Privacy Policy

1. Introduction

Formstep is a form builder. People use it to create surveys, applications, registrations, checkouts, and other interactive documents, and to collect responses from their audiences. Personal data flows through the Service in two distinct ways: data that Formstep collects about its own users (the people who build forms), and data that respondents submit through forms built by those users.

This Privacy Policy describes both. We have tried to keep it short, plain, and honest. Where a section applies only to one group, we say so. Capitalized terms not defined here have the meanings set out in our Terms of Service. For data protection roles, references to “you” in this policy correspond to the “Customer” (and, under the GDPR, the “Controller”) in our Data Processing Agreement.

By using Formstep, you acknowledge that we process personal data as described in this policy. If you do not agree, do not use the Service.

2. Who We Are

The Service is operated by Formbase AS, a Norwegian limited company with organisation number 937 921 217 and registered office in Oslo, Norway (“Formstep”, “we”, “us”, “our”). For the personal data we collect about users of the Service — such as your account, billing, and product usage data — Formstep is the data controller.

For the personal data that respondents submit through your forms, you (the Formstep user who built the form) are the data controller, and Formstep acts as your data processor. The terms of that processing relationship are described in the Data Processing Agreement, which applies automatically to customers subject to the GDPR or equivalent regimes. This Privacy Policy still tells respondents what Formstep technically does with their data on your behalf, but it does not replace your own privacy notice.

For questions, complaints, or data subject requests, contact us at support@formstep.io.

3. Scope

This Privacy Policy covers personal data that Formstep collects, uses, or shares when:

• You visit formstep.io or any of its subdomains;
• You sign up for, sign in to, or use the Formstep application at app.formstep.io;
• You submit a response to a form that is hosted on Formstep or embedded on another website;
• You contact us for support, sales, partnerships, or anything else;
• You read or interact with our marketing emails, social channels, or events.

It does not cover third-party websites, services, or integrations that we link to or that you choose to connect, even if they are reached from inside Formstep. Those services have their own privacy policies, and you should review them.

4. Personal Data We Collect

We try to collect only what we need. The categories below describe the personal data we may handle in different parts of the Service.

Account data

When you create a Formstep account, we collect:

• Your email address, used to sign in and receive system messages.
• A display name and avatar if you set them, used to identify you to your collaborators.
• Authentication data linked to sign-in methods you choose, such as magic-link login, Google sign-in, or anonymous guest sign-in for short-lived guest sessions.
• Workspace settings you set up, including workspace name, timezone, and the list of members you have invited.

Your email address is a contractual requirement for using the Service — it is the only data required to register, and without it we cannot create your account. Display name, avatar, and workspace settings are optional.

Subscription and billing data

Formstep subscriptions and AI credit purchases are sold through Polar (polar.sh), our payment provider and Merchant of Record. Polar collects and stores your payment details directly. Formstep receives only the limited information needed to provision your plan and credits, including:

• A Polar customer identifier linking your Formstep account to your Polar customer record;
• A Polar subscription identifier and the chosen billing interval (monthly or annual);
• Subscription lifecycle timestamps such as the current period end, lapse, and grace-period markers used to apply your plan entitlements;
• Order and credit-top-up identifiers used to provision AI credits.

Formstep does not see or store payment card details, tax identifiers, or billing addresses — Polar holds those records directly, and you can access them through the Polar billing portal. Where you accept respondent payments through the Payment field, Stripe collects all card data directly; Formstep receives only non-sensitive references such as the last four digits.

Form content you create

The forms you build on Formstep — including questions, copy, media, conditional logic, and styling — are stored on our infrastructure so we can display them to respondents and let you edit them later. Form configuration is treated as Your Content under our Terms of Service.

Submission data from respondents

When someone submits a response to one of your forms, we store on your behalf:

• The answers and uploads the respondent provides, exactly as they entered them;
• A submission timestamp, the respondent’s browser language, the workspace timezone (captured at submit), and identifiers that link the submission to your form;
• Drafts and partial submissions saved server-side while the respondent fills the form, plus timestamps used to power abandoned-response reminders (when you enable them);
• Technical analytics signals captured for every published form, including approximate country (derived from the respondent’s timezone or the Cloudflare edge CF-IPCountry header), device type, browser, traffic source, and engagement duration;
• A respondent-side visitor identifier used to deduplicate form view and engagement counts — see Cookies and Similar Storage for details;
• Where you use the Payment field, a reference to the Stripe payment the respondent completed (the card data itself is handled by Stripe, not by Formstep);
• For a request you send to one named recipient, their name and email address and the prefilled values, hidden context, metadata and documents you send with it, plus the history of its invitation, reminder and callback deliveries.

