newsletter

This information may include:

  • Email address
  • Name (optional)
  • Website URL (optional)
  • API keys
  • Form configurations
  • CAPTCHA settings (reCAPTCHA or Altcha)
  • Payment information (processed by Stripe)
  • Form submission data processed through our service

Legal Basis for Processing (GDPR)

We process your personal data under the following legal bases:

  • Contract Performance: Processing necessary to provide you with our services, including account management, form processing, and email delivery.
  • Consent: For optional features like analytics cookies, marketing communications, and form submission storage.
  • Legitimate Interest: For service improvement, security monitoring, fraud prevention, and customer support.
  • Legal Obligation: When required by law to retain or disclose data.

How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve our services
  • Process and deliver form submissions to your specified email address
  • Monitor and analyze usage patterns and trends (with consent)
  • Prevent fraudulent form submissions using CAPTCHA verification
  • Communicate with you about service-related issues
  • Send product updates and marketing communications (with consent)
  • Process payments and manage subscriptions
  • Enforce our terms, conditions, and policies

Form Submission Data

When your website visitors submit forms through our service, we process this data to deliver it to your specified email address. We act as a data processor for this information, while you (our customer) act as the data controller.

Default Behavior: By default, we do not permanently store form submission content on our servers. Form data is processed and delivered to your email address, then removed from our systems beyond minimal metadata required for service improvement and security purposes.

Optional Storage for Pro Users: Users on paid plans (Pro) have the option to enable form submission storage in their account settings. When enabled:

  • Form submissions are stored securely in your account and can be viewed through your dashboard
  • You maintain full control over this feature and can enable or disable it at any time
  • Stored submissions are retained indefinitely until you manually delete them
  • You can export or delete stored submissions at any time
  • This storage is entirely optional and disabled by default

If you enable form storage, you are responsible for ensuring you have appropriate consent from your form submitters. See our Data Processing Agreement for more details on our processor obligations.

Third-Party Services & Data Processors

We use the following third-party services to operate our business. Each service has their own privacy policy governing how they handle data:

Infrastructure & Hosting

  • Amazon Web Services (AWS) - Cloud hosting, database (DynamoDB), and email delivery (SES). Data is stored in AWS data centers.Privacy Policy
  • Vercel - Website hosting and edge network.Privacy Policy

Analytics (With Consent)

  • Google Analytics - Website analytics for understanding user behavior.Privacy Policy
  • Mixpanel - Product analytics for improving our service.Privacy Policy
  • Vercel Speed Insights - Performance monitoring.Privacy Policy

Security & Spam Prevention

  • Google reCAPTCHA - Spam protection for forms. Processes IP addresses and browser data.Privacy Policy
  • Altcha - Privacy-focused CAPTCHA alternative (optional).Privacy Policy

Payments

  • Stripe - Payment processing for subscriptions. We do not store your credit card information.Privacy Policy

Email Marketing (With Consent)

International Data Transfers

Your data may be transferred to and processed in countries outside of your country of residence, including the United States. These transfers are necessary to provide our services and are protected by appropriate safeguards such as Standard Contractual Clauses (SCCs) where required by law.

Cookies and Tracking

We use cookies and similar tracking technologies to enhance your experience. For detailed information about the cookies we use and how to manage your preferences, please see our Cookie Policy.

Security

We implement appropriate technical and organizational measures to protect the security of your personal information, including:

  • Encryption of data in transit (TLS/HTTPS)
  • Encryption of sensitive data at rest
  • Regular security assessments
  • Access controls and authentication
  • Employee security training

However, please be aware that no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee the absolute security of your data.

Data Retention

We retain your account information for as long as your account is active or as needed to provide you services. We may retain certain information as required by law or for legitimate business purposes.

Form Submission Data: By default, we do not store form submission content. If you are a Pro user and choose to enable form submission storage:

  • Stored form submissions are retained indefinitely until you manually delete them
  • You can delete individual submissions or all submissions at any time through your dashboard
  • If you disable form storage, existing stored submissions will remain in your account until you manually delete them
  • If you downgrade from Pro to Free plan, stored submissions will be retained for 30 days to allow you to export them, after which they will be automatically deleted

Account Deletion: When you delete your account, we will delete all your personal data within 30 days, except for data we are required to retain for legal or regulatory purposes.

Your Rights (GDPR & CCPA)

Depending on your location, you have the following rights regarding your personal data:

  • Right of Access: Request a copy of your personal data
  • Right to Rectification: Correct inaccurate or incomplete data
  • Right to Erasure: Request deletion of your personal data
  • Right to Restriction: Limit how we process your data
  • Right to Data Portability: Receive your data in a machine-readable format
  • Right to Object: Object to processing based on legitimate interests
  • Right to Withdraw Consent: Withdraw consent at any time for consent-based processing
  • Right to Lodge a Complaint: File a complaint with a supervisory authority

Exercising Your Rights: You can exercise most of these rights directly through your account settings:

  • Export your data via the settings page
  • Delete your account via the settings page
  • Manage email preferences via settings or unsubscribe links
  • Manage cookie preferences via the cookie settings in the footer

For other requests, please contact us at info@staticforms.dev. We will respond within 30 days.

California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

  • Right to know what personal information is collected
  • Right to know if your personal information is sold or disclosed
  • Right to opt-out of the sale of personal information
  • Right to non-discrimination for exercising your rights

We do not sell your personal information.

Children's Privacy

Our service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you learn that a child has provided us with personal information, please contact us so we can take steps to delete such information.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any material changes by:

  • Posting the new Privacy Policy on this page
  • Updating the "Last updated" date
  • Sending an email notification for significant changes (if you have an account)

You are advised to review this Privacy Policy periodically for any changes.

Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:

If you are in the European Union and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection authority.

← Back to Home