1. Who we are
Formglide is a trading name of DIGITALIZER LTD, a company registered in England and Wales under company number 15267581. Our registered office is 2nd Floor, Unicorn House, Station Close, Potters Bar, Hertfordshire, EN6 1TL, United Kingdom. We are registered with the UK Information Commissioner's Office (ICO) under reference ZC253283.
For privacy questions, requests about your personal data and complaints, email hello@formglide.io or write to our registered office marked "Privacy". To report a form that you think is abusive, use the report page or email security@formglide.io.
2. Our role, and which policy applies to you
Formglide is an online form builder. Our customers build forms with it and publish them to collect responses. Our legal role depends on who you are:
| You are | Our role |
|---|---|
| An account holder, or someone invited to join a workspace | Controller |
| A visitor to formglide.io | Controller |
| Someone who reports a form to us | Controller |
| A respondent who fills in a form built with Formglide, or a ticket holder | Processor for the organisation that owns the form, which is the controller |
When we process respondent data for a customer, we do so only on that customer's instructions, under our Data Processing Agreement. We are controller for a small part of that processing which we carry out for our own purposes: bot checks, rate limits, our automated phishing check, and handling reports of abuse.
If you filled in a form, the organisation that owns the form decides what it asks and how your answers are used, so please read its privacy notice and contact it first about your answers. This applies even where the form or its emails carry that organisation's branding rather than ours. If you cannot identify the organisation, email us with the form's link and we will pass your request on and help the organisation deal with it.
3. Information about account holders
When you create an account, are invited to a workspace or use the app, we process:
- Identity and sign-in: your name, email address, whether your email is verified, and your password if you have one, which we store only as a hash, never in plain text. Accounts are created with an email address and password, or with Sign in with Google (below). For a sign-up with a password, we refuse known temporary email services and send a link to verify your email address. Until it is verified you cannot publish forms, invite teammates or send notification and ticket emails.
- Sign in with Google: if you choose Continue with Google, Google shares with us your Google account ID, your name, your email address, whether Google has verified that address, and a link to your profile picture. We use them to create your account and sign you in, and your name and email address then become your account details. A new account takes its name, email address and picture from Google and starts verified. We refuse a Google account whose email address Google has not verified. If your email address already has a Formglide account, Continue with Google signs you in to it only once that account's email address is verified, and the account keeps its own name. We store your Google account ID; the access token Google gives us, and a refresh token if Google sends one, encrypted; and the ID token Google signs for the sign-in, unencrypted, which holds the same details and stops being valid after an hour. A later Google sign-in replaces them. An account created with Google has no password until you set one with Forgot password, and you accept our Terms and Privacy Policy on your first visit to the app.
- Terms acceptance: the version of our Terms and Privacy Policy you accepted, and when.
- Sessions: a session token, the IP address and browser user agent the session was created from, the approximate location (town and country) that our hosting provider works out from that IP address when you sign in, and when the session was created, last renewed and expires. We keep the location with the session and delete it with the session; we use no separate location service. Settings lists each signed-in device with its browser, approximate location and times, so you can sign out any you do not recognise. If a member of our staff views your account to help you (see below), the session also records who they are.
- Workspaces and teams: workspace names, who belongs to each workspace and their role (owner or member), agency client workspaces, and any white-label brand name and logo.
- What you build: your forms, their published versions, A/B tests and settings. If you import from Typeform, we use the Typeform token you paste only to run that import.
- Integration settings: credentials you enter to connect integrations, such as a Meta access token, a Google Analytics API secret, a Slack webhook address, a Google service account key, or a webhook address and signing secret.
- Google Sheets with Connect with Google: if you connect a form to Google Sheets this way, you sign in to Google and give Formglide your Google account's email address (Google also sends the ID of your Google account, which we do not keep) and access to the Google Drive files Formglide creates, and nothing more: Formglide can see only the spreadsheets it creates for you, never the rest of your Drive. Formglide then creates a spreadsheet named after the form in your Drive (a Reconnect with the same Google account keeps using it while Formglide can still reach it and its sheet) and adds a row to it for each completed response. For that form we store the token Google gives us for the connection (a refresh token, always encrypted), the spreadsheet's ID, the name of its first sheet, and the email address of the Google account you connected, which the form's Integrations page shows to your workspace. The access tokens we get with it are kept only in our servers' memory, never stored, and expire within an hour. Disconnect deletes the token and the connection and asks Google to withdraw Formglide's access, unless the same Google account is still connected to another form; the spreadsheet stays in your Drive.
