Privacy Policy

The data controller for personal data processed in connection with your account and use of Liteform is Thibaud Métayer, an entrepreneur individuel operating under the micro-entreprise regime, located in Bordeaux, France, registered under SIRET 533 344 628 00060. VAT is not applicable under the micro-entreprise VAT exemption.

For questions about this policy or to exercise your rights, contact us at hello@liteform.io. No Data Protection Officer has been appointed.

For account holders: name, email address, password hash, billing information handled by Stripe, and usage data such as pages visited and features used.

For respondents: the answers submitted through a form, plus technical data needed to deliver and protect the form, such as IP address and browser metadata for spam prevention.

Name, email address and password are mandatory to create an account: without them, the service cannot be provided. Billing information is only requested for paid plans. Other usage data is collected automatically as you browse and does not result from a voluntary input.

We do not collect more data than is necessary for the purposes described below.

We process account data to provide and improve the service, process payments, prevent abuse and send service communications. The legal basis is performance of our contract with you and, where applicable, our legitimate interest in securing and improving the service.

We process respondent data on behalf of the form author to store, display and forward responses to the integrations the author configured. The legal basis is the form author's instructions (contractual necessity).

We do not sell personal data, and we do not use your form responses to train AI models.

When you answer a form built with Liteform, the form's author is the data controller for your answers. We process them on the author's behalf: we store them, display them to the author and forward them to the integrations the author configured.

If the author enables integrations such as Notion or Google Sheets, the answers are transferred directly at the author's instruction. This is a controller-initiated transfer, not a Liteform sub-processing activity. Questions about a specific form should go to its author first.

We rely on the following subprocessors to host, secure and operate the service. Each processes data only on our instructions and under a data processing agreement:

- Vercel: cloud hosting and infrastructure.

- Neon (neon.com): database hosting.

- Stripe: payment processing.

- Resend: transactional email delivery.

- PostHog (EU instance): product analytics on pseudonymous usage data.

- Better Auth Infra: authentication infrastructure.

- OpenRouter: AI form generation (prompt content only, not respondent answers).

- Vercel Blob: file storage for form branding uploads.

- Google reCAPTCHA: bot protection on public forms.

Some subprocessors may store data outside the European Economic Area. Where this occurs, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.

We use cookies that are necessary for the service to work, such as keeping you signed in and remembering your theme and language preferences. These do not require consent.

We use analytics cookies (PostHog) to understand product usage in aggregate. These are optional and require your consent before they are placed. You can manage your choices through the cookie banner or the Cookie Policy page.

You can also manage or disable cookies through your browser settings. Blocking necessary cookies may prevent you from signing in or using core features.

Form or workspace deleted individually (account still active): associated responses are anonymised and the form is permanently deleted within 30 days at the latest (14 days for a workspace), a window during which the deletion can still be undone by contacting us.

Account deleted entirely: your account data, workspaces, and associated responses are deleted or anonymised immediately, with no waiting period, except where the law requires a longer retention period (for example billing data, see below). Account deletion cannot be undone.

Payment records: retained for the period required by tax and accounting law, currently 10 years in France.

Usage logs and analytics: retained for up to 12 months, then deleted or aggregated.

Under the GDPR and similar laws you can access, correct, export, restrict or delete your personal data, and object to certain processing. Write to hello@liteform.io and we will respond within one month, extendable by two further months for complex requests.

You may also lodge a complaint with the CNIL or your local data protection authority.

Data is encrypted in transit using TLS, access is limited to the people who need it, and forms can be protected with passwords, CAPTCHA and honeypot fields. We enforce multi-factor authentication on critical internal services.

No system is perfectly secure. If you discover a vulnerability, please report it responsibly to security@liteform.io.

We may update this policy as the service evolves. Material changes are announced by email or in the product at least 30 days before they take effect. For any privacy question, contact hello@liteform.io.

In accordance with Article 85 of the French Data Protection Act (Loi Informatique et Libertés), you may set directives regarding the retention, erasure or disclosure of your personal data after your death. To register, change or cancel these directives, contact us at hello@liteform.io.