This policy explains how FORMWORK SOFTWARE LIMITED (“FormWork”, “we”, “us”) collects and uses personal data when you visit useformwork.com, contact us, or use the FormWork service at app.useformwork.com. It also explains what happens to data that our customers collect through their forms, where our role is different.
Who we are
FORMWORK SOFTWARE LIMITED is a private limited company registered in England and Wales with company number 15640273. Our registered office is 167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF.
Our ICO registration number is [ICO registration number].
For any question about this policy or your personal data, email [privacy contact email] or write to us at our registered office. We have not appointed a data protection officer.
Our role: controller or processor
Our role depends on whose data it is and why we hold it.
We are the controller for personal data about:
- visitors to useformwork.com
- people who contact us, send us feedback or try a live example form on our website
- people who sign up for, sign in to or are invited to a FormWork account (“account holders”)
- billing contacts
- people who receive marketing from us
We are a processor for the personal data that our customers collect and manage using FormWork. This includes answers submitted to customers’ forms, uploaded files, entries, data tables, and the details of approvers and other people a customer involves in its processes. For that data, the customer is the controller. It decides what is collected, why, how long it is kept and where it is sent, and its own privacy notice applies. We process that data only on the customer’s instructions, under our [link to terms] and [link to DPA]. If anything in this policy conflicts with those documents about customer data, those documents prevail.
If you filled in a form built with FormWork, or received an approval or status link from one, please contact the organisation that sent you the form about your data. It is responsible for answering your request. If you contact us instead, we will pass your request to that organisation where we can identify it, but we can’t decide on the request ourselves.
We are also a controller for limited technical data about people who use customers’ forms, such as IP addresses used for rate limiting, CAPTCHA results and security logs, where we use it to keep the service secure and to meet our legal obligations.
Information we collect
When you visit our website
- Technical and usage data. Your IP address, browser and device information, the pages you visit, the website that referred you, and the time of your visit. Our website hosting provider receives this when your browser requests a page.
- Analytics data. On useformwork.com we use Google Analytics. It records pages viewed and a small number of events: a visit referred from certain AI assistants (ChatGPT, Claude, Perplexity, Copilot or Gemini, identified from the referring website), a click on a link to start a free trial, and a successful submission of our contact form. The contact form event does not include what you wrote. See cookies and similar technologies.
- Your display preference. If you choose a light, dark or system theme, your browser stores that choice on your device. It is not sent to us.
When you contact us or try a live example
Our contact form and the live example forms on our website are FormWork forms, loaded from app.useformwork.com. What you enter is stored in our own FormWork account, together with the technical data needed to deliver and protect the form. For the contact form, this is usually your name, email address and message, and we also keep any later correspondence with you. The live examples use fictional organisations, so you don’t need to enter real details.
When you create or use an account
- Identity and contact details. Your name and email address.
- Sign-in data. Your password, which we store only as a one-way hash, not in readable form. When you sign in, we record your IP address, browser user agent and when the session started and expires.
- Account and team data. Your account (team) name, your role (Admin or Member), the groups you belong to, any time you mark yourself as away, and invitations you send or receive.
- Activity in the service. What you create and change, such as forms, processes and automations, and the history the service keeps of who changed what and when.
- API keys. The name of each key, who created it, and when it was created, last used and revoked. We keep only a hash of each key’s secret.
- Billing data. Your plan, trial and subscription status, and the identifiers Stripe gives your customer record and subscription. Payment card details are entered on pages provided by Stripe and are processed by Stripe. We do not receive or store full card numbers. Stripe sends us notifications about your subscription, which we keep, and these can include the billing name, email address, postal address and tax ID you give Stripe.
- Support and feedback. Messages you send us, and feedback you submit through the service together with your name, email address, account and the page you were on. Our team also keeps notes when helping you.
- Technical and error data. Our servers log requests to the service, and we record errors to fix problems. When a request fails with a server error, the log can include part of what was sent, which may contain personal data.