- Billing: your Stripe customer and subscription identifiers, plan, status, renewal date and whether we have sent your renewal reminder, and, if you use the refund button, the amount refunded, the Stripe identifiers and who requested it. Stripe collects card details on its own pages; we never see or store your card number.
- In-form payments: if you connect Stripe to take payments in your forms, we send Stripe your workspace name and your email address to create the workspace's Stripe account, and we store that account's identifier, its status (whether it can take payments, whether onboarding is finished, and its display name), when the workspace first connected, and who agreed to the payments terms, when, and which version. Stripe collects your business, identity and bank details on its own pages; we do not receive them.
- Sign-up attribution: the campaign details described in section 5, if your sign-up link carried any.
- Check-in activity: which team member checked in which ticket, and when.
- Support and administration: emails you send us and our replies. Authorised Formglide staff can access accounts for support, security and administration; each time they view an account as its user, change a plan or delete an account, we log who did it and when.
Information we receive from Google. We use what Google shares with us through Sign in with Google and Connect with Google only to create your account, sign you in and run the Google Sheets connections you set up; the name and email address from Sign in with Google then become your account details, used as this policy describes for any account. We do not use it for advertising and we do not sell it. Apart from your name and email address, which become your account details, people at Formglide do not read it, except to help you when you ask us to, for security, or where the law requires it. Formglide's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.
Invitations. When a workspace owner invites someone, we store the invitee's email address, the role offered, who sent the invitation, a one-way hash of the invitation link (never the link itself), and when it expires, was accepted or was revoked. Invitation links expire after 7 days. We send the invitee one email naming the person who invited them and the workspace. If you received an invitation you did not expect, you can ignore it, or email us and we will remove your details.
Emails we send you. We send service emails only: email verification, welcome, password reset, team invitations, renewal reminders, failed payment, upgrade confirmation, refund confirmation, account deletion confirmation, an alert when a form's Google Sheet cannot be written to, and notices about action we take on your forms or workspace. We do not send a marketing newsletter. If we start one, we will tell you first and give you a simple way to opt out.
4. Information collected through customers' forms
For this information we act as a processor for the customer who owns the form (section 2). Depending on how the customer sets up the form, we process:
- Answers. The customer decides what to ask. Answers can include names, contact details, dates, free text and uploaded files. Our Terms do not allow customers to collect health or other special category data without our prior written agreement.
- Partial answers. If the customer turns on partial capture, answers are saved as the respondent moves through the form, before they press submit.
- Submission details sent by the browser and stored with the response: the page address, the referring page, campaign (UTM) parameters, hidden-field values set by the customer, a device label (mobile or desktop), the full browser user agent, which version of the form was shown in an A/B test, the respondent's tracking choice where the form asks for one, and, where the customer's Meta Pixel or Google Analytics is running on the form, the identifiers those tools set in the browser.
- IP address. We use the respondent's IP address when a response is submitted, to apply rate limits and run the bot check. We store a keyed one-way hash of it with the response, for investigating abuse, which we never share with the form owner or the services they connect. The hash still counts as personal data.
- A respondent key and form events. A random key kept in the respondent's browser lets a respondent resume a form and stops repeat visits being counted twice. Views, steps reached, steps completed and submissions are recorded against that key for the customer's drop-off analytics.
- Answers kept in the respondent's browser. From the moment a respondent presses submit until our server confirms the response, the form keeps a copy of their answers in their own browser, so that someone who leaves the page while it is being sent can send it on their next visit. While a respondent is on the payment page of a form that takes payments, the form keeps their answers in that browser tab, so a cancelled payment brings them back to the payment step with their answers. Section 11 says how long each copy lasts.