Respondent IP addresses are processed transiently for rate limiting, Cloudflare Turnstile bot protection, and abuse prevention, and are not persisted alongside submissions.

You decide what fields to include and which of these technical signals to capture. You are the data controller for submissions — see Section 2 for data protection roles.

Form submissions may include special categories of personal data under Article 9 GDPR — such as health information, political opinions, or biometric data — depending on the questions you ask. As the controller, you are responsible for establishing a valid legal basis under Article 9(2) GDPR before collecting such data and for making any required disclosures to respondents.

Product usage and device data

When you use the Formstep application, we automatically collect:

• Activity logs such as which pages you load, what features you use, and when, used to operate the product, debug issues, and understand which features matter.
• Device and browser data such as user-agent, screen size, operating system, language, and approximate location derived from IP.
• IP address, used to deliver the Service, detect abuse, rate-limit, and meet security obligations.
• Diagnostic data such as error reports and performance traces when the application encounters a problem, used to diagnose and fix the issue.

Cookies and similar technologies

We use cookies and similar storage mechanisms to keep you signed in, remember your workspace and preferences, and secure the application. On our website and in the Formstep app, where the law asks us to ask first, analytics cookies are set and your visits recorded only if you accept in the cookie banner on our website; elsewhere they are set until you decline. The partner referral cookies on our website follow the same choice. See Cookies and Similar Storage for details and the choices you have.

AI feature data

When you use AI Features — such as AI-assisted form building or AI chat for analysing submissions — we process:

• The prompts you send to the AI;
• The context the feature passes alongside the prompt, such as the structure of the form you are editing or submission data you explicitly share;
• The outputs the AI returns;
• Credit consumption metadata, so we can show your remaining balance and deduct usage correctly.

These inputs and outputs are sent to Amazon Bedrock, which runs Claude models made by Anthropic, to generate the response. We may add or change providers over time and will update this Privacy Policy and the subprocessor list in the Data Processing Agreement accordingly. See AI Features below for the contractual protections we have in place.

Support and communications data

When you email us, fill out a contact form, or chat with us, we keep the contents of the conversation, the contact details you provide, and any context needed to assist you. Recordings and transcripts of demo calls, if applicable, are stored only with your prior consent.

Where this data comes from

Most personal data comes directly from you. Some is received from Google (sign-in profile), Polar (billing metadata), Stripe (transaction references, not card data), or derived from your IP address (approximate country for analytics).

5. How We Use Personal Data

We use personal data for the following purposes, and only when one of the legal bases in Section 6 applies.

We do not sell personal data, and we do not share personal data with advertisers or data brokers for advertising purposes. For AI data-handling and no-training commitments, see Section 13.

6. Legal Bases for Processing

If you are in the European Economic Area, the United Kingdom, Switzerland, or another jurisdiction with a similar regime, we process personal data only when one of the following legal bases under the GDPR applies:

• Contract (Article 6(1)(b)) — providing the Service, managing your account, processing payments, operating AI Features, and providing support.
• Legitimate interests (Article 6(1)(f)) — where our interest does not override your rights. Specifically:
  • Securing the Service — our interest in keeping Formstep and its users safe from abuse, fraud, and attacks.
  • Improving the product — our interest in understanding how Formstep is used so we can make it better, relying on aggregated and de-identified data wherever possible, and in finding and fixing faults. This covers the product steps and error reports described in Cookies and Similar Storage.
  • Service communications — our interest in telling you about changes to features you already use.
  • Counting visits — our interest in knowing how many people visit our website and the Formstep app and which pages they view, measured without cookies as described in Cookies and Similar Storage.
  • Understanding how our website and app are used — outside the regions where we ask first, our interest in seeing how visitors use our website and how people use the Formstep app, through analytics cookies and session recordings, as described in Cookies and Similar Storage. You can object at any time through Cookie settings in the website footer.
  • Crediting partners who refer customers — outside the regions where we ask first, our interest in paying the partners in our affiliate program for the customers they refer, through the referral cookie described in Cookies and Similar Storage. You can object at any time through Cookie settings in the website footer.
• Consent (Article 6(1)(a)) — analytics cookies and session recordings on our website and in the Formstep app, and the partner referral cookie on our website, for visitors in the regions where we ask first, and optional product data sharing. You can withdraw consent at any time, for example through Cookie settings in the website footer.
• Legal obligation (Article 6(1)(c)) — tax, accounting, sanctions, and other legal obligations.
• Vital interests (Article 6(1)(d)) — only in rare cases to protect someone’s life or physical safety.

