Privacy Policy

Two roles: form owners and respondents

If you have a Formlark account, we decide how your account data is handled — for that data, we are the controller and this policy is the full story.

If you filled out a form built with Formlark, the person or organization that created the form (the form owner) controls the answers you submitted. We process form responses on the owner's behalf. Requests about your answers — access, correction, or deletion — go to the form owner, and we give owners the tools to honor them.

What we collect

• Account data. Your name, email address, and password. Passwords are stored only as a cryptographic hash — we never keep or see the password itself.
• Forms you build. The questions, logic, settings, and design of your forms.
• Form responses. Answers submitted to forms, including partial submissions — answers typed into a form are saved as the respondent goes, even if they never press submit.
• Uploaded files. Files respondents attach through a form, stored in Amazon S3.
• Usage analytics. Anonymous, cookieless events such as page views and form views, starts, and completions. We use no advertising trackers and no third-party analytics.
• IP addresses. Processed to rate-limit abuse and block spam. We do not store raw IP addresses; analytics use a truncated hash that rotates daily.

How we use it

• To run the service: hosting your forms, collecting responses, showing you analytics.
• To send email: notifications to form owners about new responses, and — on the Pro plan — an auto-reply the form owner configures, sent to the respondent. Our email system only sends; we never receive or scan mail on your behalf.
• To defend against spam and abuse.
• To understand product usage in aggregate and improve Formlark.

We do not sell personal data, and we do not show ads.

Cookies

We set one cookie: a session cookie that keeps you signed in to your account. There are no tracking cookies and no third-party cookies. If you only fill out a form and never sign in, we set no cookies at all.

Where your data lives

Formlark runs on Amazon Web Services (AWS) in the Seoul region (ap-northeast-2): the database on RDS, uploaded files on S3, and outgoing email through SES. AWS is our subprocessor. Because hosting is in South Korea, using Formlark from elsewhere means your data is transferred to and processed in South Korea.

Webhooks

Form owners can configure webhooks that send response data to endpoints they choose. Once delivered, that data is governed by the receiving service — choosing trustworthy endpoints is the form owner's responsibility.

Payments

Checkout and billing are handled by our payment partner, a merchant of record. Your card details go directly to them and never touch our servers — we receive only what is needed to activate your plan.

Retention and deletion

• Your whole account. Delete it yourself anytime from settings. This permanently removes your forms, responses, and uploaded files immediately; residual copies in backups are purged within 30 days.
• Individual responses. Form owners can delete single responses or all responses of a form at any time.

Your rights

You can access, correct, delete, and export your data. Form owners can export responses as CSV and manage account data directly in the product; for anything the product doesn't cover, email us and we'll help.

If you are a respondent, the form owner controls your answers — send requests to them first. If you can't reach the owner, contact us and we'll assist within our role as processor.

Children

Formlark is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

Changes to this policy

When this policy changes, we update it here along with the date at the top. For material changes, we notify account holders by email.

Contact

Questions about privacy — or about our Terms of Service — go to support@formlark.clomia.com.