Privacy policy
FormRill receives form submissions for website owners. This page explains what we collect, where it lives, who helps us process it, and how you remove it. Questions go to hello@formrill.com.
The short version
- We store what your visitors submit so we can deliver it to you. We don’t sell it, share it for advertising, or use it to train AI models.
- Data is stored in Cloudflare D1 on Cloudflare’s network. Notification emails go through our email-sending service on AWS (Mumbai region).
- This website sets no cookies and loads no analytics or advertising scripts.
- For submissions, you are the controller and FormRill is your processor.
What we collect
| Data | What it includes | Why |
|---|---|---|
| Account | Your email address, a SHA-256 hash of your access token, and when you signed up. | To run your account and email you about it. |
| Form settings | Form names, website labels, allowed domains, redirect URLs, and the automation settings you enter, including destination URLs and credentials such as a Telegram bot token. | To deliver submissions where you asked. |
| Submissions | Whatever fields the form sends, the address of the page it came from (its Origin or Referer header), the time, and the status and assignee you set. | To store, show and deliver them to you. |
| Delivery log | For each delivery attempt: when, whether it worked, the response status and any error text. | So you can see and retry failures. |
| Funnel events | If you add our script: “view” and “start” events with a random per-page-load ID. No cookies, no IP address stored. | To show your form’s conversion funnel. |
We don’t store visitors’ IP addresses with submissions. Cloudflare processes request data such as IP addresses to run and protect its network.
Where it is stored
FormRill runs on Cloudflare Workers, and all of the data above is stored in Cloudflare D1, Cloudflare’s database service. Data is encrypted in transit with HTTPS.
Subprocessors
| Provider | Purpose | Data involved |
|---|---|---|
| Cloudflare | Hosting, database (D1), network and DDoS protection | All data described above |
| Amazon Web Services (email sending) | Sending notification and account emails | Email content: the submission text, form name, recipient and reply-to address |
| Payment merchant of record | Billing, tax and invoices, when paid plans launch | Billing details only; never submission content |
When you connect an automation such as Google Sheets, Telegram, WhatsApp, a webhook or a CRM, we send submissions to that service because you told us to. Those services act for you under their own terms; they are your choice, not our subprocessors.
How long we keep it
History limits aren’t enforced yet during the beta: submissions stay until you delete them. After launch, Free keeps 30 days. The windows after launch, by plan:
- Free: 30 days
- Pro: 1 year
You can delete submissions, a form or your whole account at any time. Account and form settings are kept while your account exists.
Deleting data
- A form: deleting a form in the dashboard permanently deletes it with all of its submissions, automations, delivery log and funnel events. This can’t be undone.
- Single submissions: delete any submission from the form’s Submissions tab in the dashboard. It is removed permanently along with its delivery log.
- Your account: in the dashboard, open Account and choose Delete account. It permanently deletes the account and every form, submission, automation and log in it, immediately.
- Export: export your submissions as CSV or JSON from the dashboard.
AI
Submission data is never used to train AI models, ours or anyone else’s. If we add AI features such as spam scoring, we will document here which provider processes what, and use endpoints that don’t retain data where available.
Your visitors’ rights
Under GDPR and similar laws, you (the website owner) are the controller of the submissions your forms collect, and FormRill is your processor. Visitors should contact you to access or delete their data; we’ll help you fulfil those requests. If a visitor contacts us directly, we will forward the request to you.
A data processing agreement (DPA) is available on request at hello@formrill.com.
Cookies and storage
This marketing site uses no cookies. The dashboard keeps your access token in your browser’s local storage so you stay logged in. The optional form script stores nothing in the visitor’s browser.
Changes
If we change how we handle data, we’ll update this page and the date at the top. Material changes are emailed to account holders before they take effect.
Start free when you’re ready
Free up to 500 submissions a month and unlimited forms. No server, no credit card.
Start freeRelated
- Security
How submissions are protected.
- Terms of service
The rules for using FormRill.