Privacy Policy

For creator accounts, billing and our website, FormzoAI decides how data is used and is responsible for it.

For answers to a form, the creator who published the form is responsible for what they ask and what they do with the answers. FormzoAI processes those answers on the creator's behalf, to run the form and give the creator the results. If you answered a form and want your answers changed or deleted, contact the organisation that sent you the form. If you can't reach them, email us and we'll help.

From creators: name, email address and profile picture (from Google sign-in, if used); workspace name, logo and accent colour; the forms you build, including the prompt you typed to create one; team members and invitations; billing details handled by Stripe (we never see or store full card numbers); and API keys, of which we store only a one-way hash.

From respondents: the answers you give, including follow-up replies, the full conversation, files you upload (such as a CV) and text extracted from them, the language you write in, and your email if the form asks for it. We also store an AI-written summary, a translation into the creator's language when needed, and, if the creator set a scoring guide, scores with short reasons.

Technical data: your IP address is used for rate limiting and abuse prevention and is stored only as a keyed one-way hash. We record AI usage (token counts and cost) per form for budgeting. We don't use advertising trackers or sell data.

Respondents are told at the start that they're chatting with an AI assistant. When you answer an open question, the assistant receives the form's purpose, the current question, the replies within that question and a short list of key facts from your earlier answers, so it can react and ask a relevant follow-up. Structured answers such as emails, dates and choices are checked by ordinary code, not the AI.

When a response is submitted, one AI request writes the summary, translations and scores for the creator. Creators can also ask questions across the summaries of their responses. Scores are advice to the creator: FormzoAI doesn't make decisions about respondents, and creators decide what to do with the results.

Our AI provider processes requests to generate replies and doesn't use them to train models. We don't use your forms or answers to train AI models either.

• To run the service: build forms, hold the conversation, save progress, deliver answers to the creator, and send the emails you ask for (sign-in links, continue-later links, response alerts).
• To bill creators and enforce plan limits.
• To keep FormzoAI secure and affordable: bot checks, rate limits and AI spending caps.
• To provide support and tell creators about important changes to their account or the service.

We share data only with the companies that help us run FormzoAI, under contracts that limit them to doing that work for us:

Creators can also send their responses elsewhere themselves, for example to Google Sheets, through webhooks to their own systems, or with our API. Once data leaves FormzoAI that way, the creator's own arrangements apply. We may disclose data if the law requires it, and we'll tell affected creators where we're allowed to.

FormzoAI stores and processes data in the United States. If you're outside the US, your data is transferred there, with safeguards such as standard contractual clauses where the law requires them.

We only use cookies needed for the service to work:

• Sign-in session for creators.
• Draft cookie (fz_anon) so a form you create before signing up can be attached to your new account. It lasts 30 days.
• Resume cookie (fz_r_…) so respondents can come back to a half-finished form on the same device.
• Cloudflare Turnstile may set cookies to tell people from bots.

We don't use advertising or cross-site tracking cookies.

• Responses are kept until the creator deletes them, or for the period the creator sets in their workspace's data retention setting.
• Creators can delete a single respondent's data (answers, conversation and files) at any time. Deleted forms are removed permanently after 24 hours.
• Unfinished conversations are deleted after 30 days, and forms made before sign-up that were never claimed after 30 days.
• When a subscription ends, the creator keeps read and export access for 90 days. We email a warning a week before, then delete the workspace's forms and responses.
• We keep billing records as long as tax and accounting law requires.

Depending on where you live, you may have the right to access, correct, delete or export your data, and to object to or restrict some processing. Creators can do most of this in the app: edit profile and workspace settings, export responses to CSV, delete forms and respondents. For anything else, email privacy@formzo.ai. We'll answer within 30 days.

Respondents should contact the form's creator first, as they control their form's answers. Answers are saved as you go so you can pick up where you left off, which means the creator can see a conversation before it's submitted. Unfinished conversations are deleted after 30 days. You may also complain to your local data protection authority.

Data is encrypted in transit and at rest by our providers. Access is limited to people who need it to run the service. Respondent text is passed to the AI as data, never as instructions, and webhook deliveries are signed. No system is perfectly secure; if a breach affects your data, we'll tell you as the law requires.

FormzoAI isn't meant for children under 16, and creators may not use it to collect data from children without the consent the law requires.

If we change this policy in a way that matters, we'll email creators before it takes effect and update the date above. The Terms of Service explain the rules for using FormzoAI.