Privacy Policy

This policy explains how hootform ("we", "us") handles personal data. It covers:

• people who use hootform to build forms (editors, and members of an organization);
• people who visit hootform's website and docs;
• respondents, who fill in forms built with hootform — in a different way, explained below.

Who we are

hootform is the form builder at https://hootform.com. For anything about privacy, email [email protected].

Two roles: controller and processor

For the data of the people who use hootform and visit our site, we are the controller: we decide why and how it's used, and this policy is our promise about it.

For the answers respondents give in a form, the organization that owns the form is the controller and we are its processor. We store and process those answers only to run the service for that organization, under our Terms of Service. We don't use respondents' answers for our own purposes, and we never sell them.

If you filled in a form

The form belongs to the organization that made it, not to hootform; its name or logo is usually at the top. That organization decides what it asks, what it does with your answers and how long it keeps them, and its own privacy notice — often linked at the foot of the form — applies. To see, correct or delete your answers, contact them. If you can't reach them, email [email protected] and we'll pass your request on.

What we store for the form's owner:

• Your answers, including any files you attach or signature you draw, and any follow-up questions you answer.
• Values in the form's link that the owner set up to be stored (hidden fields), such as a campaign name.
• When you started and finished, which language you used, and which question you reached if you didn't finish.
• Your browser's user agent and the page that linked to the form (the referrer).
• Signals of possible spam or bots: a score if a typed answer looked like spam, and a flag if a bot check failed.

Your IP address is used briefly to limit how many responses one address can start and, where it's on, to check you aren't a bot (through Cloudflare Turnstile). We don't store it with your response.

If the owner turned on encryption, identifying answers (email, phone, links, dates, files, signatures and others), hidden fields, follow-ups, the user agent and the referrer are encrypted in our database with a key unique to that form. Unfinished responses are saved as you go, so the owner may see answers to a form you didn't submit. To let you come back later, your browser keeps a cookie for 30 days — see Cookies.

What we collect from people who use hootform

• Account details: your email address and, if you give one, your name. If you sign in with Google, we receive your Google account's name and email address.
• Where you signed up from: a short label for the hootform page that sent you (such as "templates" or "docs"), recorded once when your account is created.
• Your organizations: the organizations and workspaces you belong to, your role in each, invitations you send (including the invitee's email address), and who created or last changed a form.
• What you build: forms, versions of them, pictures and logos you upload, and settings such as webhooks and notification recipients.
• Connected accounts: if you connect Google Sheets, the Google account's email address and access tokens, which we encrypt and never show anyone.
• Billing records: if your organization buys Premium, the subscription's identifiers and status from Dodo Payments. Dodo collects your payment details directly; we never see your card number.
• Sign-in codes: each code is kept so it can be checked, expires after 10 minutes and works once.
• Support: what you send us when you email us.

We don't use advertising or analytics trackers on hootform's website, dashboard or forms. A form's view count is a counter per form per day, not a record of who visited.

How we use it, and our legal bases

We don't send marketing email without your consent, and you can withdraw consent at any time.

AI features

Some features send text to a large language model provider — Anthropic or OpenAI, whichever the feature runs on. Under their API terms, neither uses this data to train its models; they may keep it for a limited time to monitor abuse, as their policies describe. Here's what each feature sends:

• Building a form with AI and translating a form: the description you type, and the form's own text.
• Follow-up questions (Premium, only on forms whose editor turned them on): the question and the respondent's answer to it, so the model can ask a follow-up.
• AI insights and response summaries (Premium, only when an editor asks): free-text answers, "Other" text and follow-up replies from up to the latest 50 completed responses, or from one response. Identifying answers (email, phone, links, dates, files, signatures and numbers marked personal), consent, hidden fields, the user agent and the referrer are never sent, and responses are labelled with stand-ins rather than their ids.
• Spam check (every plan, on by default, can be turned off per form): short and long text answers, and "Other" text, are sent to OpenAI as they're submitted to judge whether they look like spam. Nothing else from the response is sent.

Who else handles data

We use a small number of service providers ("subprocessors") to run hootform — hosting, email, payments, AI and bot protection. Each is bound by a data protection agreement and handles data only to provide their service to us. The full list, with what each receives and where, is on our Subprocessors page.

Otherwise we share personal data only:

• with the services an editor chooses to connect, such as Google Sheets or a webhook, when they ask us to;
• inside an organization, where members can see what their role allows;
• when the law requires it, or to protect people's safety or our rights;
• with a buyer or successor if hootform is sold or merged, who must keep this policy's promises.

We never sell personal data or share it for advertising.

Where data is stored

hootform's servers, database and file storage run in the European Union. Some subprocessors, such as our email and AI providers, are in the United States. Where data leaves the EU or UK, the transfer relies on an adequacy decision (such as the EU–US Data Privacy Framework) or on the European Commission's Standard Contractual Clauses.

How long we keep it

• Accounts are kept while they're in use. When you delete your account, your personal details are removed within 30 days, apart from what we must keep by law, such as billing records.
• Forms and responses are kept until the organization deletes them, deletes the form or the organization, or sets the form to delete old responses automatically.
• Files a respondent picked but never submitted are deleted after 24 hours.
• Webhook and Google Sheets delivery logs keep the latest 50 attempts per destination.
• Backups of the database roll off within 7 days, so deleted data is gone from them by then.

How we protect data

• Every connection to hootform uses TLS (HTTPS).
• On forms with encryption on, identifying answers, attached files, follow-ups and AI reports are encrypted at rest with AES-256-GCM, under a key per form that is itself wrapped with a key kept outside the database. Deleting a form destroys its key.
• Connected accounts' tokens are always encrypted the same way.
• Files respondents attach are stored privately and only ever downloaded through hootform, by people with access to the form.
• Access inside an organization follows its roles, and is checked on every request. hootform staff reach customer data only when needed to support or secure the service.

No system is perfectly secure. If a breach affects your personal data, we'll tell you, and the authorities where required, without undue delay.

Your rights

Depending on where you live — including under the GDPR, the UK GDPR and California's CCPA — you have the right to:

• access the personal data we hold about you, and get a copy in a portable format;
• correct it if it's wrong;
• delete it;
• object to or restrict how we use it, including where we rely on legitimate interests;
• withdraw consent where we rely on it;
• complain to a data protection authority, such as the one where you live or work.

To use any of these, email [email protected]. We'll answer within a month, and may need to confirm it's you first. You can change your name, and leave or delete organizations, in the dashboard yourself. If you're a respondent, contact the organization that owns the form first — see above.

We don't sell or "share" personal data as the CCPA defines it, and we don't treat you differently for using your rights.

Children

hootform isn't meant for anyone under 16, and we don't knowingly collect personal data from them for our own purposes. If you think a child has given us personal data, email [email protected] and we'll delete it. An organization whose forms are filled in by children is responsible for getting any consent the law requires.

Cookies

hootform sets only the cookies and browser storage it needs to work, such as the one that lets a respondent resume a form. The Cookie Notice lists each one.

Changes to this policy

When we change this policy in a way that matters, we'll update the date at the top and email account holders before the change applies.

Contact

Email [email protected].