When a new account is created, our team receives an email with the new account holder’s email address and account name.
Data customers collect through their forms
When a customer uses FormWork, we store and process the data their forms collect for them. Depending on how the customer has set up its forms, this can include:
- answers and uploaded files submitted by respondents
- email addresses used to send confirmation emails or links to resume an unfinished entry
- the names, email addresses, decisions and comments of approvers, including people outside the customer’s team who receive approval links
- the text typed into an address field, if the form uses address lookup
- information the customer’s team adds, such as team fields, comments, owners and stage changes
We process this data as a processor, as described in our role.
How we use information and our lawful bases
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we need a lawful basis for each use of personal data for which we are the controller.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Deliver and secure our website | Technical and usage data | Legitimate interests: running a reliable and secure website |
| Understand how our website is used and improve it | Analytics data | Legitimate interests: understanding which content and channels help people find FormWork. See cookies and similar technologies |
| Remember your display preference | Your theme choice, on your device | Legitimate interests: providing the setting you asked for |
| Reply to enquiries and feedback | Contact details, message, correspondence | Legitimate interests: responding to people who contact us. Where you are asking about a subscription, steps you ask us to take before entering into a contract |
| Create and run your account and provide the service | Identity, sign-in, account and activity data | Performance of a contract with you. Where you use an account on behalf of an organisation, legitimate interests: providing the service that organisation has asked for |
| Send service emails, such as welcome emails, invitations, password resets and automation failure alerts | Contact details, account data | Performance of a contract, or legitimate interests: running the service our customer has asked for |
| Take payments, manage subscriptions and calculate tax | Billing data | Performance of a contract |
| Keep financial and tax records | Billing data | Legal obligation |
| Keep the service and its users secure, prevent fraud and abuse, and enforce our terms | Sign-in data, technical data, CAPTCHA results, rate-limit counts | Legitimate interests: protecting our service, customers and their respondents |
| Monitor errors and performance and fix problems | Technical and error data | Legitimate interests: running a reliable service |
| Provide support and manage accounts, including trials and new sign-ups | Account data, support records, notes | Performance of a contract and legitimate interests: helping customers use the service |
| Tell you about FormWork products and updates | Contact details | Legitimate interests. We send marketing emails to individuals only with consent, or where you are a customer, we are telling you about similar products, and you have had the chance to opt out. You can opt out at any time |
| Comply with the law, respond to lawful requests, and establish, exercise or defend legal claims | Any relevant data | Legal obligation and legitimate interests: protecting our legal rights |
| Reorganise, sell or transfer all or part of our business | Any relevant data | Legitimate interests: running and developing our business |
When the service sends emails on a customer’s behalf, such as approval requests, reminders, form notifications and emails to respondents, we act as the customer’s processor and the customer’s lawful basis applies.
Where we rely on legitimate interests, we have considered your interests and rights and concluded that they don’t override ours. You can ask us for more information about this balance, and you can object, as described in your rights.
Where we rely on consent, you can withdraw it at any time. This does not affect processing that happened before you withdrew it.
If you don’t provide the information we need to create your account or bill you, we won’t be able to provide the service.
We don’t make decisions about you based solely on automated processing that produce legal or similarly significant effects. Customers can set up automations that act on form entries; that is the customer’s processing, not ours.
Cookies and similar technologies
Cookies and browser storage let a website keep small pieces of information on your device.
On useformwork.com
| Name or type | Provider | Purpose | Necessary? |
|---|---|---|---|
Google Analytics cookies, such as _ga and _ga_<ID> | Distinguish visitors and sessions so we can measure use of the website | No | |
theme (browser local storage) | FormWork | Remember your light, dark or system theme choice | Set only when you choose a theme |
| Browser local storage used by our embedded forms | FormWork | Remember an unfinished entry so you can return to it | Set only if the form lets you resume an entry |
Google Analytics runs only on useformwork.com and www.useformwork.com, not on other copies of the site. The website does not currently display a cookie banner or ask for your consent before Google Analytics cookies are set. You can block or delete cookies in your browser settings, and you can stop Google Analytics from collecting data about your visits with Google’s opt-out browser add-on. Blocking analytics cookies does not affect how the website works.