- Uploaded files. Files go directly from the respondent's browser to our file storage provider (Cloudflare R2). Only signed-in members of the customer's workspace can request a download link. Each link works for 5 minutes and anyone holding it can use it during that time.
- Event tickets. If the customer issues tickets, we store the holder's name and email, the ticket tier, a random ticket code, its status, and the check-in time and team member. We email the ticket on the organiser's behalf. The ticket page can be opened by anyone with its link or QR code, and shows the holder's name (or email if no name was given), tier, code and status. It is excluded from search engines. If a form is taken down or a workspace suspended, its ticket pages show as disabled.
Tracking set up by the form owner. A customer on a paid plan can connect Meta Pixel, the Meta Conversions API or Google Analytics 4 to a form. When they do, the hosted form shows a banner asking the respondent to accept or reject that tracking. Until the respondent accepts, the form loads none of these tools and we send no tracking events to Meta or Google for that respondent; rejecting does not stop anyone filling in the form. The choice is remembered in the respondent's browser for that form, and a "Privacy choices" link at the foot of the form lets them change it. The customer can turn the banner off, in which case these tools run without asking and the customer is responsible for obtaining any consent the law requires. When the tools run, Meta receives page, content and lead events from the browser, and our server sends a lead event containing the respondent's email address and phone number in hashed form, the page address, browser user agent and Meta's browser identifiers. If the customer turns on per-question events (off by default), each completed question is also sent as an event, and the server event includes the respondent's IP address. Google Analytics receives page and lead events with its browser identifier. Hashing contact details does not make them anonymous.
Other integrations the customer chooses. A customer can also send responses to Google Sheets, Slack, email notifications to members of its workspace, or a webhook address of its choosing, and can import forms from Typeform. None of these run unless the customer sets them up on that form. Google Sheets adds each completed response as a row to a spreadsheet in the customer's own Google account: one Formglide creates when the customer uses Connect with Google (section 3), or one the customer shares with a Google service account of its own. What those services do with the data is governed by the customer's own arrangements with them.
Payments. If the customer takes payments in a form, the respondent pays on Stripe's checkout page and enters their card details there; we never see or store them. Stripe processes the payment for the customer, under the customer's own agreement with Stripe. We pass Stripe the amount, a description of what is being bought, and the first email address the respondent gave in the form, so Stripe can fill in the checkout page and send a receipt. With the response we store the amount and currency, the payment status (pending, processing, paid, failed, refunded or abandoned, and any amount refunded), when the checkout started and when it was paid, and Stripe's identifiers for the checkout session, the payment and the customer's Stripe account. To protect against card testing, we count checkout attempts per form, per workspace and per IP address (for the address, a keyed one-way hash only).
We never sell respondent data, and we never use it for our own marketing, advertising or profiling.
5. Website visitors and sign-up attribution
Website analytics. On our marketing pages (the home page, pricing, the comparison pages, templates, the blog and these legal pages) we use Google Analytics to count visits and see which pages people read. It runs only if you press Accept on the cookie banner shown on those pages. Until you accept, nothing from Google loads and Google receives nothing about your visit. If you accept, Google Analytics sets its cookies on formglide.io (section 11) and receives the pages you view, the site that sent you to us and technical details of your browser and device. We use it only to understand our own marketing. We have left its advertising features switched off and we do not use it for advertising. Your choice is kept in your browser's storage; "Cookie choices" in the footer of every marketing page lets you change it, and declining after you had accepted stops Google Analytics on this site and deletes its cookies from your browser. We run no analytics or advertising scripts of our own in the app, on the sign-in and sign-up pages, or on customers' forms, where any tracking is the form owner's (section 4). Our fonts are served from our own site. Our hosting provider processes your IP address and request details to deliver pages to you and to protect the service.
Sign-up attribution. We want to know which of our campaigns bring us customers. If the link you use to sign up carries campaign details, namely UTM parameters, ad click identifiers (gclid, gbraid, wbraid, fbclid) or a ref code, together with the page you landed on and the website that sent you to us (its address only, without any search terms or query string), we store them on your account when you create it. We read them only from links on our own site: we set no cookie and use no browser storage for this. We use these details only to measure our own marketing; we do not send them to Google, Meta or any other advertising platform.
