Legal

Privacy Policy

Last updated: September 18, 2026

1. Data We Process

  • Account & Profile Data: Email addresses and basic profile details managed via Clerk to authenticate accounts, verify early access eligibility, and deliver transactional notifications (e.g., approval notices, invoices).
  • Form Submission Payloads: Responses collected through your forms are stored in secure managed database storage with spam classification. Data is accessible solely to the verified form owner via dashboard views, CSV/Excel export, or direct API routes.
  • Quota Analytics: Aggregated usage counts (active forms created, monthly submissions ingested) strictly to track billing quota limits. We do not load third-party ad trackers on hosted forms.

2. Cookies & Local Session State

  • Authentication (__clerk_*): Secure, httpOnly session cookies essential for maintaining authenticated dashboard access.
  • Referral Attribution (fc_ref): A 30-day lightweight cookie used solely to attribute waitlist referral signups for submission bonus credits.
  • Payment Gateways: Razorpay may initialize transient session state during checkout to process INR and USD card, UPI, or netbanking transactions. We do not store raw payment card data on our servers.

3. Google Workspace API Usage

  • What data we access: We access specific Google Sheets spreadsheets that you explicitly select using the Google Picker. We only request the minimum required non-sensitive scope (drive.file) which restricts our access exclusively to files you create with or select for Forms Chroma. We do not have access to your entire Google Drive.
  • How we use your data: The accessed Google Sheets are used strictly as a destination for your form submissions. When a user submits a form on our platform, we append their responses as a new row to the specific spreadsheet you selected. We do not read or use your spreadsheet data for any other purpose.
  • Data protection mechanisms: Your Google OAuth tokens are encrypted at rest using AES-256 and stored securely in our managed database. Tokens are transmitted exclusively over secure HTTPS/TLS protocols. We do not share your Google data with any third-party services, AI models, or advertising networks. You can revoke access at any time from your Google Account settings or by disconnecting within our dashboard.

4. Integrations & Data Sharing

We do not sell, rent, or monetize personal data. Form submission payloads are dispatched only to endpoints explicitly configured by the form creator (e.g., Google Sheets, webhooks, Discord, Telegram, or outbound email relays). Data is retained until you delete the associated form or request complete account erasure.

5. Data Subject Rights

You may request access to, correction of, or permanent deletion of your account and form submissions at any time by contacting [email protected].
Operational Address: Mumbai, Maharashtra, India — 400081.