Google may use your IP address to estimate your general location. Read how Google uses information from sites that use its services.
The website serves its own fonts and does not load fonts from a third-party font service. Our embedded forms are loaded from app.useformwork.com, which receives your IP address and browser information. If an embedded form uses a CAPTCHA check or a Google font, Cloudflare or Google also receives this information, as described below.
In the FormWork service
| Name or type | Provider | Purpose | Necessary? |
|---|---|---|---|
session_token cookie | FormWork | Keep you signed in. It expires after 7 days or when you log out | Yes |
| Browser session and local storage | FormWork | Remember the account you are working in and interface preferences | Yes |
| Browser local storage on forms | FormWork | Let a respondent resume an unfinished entry, where the form allows it | Yes, to provide the feature |
| Cloudflare Turnstile | Cloudflare | Check that a sign-up, sign-in, password reset or protected form submission comes from a person | Yes, for security |
Customers decide how their forms look and what they contain. A form can use a font the customer chooses from Google Fonts, embed a video from YouTube or Vimeo, or take a payment through the customer’s own Stripe account. When it does, the respondent’s browser connects to that provider, which receives the respondent’s IP address and browser information and may set its own cookies under its own policies.
We don’t use advertising cookies in the FormWork service.
Who we share information with
We do not sell your personal data.
We share personal data only as described here.
Service providers
We use the following providers to run our website and service. Where they process personal data on our behalf, they do so under contracts that require them to protect it and use it only on our instructions. Where we are a processor for our customers, these providers are our sub-processors. Where a provider also uses data for its own purposes, such as Google for Google Analytics, its own privacy policy applies to that use.
| Provider | What they do | Data involved |
|---|---|---|
| [hosting provider] | Hosts the FormWork application and database in [hosting region] | All service data |
| [hosting provider], running open-source Gotenberg software | Generates PDF documents from form data | Data included in the document |
| DigitalOcean (Spaces) | Stores uploaded and generated files in [storage region] | Files and their names |
| Cloudflare | Hosts and delivers useformwork.com, and provides Turnstile CAPTCHA checks | Technical data, CAPTCHA signals |
| Website analytics on useformwork.com | Analytics and technical data | |
| Stripe | Subscription payments, checkout, tax calculation and billing portal | Billing details you enter on Stripe’s pages, and identifiers for your account and user |
| Twilio SendGrid, or [SMTP email provider] | Delivers emails sent by the service | Recipient addresses and email content, including any attachments |
| HERE | Suggests addresses as a respondent types, on forms that use address lookup. Requests come from our servers, so HERE does not receive the respondent’s IP address | The text typed into the address field, and the countries and language the form uses |
| Sentry | Error and performance monitoring | Technical data, error details and user IDs. We remove sign-in cookies, authorisation headers and private link tokens before sending |
We may change these providers. When we do, we will update this list and give customers any notice of new sub-processors that our [link to DPA] requires.
Where customers send data
Customers can configure FormWork to send data elsewhere, for example through email notifications, Slack messages, HTTP requests, webhooks, API access, extensions such as Stripe payments, exports and PDF documents. The customer chooses the destination and is responsible for it. Once data reaches a service the customer has chosen, that service’s own terms and privacy policy apply, and we are not responsible for how it handles the data.
