Privacy policy

Formelia is a platform for creating forms, sharing them and analyzing their responses. This policy covers the personal data handled when using formelia.io, the application and the forms published with Formelia.

For any privacy matter — including the identification details and domicile of Formelia's operator — you can write to privacy@formelia.io. It is answered by people, not a decorative inbox.

One distinction matters to understand this policy. When you create a Formelia account, we decide how your registration and usage data is handled: there, we are the data controller. When someone answers a form you created, the party deciding what is asked and why is the form creator: there, the creator is the controller and Formelia acts as a data processor, handling responses under the creator's instructions.

If your organization needs a data processing agreement (DPA), request it by writing to privacy@formelia.io.

• Account: name, email address, password (hashed) and, if you sign in with Google, the name, email and avatar Google shares with us.
• Content: the forms you create, their settings, the brand images you upload and the responses you receive.
• Billing: your plan and subscription status. Payment is processed by Polar; Formelia never sees or stores your card numbers.
• Product usage: our own functional events (for example, which dashboard pages you visit or when you publish a form) to operate and improve Formelia. We use no third-party analytics tools.
• Technical data: IP address, browser type and error logs — the minimum needed for security and diagnostics.

This section is for you if you arrived here from a form. The party responsible for that form — what it asks, why, and what happens with your answers — is the person or organization that created it. Formelia processes your answers on their behalf.

• We save your answers progressively while you respond, so you do not lose progress if you close the tab.
• We record technical interaction events (for example, on which question you dropped off) that the creator sees in aggregate statistics.
• If the form requires verification, we ask for your email and send you a one-time code (OTP).
• If the creator limits the form to one response per browser, we use a cookie and a technical identifier to detect duplicates.
• If the form allows file uploads, files are stored securely and are accessible to the creator and, in the limited cases described in this policy, to Formelia and its storage providers.
• If the creator uses AI features on the responses (for example, summaries or insights), they may be processed by our inference providers as described in the artificial intelligence section; they are not used to train models.
• We record minimal technical data (IP address and error logs) for security and diagnostics.

• Providing the service: creating, publishing and processing forms and responses.
• Saving your work automatically and keeping your sessions active.
• Computing statistics for the creator (completion rate, NPS, drop-off), always over their own forms.
• Sending transactional email: verification, OTP codes, account and billing notices.
• Protecting the platform: preventing fraud, abuse and unauthorized access.
• Complying with legal obligations where they apply.

We do not sell personal data, we do not rent it, and we do not use it for advertising. We do not send third-party commercial email either.

Where the law requires a legal basis (such as the GDPR), we rely on: performance of the contract (providing you the service), our legitimate interest (security, abuse prevention and product improvement with our own events), your consent (for example, signing in with Google) and compliance with legal obligations.

Some Formelia features use AI models: generating a form draft from your description or summarizing responses into insights. When you use them, we send the AI provider only the content needed to produce the result (your instruction and, for insights, the responses of the form you are analyzing).

• We work with inference providers (currently Cerebras and OpenAI) that, under their terms, do not use your content to train their models and may only process it to provide the service, including limited temporary retention for security and abuse prevention.
• Formelia does not use your content to train AI models.
• AI features are optional: if you do not use them, your content is not sent to these providers.
• We meter AI credit consumption per organization to apply your plan.

We only use cookies that are essential for the service to work. There are no advertising cookies and no third-party tracking cookies.

We share data only with the providers we need to run Formelia (subprocessors), under contracts that limit their use to providing us the service. We will keep this list up to date on this page and, if you have a DPA with us, we will notify you of subprocessor changes with reasonable notice so you can object on legitimate grounds:

Beyond these providers, we would only disclose data if required by law or a valid order from an authority, or to protect the rights, safety or integrity of the service. If Formelia were part of a merger or acquisition, data could transfer as part of that transaction; we would notify you before any different policy applies.

Our providers operate mainly in the United States and the European Union. When data moves across borders, we rely on the safeguards these providers offer (such as standard contractual clauses) so it travels with equivalent protection.

• Account data: for as long as your account exists.
• Forms and responses: for as long as you keep them in your account. On the Free plan — including moving to Free from a paid plan — responses stop being accessible 90 days after receipt and are permanently deleted shortly after; on paid plans they are kept while the subscription is active.
• Temporary cached data (drafts, response progress, OTP codes): deleted automatically within short periods defined by their function.
• Technical and security logs: limited periods, only for diagnostics and protection.
• If your account ends, we keep your content for the 30-day export window described in the Terms and delete it afterwards.
• If you delete content or your account, it disappears from active systems and backups purge it within their rotation cycles (up to 35 additional days).

• Encryption in transit (TLS) on every connection, and encryption at rest for the database and storage.
• Multi-tenant isolation at the database level: each organization can only access its own data.
• Restricted, logged internal access; passwords are stored hashed, never in plain text.

No system is infallible. If a security incident affecting personal data occurred, we would notify without undue delay — you as the account holder or, where we act as processor, the creator responsible for the form — together with the measures taken, and we would meet the notification deadlines required by applicable law.

You have the right to access your data, correct it, export it, delete it, and to object to or restrict certain processing. Many of these actions are available directly in the app: you can edit your profile and export your form responses at any time.

For everything else — including full account deletion — write to privacy@formelia.io from your account email. We respond within 30 days; if the request is complex we may extend this, notifying you within that period and never beyond the legal maximums. If you believe we did not handle your request properly, you have the right to complain to your country's data protection authority.

Formelia is not directed at children under 16 and they may not create accounts. If a creator directs forms at minors, it is their responsibility to comply with applicable laws (including parental or guardian consent). If you believe we collected a minor's data without proper authorization, write to us: we will delete it or, where we act as processor, coordinate its deletion with the responsible creator.

If we make material changes, we will notify you by email or in the app at least 30 days before they take effect. The date of the latest revision always appears at the top of this page. This policy is published in Spanish and English; in case of conflict between versions, the Spanish version prevails.

For any privacy question or to exercise your rights: privacy@formelia.io.