Privacy Policy

Onlyform is a form building platform operated by Onlyform, Inc. When you create a form with us, we are the data controller for your account data and the data processor for the responses your forms collect.

If you are filling in a form built by somebody else on Onlyform, the organisation that built that form is the controller of your answers. This policy explains what we do with data in both roles.

This policy applies to onlyform.com, the Onlyform web application, our public API and any form hosted on an onlyform.com link or embedded from one. It does not cover third-party sites we link to, or what an organisation does with responses after they have collected them.

Account information

Your name, email address, password hash, workspace name and any profile details you choose to add. If you sign in with Google or SSO, we receive your name, email address and account identifier from that provider.

Form and response data

The forms you build and the answers people submit to them, including any files uploaded. We store this so we can show it back to you; we do not read it, sell it or use it to train models.

Usage and device data

IP address, browser and device type, pages viewed, features used and timestamps. We use this to keep the service running, prevent abuse and understand which features are worth improving.

Payment information

Handled by our payment processor. We receive the last four digits, card brand, expiry and billing country. We never see or store full card numbers.

• To provide the service: building forms, collecting responses and showing you results.
• To bill you and to send service notices about your account, billing and security.
• To provide support when you ask for it.
• To detect, investigate and prevent fraud, spam and abuse.
• To improve the product in aggregate, using usage patterns rather than the content of responses.
• To send product updates and marketing, where you have opted in. You can unsubscribe at any time.

Where UK or EU data protection law applies, we rely on the following bases: performance of a contract to provide the service you have signed up for; legitimate interests to secure the platform, prevent abuse and improve the product; consent for optional cookies and marketing email; and legal obligation where we are required to retain or disclose data.

We do not sell personal data. We share it only with service providers who help us run Onlyform, and only for that purpose. Our current sub-processors cover cloud hosting, payment processing, email delivery, error monitoring and customer support.

We also share data where you ask us to, for example when you connect an integration such as Google Sheets, Slack or a webhook of your own. We may disclose data where legally required, and will tell you unless we are prohibited from doing so.

A current, versioned list of sub-processors is published on our security page. You can subscribe to be notified before any change takes effect.

When somebody answers a form you built, you decide what is asked, how long it is kept and who can see it. We process those answers on your instructions under our data processing agreement.

If you are a respondent and want your answer corrected or deleted, contact the organisation that created the form. If you cannot reach them, we will help you identify who they are.

You can choose whether your workspace data is stored in the EU or the United States. Where data is transferred outside its region, we rely on Standard Contractual Clauses or an equivalent approved transfer mechanism, together with encryption in transit and at rest.

Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, restrict or object to processing, withdraw consent, and receive your data in a portable format.

You can export your workspace and delete your account from your settings at any time. For anything else, email privacy@onlyform.com. You also have the right to complain to your local supervisory authority.

We use a small number of essential cookies to keep you signed in and to keep the service secure, and optional cookies for analytics and marketing that only run if you accept them. Our cookie policy explains each one and how to change your choice.

Data is encrypted in transit with TLS 1.3 and at rest with AES-256. Access is role-based and least-privilege, uploaded files are served from signed expiring URLs, and we run regular third-party penetration testing. Our security page sets out the detail.

Onlyform is not intended for children under 16 and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, contact us and we will delete it.

If we make a material change we will email account owners and post a notice in the product at least 30 days before it takes effect. Every previous version stays available from this page.

Email privacy@onlyform.com for any privacy question, or dpo@onlyform.com to reach our data protection officer. Postal details are on our contact page.