Other sharing
We may also share personal data:
- with the organisation that owns your account, which can see the details of its members and their activity
- with professional advisers, such as lawyers, accountants and auditors, under a duty of confidentiality
- with the police, regulators, courts or other authorities where the law requires it, or where we reasonably believe it is necessary to protect the rights, property or safety of FormWork, our customers or others
- with a buyer, investor or successor if we are involved in a merger, acquisition, restructuring or sale of assets, subject to appropriate confidentiality
Third-party websites and services
Our website, the service, forms built with FormWork and our emails may link to, or include content from, websites and services we don’t control. Examples are Google, Stripe, YouTube, Vimeo and the systems customers connect to FormWork. This policy does not apply to them, and we are not responsible for their content, availability, security or privacy practices. Please read their terms and privacy policies before you use them. This does not affect our responsibility for the providers listed above when they process personal data on our behalf.
International transfers
Some of our providers are based in, or process data in, countries outside the UK, including the United States. When we transfer personal data outside the UK, we rely on one of these safeguards:
- UK adequacy regulations for the destination country, including the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it
- the International Data Transfer Agreement (IDTA), or the International Data Transfer Addendum to the EU Standard Contractual Clauses (UK Addendum), together with any additional measures needed
Where we are a processor, we transfer customer data outside the UK only as permitted by our agreement with the customer.
You can contact us for more information about the safeguards for a particular transfer.
How long we keep information
We keep personal data only for as long as we need it for the purposes in this policy, including to meet legal, accounting and reporting requirements. After that, we delete or anonymise it. Where that isn’t immediately possible, for example in backups, we keep it secure until it is deleted.
| Data | How long we keep it |
|---|---|
| Website analytics data | [retention period] (as set in Google Analytics) |
| Enquiries, contact form submissions and live example entries | [retention period] after our last contact, or after the entry was made |
| Account data | While the account is active, then [retention period] after the account is closed. You can’t yet close an account in the service, so contact us to close it |
| Sign-in sessions | Sessions expire after 7 days. Session records are deleted when you log out, and records of expired sessions are kept for [retention period] |
| Password reset links | Expire after 1 hour |
| Team invitations | Expire after 7 days |
| Rate-limit counts, which can include IP addresses | Up to about 24 hours |
| Billing and financial records, including Stripe notifications | [retention period], to meet tax and accounting law |
| Support records and account notes | [retention period] |
| Records of emails the service sends, including their content | [retention period]. The text of emails that contain private links, such as approval links, is removed once they are sent |
| Server logs and error monitoring data | [retention period] |
| Backups | [retention period] |
| Data customers collect through their forms | Until the customer deletes it, or [retention period] after the customer’s agreement ends, unless the law requires us to keep it. Entries a customer deletes are removed from the service but may remain in our database and backups for up to [retention period] before they are permanently erased |
We may keep information for longer where we need it to establish, exercise or defend legal claims, or where the law requires it.
Your responsibilities as a customer
If you use FormWork to collect personal data, you are the controller of that data and we are your processor. You are responsible for:
- having a lawful basis for collecting and using it, including consent where you rely on consent
- making sure you are entitled to give the data to us and to instruct us to process it
- giving respondents, approvers and anyone else whose data you process a clear privacy notice
- deciding what to collect, how long to keep it, and when to delete it
- deciding who in your account can access it, and where your automations, integrations, extensions and exports send it
- checking that any third-party content you add to your forms, such as fonts, videos and payment providers, is suitable and covered by your privacy notice
- responding to requests from people exercising their data protection rights, with our help where our agreement provides for it
- deciding whether your forms are suitable for children, and meeting any legal requirements that apply if you collect children’s data
- not using the service to collect special category or criminal offence data unless you have a lawful basis and appropriate safeguards
Our [link to terms] and [link to DPA] set out these responsibilities in more detail.
How we protect information
We use reasonable technical and organisational measures to protect personal data. They currently include:
- encryption of data in transit between your browser and our service
- passwords and API key secrets stored only as one-way hashes, and approval, status, invitation and password reset links stored only as hashes
- encryption of the secrets customers store for their integrations
- secure, HTTP-only session cookies, and the ability to log out other devices
- role-based access within accounts, and limits on repeated attempts at sensitive actions
- CAPTCHA checks on sign-up, sign-in, password reset and forms that use them
- protections against the service being used to reach private networks when sending data to other systems
- access to customer accounts limited to a small number of authorised staff, who use it to support customers and run the service, with their access logged and their changes to trials and account notes recorded
No method of transmission or storage is completely secure, so we can’t guarantee the security of your data. If we become aware of a personal data breach, we will act in line with our legal obligations, including notifying the ICO and affected people where required. We will tell customers about breaches affecting their data as our [link to DPA] requires.
