Privacy Policy

1. Data controller and data processor

Formisse acts in two different roles. For data about your account and your use of the Service (account details, billing, usage logs), Formisse is the data controller.

For the responses submitted to your forms (submissions), Formisse is only a data processor; the data controller for that data is you, our customer, who created the form. You decide what data to collect and why, and we process it solely on your behalf to provide the Service.

2. Data we collect

To provide the Service, we process the following types of data:

• Account data: your name, email, workspace name and account preferences.
• Billing data: plan information and payment records processed through our payment provider (your card details are not stored by us).
• Form submissions: the content visitors enter into your forms, and any uploaded files.
• Technical data: IP address, browser and device information, submission metadata and usage logs.

3. How and why we process data

We process personal data only for legitimate purposes and on an appropriate legal basis (performance of a contract, legitimate interest, legal obligation or explicit consent):

• To provide the Service and run your account and forms,
• To analyse submissions according to the features you have enabled,
• To keep the Service secure and prevent fraud and spam,
• To meet our legal obligations and communicate with you.

4. Form submissions and your responsibility

The data you collect through your forms belongs to you, and you are the data controller for it. You are responsible for which fields you ask for, which consents you obtain, and the lawfulness of the data you collect.

You should not request sensitive or special-category data (such as identity numbers, health data or passwords) through your forms unless you have the necessary legal basis and consents in place. Informing your visitors about your own privacy practices is also your responsibility.

5. Processing with artificial intelligence

When you enable AI analysis on a form, the content of submissions to that form is processed with AI to produce outputs such as a summary, category, urgency and spam score.

For this processing, submission content may be sent over secure connections to the AI providers we work with, and used solely for this analysis. The providers do not use the data to train their own models.

You can turn AI analysis off on any form.

6. IP address and technical data

For each submission, the sender's IP address and some technical metadata are recorded at the system level to prevent spam and abuse, keep the Service secure and apply rate limiting.

This technical data is not shown to the administrator who created the form. People using Formisse see only the fields visitors filled in on the form; they cannot access IP or header information.

7. Data hosting and transfers

Your data is hosted on OVHCloud infrastructure with servers located in Germany (within the European Union). Files uploaded through forms are stored on Cloudflare.

Some of our service providers (for example AI providers) may process data outside the European Economic Area. In such cases, we ensure the transfer is protected by appropriate safeguards such as Standard Contractual Clauses.

8. Service providers (sub-processors)

We do not sell your data. To deliver the Service, we work only with the trusted providers we need, under contractual safeguards:

• Hosting: OVHCloud (Germany, EU).
• File storage: Cloudflare.
• AI analysis: enterprise AI providers.
• Providers for email delivery and payment processing.

We may also share data with competent authorities where a legal obligation requires it.

9. Cookies

We use cookies to keep your session active and remember your preferences. See our Cookie Policy for details.

10. Data retention

We keep your data for as long as your account is active and as needed to provide the Service. You can delete your submissions from the panel at any time.

When you close your account, your data is deleted or anonymised within a reasonable period, subject to any legal retention obligations.

11. Security

We apply reasonable technical and organisational measures to protect your data, including encryption in transit and at rest, access controls and regular monitoring.

No system is completely secure, so we cannot guarantee absolute security, but we work continuously to minimise the risks.

12. Your rights

Under the GDPR and applicable data protection laws you have the following rights regarding your personal data:

• To access your data and request a copy,
• To have inaccurate data corrected,
• To request erasure of your data,
• To restrict and object to processing,
• To receive your data in a portable format,
• To lodge a complaint with the relevant supervisory authority.

If you submitted a form and wish to exercise these rights, you may need to contact the controller who created the form first; if you reach out to us, we will help direct you to that controller.

13. Changes to this policy

We may update this policy from time to time. For significant changes we will notify you and update the "last updated" date above; the current version is always published on this page.

14. Contact

For any privacy and data protection questions or requests, you can reach us at [email protected].