Where we rely on legitimate interests, you have the right to object, and we will reconsider on the basis of your specific situation.

7. How We Share Personal Data

We share personal data only when one of the following applies.

With subprocessors that help us run Formstep

We rely on a small set of trusted third-party providers to deliver the Service. They process personal data only as needed to provide their part of the Service, under contracts that require appropriate confidentiality and security measures. The core subprocessors include:

• Convex — application database and backend.
• Cloudflare R2 — object storage for file uploads and signatures.
• Cloudflare — CDN, DNS, edge security, custom hostnames, and Turnstile bot protection.
• Polar — subscription billing and AI credit purchases (Merchant of Record; independent controller for buyer billing data).
• Stripe — respondent payment processing via Stripe Connect (independent controller for payment data).
• Amazon Web Services (AWS) — Amazon Bedrock for AI Features; Amazon SES for transactional and system emails, including abandoned-response reminders on Pro workspaces.
• Axiom — operational logs and monitoring.
• PostHog — analytics and error reports for our website and the Formstep app, and account sign-ups.
• Affonso — our affiliate program: records which partner referred a visitor and credits that partner when the visitor subscribes.
• Unsplash — image search API; selected images are stored in Cloudflare R2 and served from there.

The authoritative, up-to-date list of subprocessors, along with the categories of data each one processes and the regions in which they operate, is maintained in our Data Processing Agreement.

With integrations you connect

When you connect a third-party service to Formstep — such as a webhook endpoint, automation platform, spreadsheet, messaging tool, or CRM — you authorise us to send the relevant data to that service on your behalf. We share only what is needed for the integration to work, and the third party becomes responsible for the data once it receives it under its own terms and privacy policy.

With AI assistants you connect

You can connect an AI assistant, such as ChatGPT or Claude, to Formstep through our MCP server. You sign in, choose one workspace and approve the connection. When the assistant then calls a Formstep tool, we return what that tool reads to the assistant, on your instructions. Depending on what you ask, this can include form content, recipients’ names and email addresses, request details, submission answers, request activity, and analytics about form visitors such as device, browser, country and traffic source.

The company that provides the assistant handles that data under its own terms and privacy policy, and Formstep does not control what it does with it. You can revoke a connection at any time from Connected apps & API Keys, which stops further access but does not delete what the assistant has already received.

With your collaborators

If you invite people to your workspace, they will see your name, email, role, and the forms and submissions they have permission to access. Workspace owners can change member access and request ownership reassignment through support; the available workspace roles are described in Section 5 of the Terms of Service.

For legal and safety reasons

We may disclose personal data when we believe in good faith that disclosure is necessary to (a) comply with applicable law or a binding order from a competent authority, (b) enforce our Terms of Service, (c) detect, prevent, or address fraud, security, or technical issues, or (d) protect the rights, property, or safety of Formstep, our users, respondents, or the public.

In a business transfer

If Formstep is involved in a merger, acquisition, reorganisation, sale of assets, or insolvency, personal data may be transferred to the relevant counterparties as part of that transaction. Any such transfer will be subject to applicable data protection law.

8. International Data Transfers

Formstep is based in Norway, and we aim to minimise transfers outside the European Economic Area. Some of our subprocessors are located in, or transfer data to, jurisdictions outside the EEA, including the United States and the United Kingdom.

When personal data leaves the EEA, we rely on Standard Contractual Clauses (SCCs) adopted under Decision (EU) 2021/914, the UK International Data Transfer Addendum, the Swiss FDPIC addendum, adequacy decisions, or the EU–US Data Privacy Framework (DPF), as applicable. We also apply encryption in transit and at rest, restricted access, and contractual data minimisation. The applicable transfer mechanism for each subprocessor is detailed in our Data Processing Agreement.

9. Data Retention

We keep personal data only as long as we need it for the purposes described in this policy and as required by law.