6. Security, abuse reports and moderation
To protect the service, the people who use it and the people who fill in forms, we process the following as controller:
- Bot checks. Cloudflare Turnstile runs on hosted forms, on our sign-up, sign-in and password reset pages, and on the report page. It receives your IP address and signals from your browser to tell people from bots. The check runs in Cloudflare's invisible mode, and Cloudflare's Turnstile Privacy Addendum applies to it.
- Rate limits. To slow down password guessing and automated sign-ups, we count requests to sign-up, sign-in, password reset and verification email by IP address. We store the IP address, the page requested and a counter, and keep these records for no longer than 24 hours. To stop file uploads and payment checkouts on forms being abused, we also count those requests per form, per workspace and per IP address. For the per-address count we store only a keyed one-way hash of the IP address, never the address itself, with a counter for a window of up to an hour. Since 14 October 2026 we also count, the same way, form answers and form analytics events per IP address and per form, ticket resends per ticket and per workspace, integration test sends per user, and wrong passwords per account: for that last count we store a keyed one-way hash of the email address, never the address, for fifteen minutes.
- Payment checks. For forms that take payments, we count checkout pages opened and completed per form, and hold a form for review when many checkouts are opened with very few completed (a sign of card testing). When Stripe tells us a payment made through a form was disputed, or that a customer's Stripe account is restricted, we pause that workspace's payment forms until a person reviews them.
- Abuse reports. Every hosted form has a "Report abuse" link to our report page. When you send a report, we store the form's link, the reason and details you give, your email address if you choose to give it, and a keyed one-way hash of your IP address, which we use to limit repeated reports. Reports are emailed to our team. We do not give the form owner your details unless the law requires it.
- Automated phishing check. When a form is published, we automatically check its text for signs of phishing, such as questions asking for passwords or payment card details, or a well-known brand next to account-related wording. A form the check flags may be held from public view until a person at Formglide reviews it.
- Moderation records. If we hold or take down a form or suspend a workspace, we record the decision, the reason and which administrator made it.
We do not make decisions about people that have legal or similarly significant effects based solely on automated processing. A form held by the phishing check or by the payment checks stays held until a person reviews it.
7. Why we use personal data, and our lawful bases
Where we are controller, we rely on the following lawful bases under the UK GDPR (and the EU GDPR where it applies):
| Purpose | Lawful basis |
|---|---|
| Providing your account and the service | Contract, where you contract with us yourself. Where you use an account on behalf of an organisation, our legitimate interests in providing the service that organisation has signed up for |
| Billing, refunds, renewal reminders and account records | Contract, or legitimate interests as above; legal obligation for the records tax and accounting law require |
| Team invitations | Legitimate interests in letting customers invite the colleagues they choose |
| Recording which version of our terms you accepted | Contract and legitimate interests in being able to show what was agreed |
| Bot checks, rate limits, abuse reports, the phishing check and moderation | Legitimate interests in protecting people, accounts and the service from fraud and abuse; legal obligation where a specific legal duty applies |
| Support, including viewing an account as its user | Legitimate interests in resolving problems you raise and running the service |
| Sign-up attribution | Legitimate interests in understanding which of our marketing works |
| Website analytics on our marketing pages | Consent, given on the cookie banner; you can withdraw it at any time with "Cookie choices" in the footer |
| Responding to legal claims, complaints and regulators | Legitimate interests in establishing or defending legal claims; legal obligation where it applies |
Where we rely on legitimate interests, we have weighed them against your rights, and you can ask us for details or object (section 12).
