Last updated: July 3, 2026
This policy explains what personal data XForm collects, why, and what rights you have. It covers both account holders and the people who answer forms built with the service.
For account holders: name, email address, password hash, billing information handled by Stripe, and usage data such as pages visited and features used.
For respondents: the answers submitted through a form, plus technical data needed to deliver and protect the form, such as IP address for spam prevention.
We use account data to provide and improve the service, process payments, prevent abuse and send service communications. We do not sell personal data, and we do not use your form responses to train AI models.
When you answer a form built with XForm, the form's author is the data controller for your answers. We process them on the author's behalf: we store them, display them to the author and forward them to the integrations the author configured. Questions about a specific form should go to its author first.
We rely on a small number of providers to run the service: a cloud hosting provider for infrastructure and storage, Stripe for payments, and a product analytics tool. Each processes data only on our instructions and under a data processing agreement.
We use cookies that are necessary for the service to work, such as keeping you signed in and remembering your theme. Analytics is used to understand product usage in aggregate.
Account data is kept while your account is active and deleted within a reasonable period after account deletion. Form responses are kept until you delete them or delete the form, within the limits of your plan.
Under the GDPR and similar laws you can access, correct, export, restrict or delete your personal data, and object to certain processing. Write to hello@xform.io and we will respond within the legal timeframe. You may also lodge a complaint with your data protection authority.
Data is encrypted in transit, access is limited to the people who need it, and forms can be protected with passwords, CAPTCHA and honeypot fields. No system is perfectly secure, but we treat the protection of your data as a core feature of the product.
We may update this policy as the service evolves. Material changes are announced by email or in the product. For any privacy question, contact hello@xform.io.