• Account data is kept while your account is active. When you ask us to delete your account, account records are removed from active systems shortly after the request is processed and remain in backups only until the corresponding backup window expires.

• Form configuration and submissions are kept while your workspace exists and you have not deleted them. Cancelling a Pro subscription moves you to the free tier; only closing your account triggers deletion. You can also configure a per-form submission retention period; submissions are automatically removed by a scheduled cleanup job when that period elapses.

• Requests — the recipient’s name and email address and what you sent with the request — follow the same rules. A pending request ends at its expiry. One that expired or was canceled without an answer is deleted after the same period as draft submissions, 30 days by default, counted from when it ended. A completed one is kept until you delete it, delete its submission, or the form’s retention period passes, and then it is deleted with its submission.

• Draft submissions that a respondent starts but does not submit are purged after 30 days, unless you have configured a different retention.

• Trashed forms that you have moved to trash are permanently purged after 30 days.

• Anonymous (guest) sessions created when you try Formstep without an account are purged automatically after 1 day.

• Form analytics — page and question views are kept for up to 365 days.

• Delivery logs — records of submission processing are kept for 30 days after they finish, and records of notifications for 90 days. Integration event logs are kept for 90 days.

• Connected assistants and apps — an access or refresh token’s record is deleted 7 days after it expires. Revoking a connection stops access straight away.

• Billing records are kept for the period required by applicable accounting and tax law. Polar, as Merchant of Record, retains its own billing records under its own retention policy.

• Support communications sent to or from the Formstep support inbox are kept as long as needed to resolve your request and handle any related legal claims.

• Product usage and device data — activity logs, device metadata, and diagnostics are retained in identifiable form for a limited period and then deleted or aggregated so that individual users can no longer be identified.

• Operational and security logs generated by the Service are kept for the period needed to operate, debug, and secure the Service. Where a specific incident requires a longer period, we restrict access and delete the logs as soon as the obligation expires.

• Backups are created on a regular schedule with a short retention window. File uploads stored in Cloudflare R2 are not covered by object versioning; deletions of file uploads are unrecoverable immediately. Personal data deleted from production becomes unrecoverable once the corresponding backup window expires.

• AI prompts and outputs sent to Amazon Bedrock are not stored by AWS after the request is processed and are not used to train any models, as described in the AWS Service Terms.

If law requires us to keep a record for longer — for example to meet a tax, anti-money-laundering, or court-order obligation — we restrict access to that record and delete it as soon as the obligation expires.

10. Security

We apply technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, and unauthorised access. These measures include:

• Encryption of personal data in transit using TLS 1.2 or higher, and at rest using industry-standard algorithms;
• Access controls based on least privilege, with internal access to production systems restricted on a need-to-know basis;
• Logging and monitoring of administrative actions in production systems;
• Network segmentation and isolation of production from development environments;
• Vulnerability management, including timely application of security updates and a responsible disclosure channel at support@formstep.io;
• Access controls limiting production access to authorised personnel.

No system is perfectly secure. If you become aware of a vulnerability or a possible compromise, report it to support@formstep.io.

11. Your Rights

Depending on where you live, you may have the following rights over the personal data we hold about you. Many of these are guaranteed under the GDPR, the UK GDPR, and equivalent laws in other jurisdictions.

• Right of access — ask for a copy of the personal data we hold about you and information about how it is processed.
• Right to rectification — ask us to correct inaccurate or incomplete data.
• Right to erasure — ask us to delete personal data when there is no overriding reason to keep it. You can also close your account and delete most of your data yourself from the product.
• Right to restriction — ask us to pause processing in certain situations, for example while we check a correction or objection.
• Right to data portability — receive your personal data in a structured, commonly used, machine-readable format, or have it sent to another controller. The export feature in the application covers most of this for forms and submissions, with CSV and Excel (XLSX) output.
• Right to object — object to processing based on legitimate interests, including profiling, and to direct marketing at any time.
• Right to withdraw consent — where we rely on your consent, you can withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing before withdrawal.
• Right not to be subject to a decision based solely on automated processing (Article 22 GDPR) — we do not make decisions about you that produce legal or similarly significant effects through solely automated processing, including profiling.

To exercise any of these rights, email support@formstep.io or use the self-service options in the application where available. We will respond within one month, or tell you why we need more time. We may ask for information to verify your identity before acting on a request, especially for access or deletion.