8. Who receives personal data
We use the following providers to run Formglide. They process personal data on our behalf, under contract, and only to provide their service to us.
| Provider | What they do for us | Where |
|---|---|---|
| Vercel | Hosts the website and app and runs our server code | Server code runs in Frankfurt, Germany. Static files and request routing use Vercel's global network |
| Neon | Our database, which holds account data, forms and responses | Amazon Web Services, Frankfurt, Germany |
| Cloudflare | Domain name service, the Turnstile bot check, and file storage (R2) for uploaded files and white-label logos | Cloudflare's global network. File storage has a Western Europe location preference, which is not a guarantee that files stay in Europe |
| Resend | Sends our emails, including response notifications and event tickets | Provider based in the United States |
| Sentry (Functional Software, Inc.) | Error monitoring for our servers. It receives an error report when something fails on the server, such as a failed email or a failed scheduled job: the error message and stack trace, the request path and method, and the time. It does not receive form answers or uploaded files | European Union (Frankfurt, Germany), on Sentry's EU data residency |
| Stripe | Our subscription billing, customer portal and refunds; for customers who take payments in forms, creating their Stripe accounts and checkout pages | Stripe's global infrastructure |
| Google Workspace | Our email, including messages you send to hello@ or security@ and the alerts we receive about abuse reports | Google's global infrastructure |
| Google Analytics | Visit statistics for our marketing pages, only after you accept the cookie banner (section 5) | Google's global infrastructure |
Stripe also acts as an independent controller for some of its own payment, fraud prevention and legal purposes; its own privacy notice explains this. For payments in customers' forms, the customer's own Stripe account processes the payment under the customer's agreement with Stripe.
Other people who can see personal data:
- Workspace members can see their workspace's forms, responses, uploaded files, tickets and integration settings. Members of an agency's main workspace can also see every client workspace under it, with the same role.
- Services the customer chooses, as described in sections 3 and 4.
- Advisers, authorities and others where the law requires it, to protect people or the service from fraud or serious harm, or as part of a sale or reorganisation of our business, in each case with appropriate confidentiality and only as far as necessary.
9. International transfers
Our app servers and our database are in Frankfurt, Germany. Vercel, Neon, Cloudflare, Resend, Sentry, Stripe and Google are based outside the UK, and some of their processing, such as request routing, security services, email delivery and support, can take place in other countries, including the United States. Where personal data is transferred outside the UK, the transfer is covered by those providers' standard data protection terms. You can ask us for more information at hello@formglide.io.
10. How long we keep personal data
There is no automatic expiry today for most data. In particular:
- Your account is kept until you delete it. Session records expire 7 days after they were last renewed.
- Forms, responses, uploaded files and tickets are kept until the customer deletes them, or deletes the workspace or account they belong to. Inactive accounts are not deleted automatically. Responses on the Free plan above the monthly allowance are kept like any other response.
- Uploaded files are stored separately from our database and are removed when the response, form, workspace or account they belong to is deleted. When you delete a form, its responses and their uploaded files are deleted from our database and from our file storage immediately, as part of the delete itself. A file uploaded to a form that never becomes part of a completed response is deleted after 24 hours, or after 7 days while that response is waiting for payment. To apply storage limits we keep a record of each uploaded file: its storage name (which includes the file's name), its size, the form and response it belongs to, and when it was uploaded. That record is deleted 30 days after the file is deleted.
- Invitations are kept until the workspace is deleted, although their links stop working after 7 days.
- Terms acceptance records, sign-up attribution and refund records are kept with the account or workspace they relate to and deleted with it. Stripe keeps its own billing records.
- Google sign-in details (your Google account ID and the tokens from Google) are kept with your account and deleted with it.
- Google Sheets connections (the token, spreadsheet ID, sheet name and Google email address) are kept until the connection is disconnected or replaced, or its form or workspace is deleted. Leaving a workspace does not end a connection you made on its forms, nor does deleting your Formglide account while the workspace stays: new responses keep arriving in your spreadsheet until someone in the workspace presses Disconnect or you remove Formglide's access in your Google account. Deleting a form, workspace or account does not withdraw the access given to Formglide in a Google account: Disconnect does that (section 3), and you can withdraw it yourself at any time in your Google account's security settings.
- Administrator action logs (what Formglide staff did, such as changing a plan, taking down a form or viewing an account to help its user, with the email address of the staff member and of the account concerned) are kept for two years from the action and then deleted. They are not deleted with the account they relate to, nor with the staff member's own account.
- Rate-limit records are kept for no longer than 24 hours. File upload and checkout counters are deleted by a daily clean-up once their counting window has ended (checkout counters for forms are kept for up to 2 hours first, so the card-testing check can read them).
