Privacy Policy

Last updated 28 October 2026

This policy explains what Formpit collects, why, and how it is handled. Formpit is operated by Jeyanth, an individual based in India. Contact: hello@formpit.com.

Two kinds of people

Account holders are the people who sign up and point their forms at Formpit. Visitors are people who fill in those forms on an account holder's website. For visitor data, the account holder decides what to collect and is the data controller; Formpit processes it on their instructions. Visitors with questions about a specific form should contact the website that showed it.

What we collect from account holders

• Email address and a hashed password, to run your account.
• Form settings you enter (notification addresses, redirect URLs, integration details). Notion integration secrets are stored encrypted.
• Billing status (plan, subscription identifiers) from Dodo Payments. We never see or store your card details.
• Basic server logs (IP address, browser, pages requested) kept for up to 30 days for security and debugging.
• A session cookie to keep you logged in, and a local preference for light or dark theme. We use no advertising or tracking cookies.

What we process on behalf of account holders

• Form submissions: every field a visitor sends, plus the visitor's IP address, browser user-agent and the page the form was on, used for spam filtering and shown to the account holder.
• Uploaded files, on the Pro plan.
• Replies, notes, tags and statuses the account holder adds in the dashboard.

Submissions are kept until the account holder deletes them or closes the account. Deleting a submission or form removes its data and files immediately; backups are overwritten within 30 days.

How data is used

To deliver the Service: store submissions, send notification and reply emails, filter spam, run the integrations you enable, bill Pro plans, and respond to support requests. We do not sell personal data, use it for advertising, or train models on it.

Service providers

We share data only with providers needed to run the Service, each bound by their own terms and data processing agreements:

• Resend (email delivery) receives the content of notification, reply and autoresponder emails.
• Dodo Payments (merchant of record) processes payments and holds the billing details of Pro customers.
• Hosting providers that run our servers and store the database and uploaded files.
• Google and Notion, only when an account holder connects a sheet or database; submissions are then sent to that account holder's own Google Sheet or Notion workspace.
• hCaptcha, Google reCAPTCHA or Cloudflare Turnstile, only when an account holder enables a captcha on a form; the provider receives the token and the visitor's IP to verify it.

Some of these providers are outside India, including in the United States and the European Union. Transfers rely on the providers' standard contractual safeguards.

Security

Connections use HTTPS. Passwords are hashed with bcrypt. Integration secrets are encrypted at rest. Access to production systems is limited to the operator. No system is perfectly secure; if we learn of a breach affecting your data we will notify you without undue delay.

Your rights

You can export (CSV or JSON) and delete your submissions and forms from the dashboard at any time. To access, correct or erase other personal data, or to close your account, email hello@formpit.com; we respond within 30 days. Residents of the EU/UK, California and other jurisdictions with data protection laws have the rights those laws provide, including the right to complain to a supervisory authority. Under India's Digital Personal Data Protection Act you may also nominate someone to exercise these rights on your behalf.

Children

Formpit is not directed at children under 18, and account holders may not use it to knowingly collect data from children under 13 without parental consent.

Changes

We will post changes here and, for material changes, notify account holders by email.