You can help by using a strong, unique password, keeping API keys in a secure server-side store, and reviewing who has access to your account.
Your rights
Under data protection law you have these rights over personal data we hold as a controller:
- Access. Ask whether we hold personal data about you and for a copy of it.
- Rectification. Ask us to correct data that is inaccurate or complete data that is incomplete. You can change your name and password in your profile.
- Erasure. Ask us to delete your data in some circumstances, for example where we no longer need it or you have withdrawn consent.
- Restriction. Ask us to limit how we use your data in some circumstances, for example while we check its accuracy.
- Data portability. Ask for data you gave us, where we process it by automated means on the basis of consent or a contract, in a structured, commonly used, machine-readable format, or for us to send it to another organisation where this is technically feasible.
- Object to direct marketing. Object at any time to our use of your data for direct marketing. We will then stop using it for that purpose.
- Object to other processing. Object to our use of your data where we rely on legitimate interests, on grounds relating to your situation. We will stop unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims.
- Withdraw consent. Where we rely on consent, withdraw it at any time.
- Automated decisions. Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects on you. We don’t make such decisions.
To exercise any of these rights, email [privacy contact email]. To stop marketing emails, you can also use the unsubscribe link in any marketing email we send.
We may need to confirm your identity before we act on a request. We will respond without undue delay and within one month of receiving the request. If we need to confirm your identity or ask for information to clarify the request, the month starts when we receive it. If a request is complex, or you have made several requests, we may extend this by up to two further months; we will tell you within the first month and explain why. We don’t usually charge a fee, but we may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive. When you ask for access, we will make a reasonable and proportionate search for your data.
Some rights don’t apply in every situation, and some are subject to exemptions in the Data Protection Act 2018. If we can’t do what you ask, we’ll explain why.
If your request concerns data a customer collected through one of its forms, contact that customer. See our role.
Children
Our website and service are not aimed at children. You must be 18 or over to create a FormWork account. We don’t knowingly collect personal data from children for our own purposes. If you believe a child has given us personal data, contact us and we will take appropriate steps to delete it.
Customers decide who their forms are for. If a customer’s form collects children’s data, the customer is responsible for that data, as described in your responsibilities as a customer.
Changes and how this policy applies
Changes to this policy
We may update this policy from time to time, for example when the service, our providers or the law change. When we do, we will publish the new version on this page and change the “last updated” date. If we make a change that significantly affects how we use account holders’ personal data, we will take reasonable steps to tell account holders in advance, for example by email or in the service. Changes to sub-processors for customer data are notified as our [link to DPA] requires. Please check this page from time to time.
How this policy relates to our contracts
This policy explains how we handle personal data. It describes our practices and the service as at the date below, which may change as the service develops. It is not a contract and does not create contractual rights or obligations for us or for you.
For customer data, our [link to terms] and [link to DPA] with the customer govern our obligations and prevail over this policy if they conflict. Customers’ rights and remedies in relation to the service, including any limits on liability, are set out in our terms.
Nothing in this policy limits or excludes any liability that cannot be limited or excluded by law, or affects your rights under data protection law.
Last updated: 9 October 2026.
Contact us and complaints
If you have a question, or you are unhappy with how we have handled your personal data, please contact us first so we can try to resolve it.
FORMWORK SOFTWARE LIMITED
167-169 Great Portland Street, 5th Floor
London
England
W1W 5PF
Email: [privacy contact email]
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection. Visit ico.org.uk/make-a-complaint or call 0303 123 1113.