If you are unhappy with how we have handled your data, you can lodge a complaint with a supervisory authority — for users in Norway, the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no). You can also complain to the authority in the EEA country where you live or work.

Rights of respondents

If you are a respondent who submitted a form built on Formstep, your data subject rights run primarily against the Formstep user who built that form — they are the data controller. We can help you reach them, and we will support them in responding to your request. Where we hold the underlying data as a processor on their behalf, we will act on their documented instructions. To contact us, write to support@formstep.io and tell us which form you submitted (the URL is usually enough).

12. Cookies and Similar Storage

We use a small number of cookies, localStorage, and sessionStorage entries to make Formstep work and to deduplicate analytics on your forms. We try to keep the list short.

• Strictly necessary — keep you signed in, remember the workspace you last used, secure the application against cross-site request forgery, and store essential preferences. These cannot be disabled without breaking the product.
• Functional — remember UI preferences such as theme, sidebar state, and language. You can clear them from your browser.
• Analytics on our website (formstep.io) and in the Formstep app (app.formstep.io) — PostHog, our analytics provider, can count a visit without storing anything on your device. Its servers combine your IP address and browser user agent with a random value that changes every day and is then deleted, so a visit can’t be linked to your visits on other days. If you visit from the European Economic Area, the United Kingdom and its Crown dependencies, Gibraltar, Switzerland, Turkey or Quebec, or from a location we can’t determine, we ask first: only if you accept in the cookie banner does PostHog also set a cookie (ph_*_posthog) and localStorage entries that identify your browser, and record your visits as session replays. Everywhere else, PostHog sets that cookie and records session replays from your first page, unless your browser sends a Global Privacy Control signal. We tell the regions apart by the country our hosting provider, Cloudflare, derives from your IP address. Session replays hide what you type into fields. Your choice is stored in a cookie (fs_analytics_consent) so we don’t ask on every page. You can change it at any time through Cookie settings in the website footer; declining or withdrawing deletes what PostHog stored, and your visits are then counted without cookies. The cookie that holds your choice, and PostHog’s cookie, are set for formstep.io and its subdomains, so the same choice applies in the Formstep app, which has no banner of its own: there PostHog sets its cookie and records your use only if you accepted on our website, or if you are outside the regions where we ask first and have not declined. Once you sign in, your use of the app is linked to your account identifier; we do not send PostHog your name or email address. Session replays of the app after you sign in show Formstep’s own interface, such as its buttons, menus and headings, with the layout of the screen and where you click. They hide everything else: text is masked unless it is one of Formstep’s own labels, the form you are editing, every table and the places that show your respondents’ answers or details are masked whole, and images are left out, so replays do not show the wording of your forms, your respondents’ answers or their contact details. A click is recorded with the label of the button you pressed when that label is Formstep’s own. Replays of the guest editor, where you try Formstep without an account, show the screen as you see it, including the form you build there and what you write to the AI assistant; they leave out images, what you type into fields, and the answers you give to the demo request.
• Product steps and error reports in the Formstep app — these use no cookies and store nothing on your device, so they do not depend on the choice above. When you have an account, our servers tell PostHog when you take one of a few steps: your first workspace is set up, you create a form, edit a form for the first time, publish a form, or create a request. Each is recorded against your account identifier with the identifier of the record and how the step was taken (in the app, or through the API or MCP), and never with the content of a form or anything about your respondents. When the app fails, it sends PostHog an error report: the kind of error, where in our code it happened and, for a request our servers refused, the server’s error code. Text an error message quotes is removed before the report is sent. We use both to find where people get stuck and to fix faults; to object, write to support@formstep.io.
• Partner referrals on our website (formstep.io) — when you arrive through a link from a partner in our affiliate program, Affonso, our affiliate provider, records the visit for that partner and stores the referral in cookies (affonso_referral, and affonso_data with details about the partner) for 30 days. The cookies are set for formstep.io and its subdomains, so the Formstep app reads the referral when you subscribe: we then apply the partner’s offer, if there is one, and pay the partner a commission, and the partner learns that their referral became a customer. The cookies follow your analytics choice above: where we ask first, or when your browser sends a Global Privacy Control signal, they are set only if you accept, and until then Affonso records only that a partner’s link was used, without storing anything on your device: a click identifier (affonso_id) in the page address carries the visit from page to page instead. Declining or withdrawing deletes the cookies and removes the identifier from the address.
• Analytics on hosted form pages — a random visitor identifier (fs_visitor_id) in localStorage, plus short-lived sessionStorage flags (fs_viewed, fs_engaged), used to deduplicate view and engagement counts. This storage is not needed for the form to function and does not enable advertising, cross-site tracking, or profiling. Formstep places this storage as a data processor on your instructions as controller. If your respondents are in jurisdictions where prior consent is required for non-essential storage (such as the EEA under the ePrivacy Directive or Norway under Ekomloven § 3-15), you are responsible for obtaining that consent before the form page loads.

