Privacy Policy

1. Who We Are

Upperforms Inc. ("Upperforms", "we", "us") operates the Upperforms form builder platform available at upperforms.com and via our mobile applications. This Privacy Policy explains how we handle personal data in compliance with the GDPR (EU), CCPA (California), Colombia's Ley 1581 de 2012, and Brazil's LGPD.

2. Data We Collect

2.1 Account data

When you create an account: name, email address, and profile picture (via Google OAuth). We do not store your Google password.

2.2 Form data

Forms and fields you create are stored in our database. This includes form titles, questions, settings, and themes.

2.3 Response data

When respondents submit your forms, we store the answers, submission timestamp, and basic technical metadata (device type, approximate country). We do not collect respondents' IP addresses by default.

2.4 Usage data

We collect anonymized analytics about how you use the platform (pages visited, features used, session duration) to improve the Service.

3. How We Use Your Data

• To provide, operate, and improve the Service
• To authenticate your account and ensure security
• To send transactional emails (form response notifications, account alerts)
• To comply with legal obligations

We do not sell your personal data. We do not use your data for advertising.

4. Data Sharing

We share data only with:

• Supabase — our database and authentication provider (data processed in the EU)
• Vercel — our web hosting provider (US, with EU data processing agreements)
• Legal authorities — when required by applicable law

5. Data Retention

We retain your account data for as long as your account is active. Form data and responses are retained until you delete them or close your account. Upon account deletion, all your data is permanently removed within 30 days.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data (see our Data Deletion page)
• Object to or restrict processing
• Data portability (export your forms and responses as CSV)
• Withdraw consent at any time

7. Cookies

We use cookies and similar technologies as described in our Cookie Policy.

8. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

9. International Transfers

Your data may be transferred to and processed in countries other than your own. We ensure adequate protection through standard contractual clauses and equivalent safeguards.

10. Contact & DPO

For privacy-related requests or questions, contact us at privacy@upperforms.com. We will respond within 30 days.