Privacy Policy

1. Who operates Formless

Formless is a software product developed by SquadVertex. In this policy, “Formless,” “we,” “us,” and “our” refer to the team operating the Formless service. This policy applies to formless.online and the Formless features made available through it.

2. Information we collect

• Account and sign-in information: Information associated with your account, such as your email address, name, authentication identifiers, and sign-in status. If you choose Google sign-in, Google and our authentication provider process information needed to complete the sign-in flow.
• Workspace and restaurant information: Details you enter to configure a workspace or restaurant, such as its name, menu, products, prices, images, settings, and staff or operational information.
• Forms, responses, and uploaded files: Form questions, configuration, responses, contact details, and files submitted by you or by people responding to a form. The content depends on what the form creator chooses to request.
• Subscription and transaction information: Plan, subscription status, billing events, payment status, and payment references needed to manage a subscription. Payments are handled through Razorpay where that payment flow is used. We do not intend to collect or store your full card number, CVV, or banking credentials in Formless form fields or our application database.
• Technical and usage information: Information that may be made available through hosting, security, authentication, and analytics services, such as browser/device details, pages visited, timestamps, error diagnostics, request metadata, and network information. Vercel Analytics is used for website usage insights. Hosting or security logs may process IP addresses as part of operating and protecting the service.
• Messages to us: Information you submit when you contact us for support, feedback, or other enquiries.

3. How we use information

We use information as reasonably necessary to:

• create and secure accounts and authenticate users;
• provide form creation, hosting, responses, uploads, and restaurant features;
• process subscriptions and reconcile payment or billing events;
• respond to support requests and communicate service information;
• diagnose errors, prevent abuse, maintain security, and improve reliability;
• meet applicable legal obligations and resolve disputes.

We do not sell personal information or form responses to data brokers or third-party advertisers. We may use service providers to operate Formless as described below.

4. Form creators and respondent data

When you answer a form, the person or organisation that created it decides what information to request and how to use the response. Contact that form creator for questions about their purpose for collecting the information, their disclosures, or their own retention practices. Form creators are responsible for providing any notices and obtaining any permissions required for the forms they publish.

We host and process form content to provide the service and may also process limited technical, security, and operational information for our own service purposes. The respective roles and responsibilities of Formless and a form creator depend on the activity and applicable law; Formless is not necessarily only a processor in every context.

5. Service providers and sharing

We share information only as needed to operate the service, protect users, fulfil your requests, or comply with law. Our current service architecture uses or may use the following providers for relevant features:

• Supabase: authentication, database, and file storage infrastructure.
• Google: sign-in when you choose Google OAuth.
• Vercel: website hosting, deployment infrastructure, analytics, and related operational services.
• Razorpay: payment checkout and subscription processing where billing features are used.

These providers may process information under their own terms and privacy documentation. We may also disclose information when reasonably necessary to comply with law, enforce our terms, protect the service or users, or handle a business reorganisation. We do not make form responses publicly available except as directed by the form creator or needed to deliver the requested feature.

6. Cookies, local storage, and analytics

Formless uses authentication/session mechanisms and may use browser storage, such as local storage, for necessary features including keeping you signed in or preserving an in-progress form draft on your device. Vercel Analytics helps us understand aggregate website usage. Hosting, security, and analytics technologies may process technical information as described in this policy. You can manage or clear browser storage through your browser settings, but some features may then stop working as expected.

7. Storage, security, and international processing

Formless uses third-party infrastructure, including Supabase and Vercel, to store and process information. We use reasonable technical and organisational measures intended to protect information, but no online service or transmission method can be guaranteed to be completely secure. Access to information should be limited to what is needed to operate, support, and protect the service.

Depending on provider configuration, service plans, and infrastructure location, information may be processed in India or another country. Where applicable, we take steps intended to support lawful transfers and processing.

8. Retention and deletion

We retain account, workspace, form, response, and billing information for as long as reasonably necessary to provide the service, maintain security, resolve disputes, meet legal or accounting requirements, and enforce our agreements. Retention periods can differ by information type and by the instructions of the form creator.

You may request access, correction, or deletion of information through our Contact page. We may need to verify your request and may retain certain information where permitted or required by law. Deletion from active systems may not immediately remove every copy from backups or security logs; any such copies are subject to applicable retention cycles and safeguards. If you submitted a response to someone else’s form, contact that form creator as well.

9. Your choices and responsibilities

Depending on your location and applicable law, you may have rights to request access to, correction of, or erasure of personal information, withdraw consent where processing relies on consent, or raise a privacy concern. We will consider and respond to requests as required by applicable law. We may ask for reasonable information to verify identity and protect against unauthorised requests.

Do not use Formless to collect passwords, full payment-card details, government identity numbers, sensitive personal information, or data about children unless you have a lawful basis, any required notices and permissions, and suitable safeguards. Form creators must ensure that the content and collection practices of their forms comply with applicable law.

10. Children’s information

Formless is not designed for children to create platform accounts on their own. Form creators must not collect children’s personal data unless the collection is permitted by applicable law and any required parental consent or other safeguards are in place. If you believe children’s information has been submitted improperly, contact us so we can review the request.

11. Changes to this policy

We may update this policy as Formless changes or legal requirements evolve. We will update the “Last updated” date when changes are made. Where required by law, we will provide additional notice or obtain consent for material changes.

12. Contact us

For privacy questions, access or deletion requests, or concerns about this policy, contact us through the Formless Contact page. Please describe your request clearly and avoid including passwords, payment credentials, or other unnecessary sensitive information.