We do not use cookies or similar storage to track respondents across other websites for advertising, and we do not place advertising cookies on hosted form pages. You can clear cookies, localStorage, and sessionStorage through your browser settings. Blocking strictly necessary cookies or storage may prevent parts of the Service from working.

If you build forms on Formstep, your hosted forms will set fs_visitor_id in localStorage on respondent devices as described above. You should disclose this in your own privacy notice to respondents.

13. AI Features

Prompts and context you submit through Formstep AI Features are sent to Amazon Bedrock, which runs Claude models made by Anthropic inside the EU. Formstep’s own accounts, including forms Formstep itself publishes, and its test environments may instead use Anthropic’s API, which can process data outside the EU, keeps it for up to 30 days and does not use it to train models. Customer workspaces always run on Amazon Bedrock. Context includes, where applicable, the structure of the form you are editing and submission samples you explicitly share for analysis or summarisation. We configure it so that, under the AWS Service Terms, inputs and outputs are not used to train any models and are not stored by AWS after the request is processed. Processing is in line with the security and data protection commitments in this Privacy Policy and the Data Processing Agreement.

AI outputs are generated probabilistically and may be inaccurate, incomplete, or out of date. You are responsible for reviewing every AI-generated output before you rely on it, publish it, or send it to respondents.

You should not submit personal data, secrets, or other sensitive information through AI Features unless you have a lawful basis to share that information with our subprocessors and have considered the risks. We do not control how providers respond to lawful government requests directed at them.

14. Children

Formstep is not designed for children. You must be at least sixteen (16) years old to create a Formstep account, as described in our Terms of Service.

Formstep users may build forms intended for younger audiences. If you collect personal data from children through Formstep, you are responsible for obtaining any required parental or guardian consent and for handling that data in accordance with applicable law, including COPPA where relevant. Section 6 of the Terms of Service lists sensitive data classes the Service is not designed for, and Section 7 sets out prohibited uses, including content that exploits or endangers minors.

We do not knowingly collect personal data from children under sixteen (16) (or under thirteen (13) where COPPA sets a lower threshold). If you believe we have inadvertently collected personal data from a child below the applicable age threshold without the required consent, contact us at support@formstep.io and we will delete it without undue delay.

15. Communications

We send two kinds of email:

• System emails about your account, security, billing, and the forms you build. These are part of the Service and cannot be opted out of while your account is active.
• Service announcements about changes to the product, policies, or features you rely on. We keep these to the minimum needed to keep you informed.

16. Notice for California Residents

If you are a resident of California, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including the right to know what personal information we collect, the right to delete it, the right to correct inaccuracies, and the right to opt out of the “sale” or “sharing” of personal information.

Formstep does not sell personal information and does not share personal information for cross-context behavioural advertising. Because no sale or sharing occurs, no “Do Not Sell or Share My Personal Information” link is required or provided.

The categories of personal information we collect, purposes, and retention periods are described in Section 4, Section 5, and Section 9. We do not build behavioural profiles for advertising and do not use sensitive personal information for inferences or profiling.

To exercise your rights — including the right to know, delete, correct, opt out, or limit sensitive personal information — write to support@formstep.io. We will not discriminate against you for exercising any of these rights.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to the Service, our subprocessors, applicable law, or business practices. The “Last updated” date at the top of this policy shows when it was most recently revised.

If you continue to use the Service after a change takes effect, you accept the updated Privacy Policy. If you do not agree to a change, you can close your account before it takes effect.

18. Contact Us

For privacy questions, data subject requests, or anything else related to this policy, contact us at:

• Privacy questions, data subject requests, and security reports — support@formstep.io

Formstep has not appointed a Data Protection Officer. Our privacy team monitors the support@formstep.io inbox and will route your request appropriately.

Related documents