- Payment attempts that are still unpaid 24 hours after their latest checkout are marked abandoned and then kept like other responses, until the customer deletes them. Payment records Stripe holds are kept by Stripe under its own rules.
- Abuse reports and moderation records are not deleted automatically. We keep them for as long as we need them to deal with the report and to prevent repeat abuse.
- Emails you send us stay in our mailbox until we delete them.
- Backups: deleted data can remain in our database provider's backups for a short period until those backups expire.
Deleting your account. You can delete your account yourself in Settings. We cancel any active subscription, delete every workspace you are the only owner of (with its client workspaces, forms, responses, tickets and files), remove you from workspaces others own, delete your account and sessions, and email you a confirmation. Deletion is refused while a workspace you solely own still has other members, so their work is not deleted without warning. Deletion is permanent, so export anything you need first. Administrator action logs about your account (what Formglide staff did with it) are not deleted with it: we keep them for two years from each action and then delete them.
Some copies are outside our control and are not removed when you delete your account: emails already delivered, data already sent to integrations, and records Stripe keeps under its own rules.
11. Cookies and similar technologies
We use only the cookies and browser storage listed here. None of them is used for advertising.
Cookies set by formglide.io
| Name | Purpose | How long |
|---|---|---|
Session cookie (__Secure-better-auth.session_token) |
Keeps you signed in to the app | 7 days, renewed while you use the app |
Administrator session cookie (__Secure-better-auth.admin_session) |
Used only by Formglide staff, to keep their own session while they view an account to help its user | While the staff member is viewing the account |
Google sign-in check (__Secure-better-auth.state) |
Set when you press Continue with Google, to check that Google's answer belongs to the sign-in your browser started. It holds a random value, signed by us | Up to 5 minutes; deleted once Google sends you back and the check passes |
fg_google_connect |
Set when you press Connect with Google on a form's Google Sheets card, to tie Google's answer to your browser, your account and that form. It holds two random values, your user ID, the form's ID and an expiry time, signed by us, and is sent only to our Google connection addresses | Up to 10 minutes; deleted when Google sends you back |
fg_ws |
Remembers which workspace you were looking at | 1 year |
fg_ab |
Shows a respondent the same version of a form during an A/B test. Set only on forms running an A/B test | Up to 30 days |
_ga, and _ga_ followed by our Google Analytics property ID |
Set by Google Analytics on our marketing pages, only after you accept the cookie banner, to tell visits apart (section 5). Deleted if you later decline | 2 years |
Browser storage used by formglide.io
| Name | Purpose | How long |
|---|---|---|
fg_rk_ followed by the form's ID (local storage) |
The respondent key described in section 4: resumes progress and stops repeat visits being counted twice | Until cleared; replaced after each completed response |
fg_consent_ followed by the form's ID (local storage) |
Remembers a respondent's choice on a form's tracking banner | Until cleared or changed |
fg_at_ followed by the form's ID (session storage) |
On a form: a random ID for one go at filling it in, so a response that is retried or sent twice is stored only once, and a second tab counts as a separate response. It holds no answers. Pages from before 14 October 2026 kept it in local storage; that older copy is removed the next time the form is opened | Until you close the tab; replaced when the form is opened again after a response was confirmed, and when you choose to start a new answer |
fg_done_ followed by the form's ID (session storage) |
On a form, once a response is confirmed: the ID of that go at filling it in, and of the next one begun by going back to the form with your browser's Back and Forward buttons, so that sending the same answers again is not stored as a second response. It holds no answers | Until you close the tab, the form is opened again other than with Back and Forward, or you choose to start a new answer |
fg_unsent_ followed by the form's ID and a random ID (local storage) |
On a form: a copy of the respondent's answers, kept from the moment they press submit until our server confirms the response (section 4) | Deleted once the response is confirmed or refused. If it never is, the form offers it again when next opened (Retry or Start again) and deletes it once it is sent or cleared, when it is more than 24 hours old, or when the form has changed since. Until cleared if the form is never opened again |
formglideHiddenFields (the page's entry in the tab's history) |
On a form whose link carries hidden-field values (for example a campaign or customer reference): those values, taken out of the address bar once the form has read them so the form owner's tracking tools never see them in the page address, and kept so a reload of the page still has them | Until the tab's history entry is gone |
fg_checkout_ followed by the form's ID (session storage) |
On a form that takes payments: the respondent's answers while they are on the payment page, so a cancelled payment brings them back to the payment step with their answers (section 4) | Until the payment is confirmed or you close the tab; never used after 24 hours |
fg_rk_preview_ (local storage) and fg_at_preview_ (session storage), each followed by the form's or template's ID |
The same two IDs as fg_rk_ and fg_at_, used when a form owner previews their own form or a visitor tries a template demo on our site, and kept apart so a test never mixes with real responses |
As for fg_rk_ and fg_at_ |
fg_draft_backup_ followed by the form's ID (session storage) |
In the form builder: a copy of edits to a form (its name and content) that our server has not yet confirmed saving, so a reload does not lose them | Until the edits are saved or you close the tab; discarded after 7 days |
better-auth.message (local storage) |
In the app: set by our sign-in system when you sign out or change your account name, so your other open tabs of the app notice. It holds only what happened and when, nothing about you | Until cleared; replaced the next time |
fg_site_consent (local storage) |
Remembers your Accept or Decline on the cookie banner on our marketing pages | Until cleared or changed |
fg_chunk_reload_at (session storage) |
Stops the page reloading in a loop after we release a new version | Until you close the tab |
Third-party services
| Service | When | Notes |
|---|---|---|
| Cloudflare Turnstile | Hosted forms, sign-up, sign-in, password reset and the report page | Loads a script from Cloudflare to tell people from bots; Cloudflare's privacy policy applies |
| Google Analytics (ours) | Our marketing pages, only after you accept the cookie banner | Loads a script from Google and sets the _ga cookies above; Google's privacy policy applies. Change your mind with "Cookie choices" in the footer |
| Meta Pixel and Google Analytics (the form owner's) | Only on forms where the owner has set them up, and only after the respondent accepts the banner, unless the owner has turned the banner off | Set their own cookies, such as _fbp and _fbc. Google Analytics sets two cookies named after the owner's Google Analytics measurement ID: fg_ga_ followed by that ID without its G-, then __ga; and the same name followed by _ and the ID again (fg_ga_<ID>__ga_<ID>). The owner's own forms share them; other owners' forms and our own pages never use them. The form owner is responsible for this tracking |
| Pictures on questions (the form owner's) | Only on forms where the owner has linked a picture on a question | The respondent's browser loads the picture from the website the owner chose, so that website receives the respondent's IP address and browser details, and may set its own cookies. When the picture is on another website, Formglide does not store it or pass it through our servers. The form owner chooses that website and is responsible for it |
| On Google's own sign-in and consent pages, after you press Continue with Google or Connect with Google | Google's privacy policy applies | |
| Stripe | On Stripe's own checkout and billing pages | Stripe's cookie policy applies |
12. Your rights
Depending on the law that applies to you, you have the right to ask for access to your personal data, to have it corrected or deleted, to restrict how we use it, to receive it in a portable format, to object to processing based on legitimate interests, and to withdraw consent where we rely on it.
Account holders can do much of this themselves: change their details, other than their sign-in email, in Settings, export responses as CSV on every plan, and delete their account. To change your sign-in email, or for anything else, email hello@formglide.io. We may ask you to confirm your identity. We normally reply within one month, and we do not charge for an ordinary request. If you filled in a customer's form, see section 2.
13. Children
Formglide is a business tool and is not directed at children. Account holders must be at least 18. Customers must not use Formglide to collect children's personal data without the protections the law requires.
14. Complaints
If you are unhappy with how we have handled your personal data, email hello@formglide.io or write to our registered office. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you informed and tell you the outcome.
You can also complain to the Information Commissioner's Office at ico.org.uk, or to the data protection authority where you live. You do not have to complain to us first.
15. Changes to this policy
We will update this policy when the way we handle personal data changes, and change the date at the top. For material changes, we will tell account holders by email or in the app before they take effect.