Acceptable Use Policy

This Acceptable Use Policy is part of the Onlyform Terms of Service. It applies to everyone who uses Onlyform, which is operated by Webbebo Technologies. Use Onlyform only for lawful purposes, and only collect data you are entitled to collect. Tell respondents who you are, why you are collecting their information and how to contact you. Do not describe a form as anonymous if you can identify the people who answer it.

You must not use Onlyform for:

• Phishing, impersonation, fraud or scams, or to collect other people's passwords, one-time codes, bank login details, wallet seed phrases or private keys.
• Malware, malicious files, unauthorised access to systems, or attacks on Onlyform or anyone else.
• Spam or marketing sent without the permission and unsubscribe options the law requires.
• Illegal content, child sexual abuse material, content that exploits or endangers children, threats, harassment, hate speech or incitement to violence.
• Content that infringes copyright, trademarks or other people's privacy.
• Unlawful sale of personal data, covert surveillance or unlawful discrimination.
• Evading sanctions or export controls.
• Getting around plan limits, access controls, rate limits or payments, or placing an unreasonable load on the service.

Do not collect full card numbers, card security codes or bank passwords in ordinary form fields; use a payment field connected to a supported payment provider instead. If you collect government identity numbers (including Aadhaar), health information, biometric or genetic data, information about criminal offences or other sensitive information, you must have a lawful purpose and legal basis, obtain explicit consent where the law requires it, collect no more than you need and limit who can access it.

Onlyform is not certified for regulated environments such as HIPAA-covered health data or payment card data under PCI DSS. Do not use it for data that the law requires to be kept in such an environment.

If you direct a form at children or knowingly collect children's personal information, you must give the notices and obtain the verifiable parental consent that the law requires before collecting it. A simple checkbox on the form is not enough where the law requires verifiable consent.

If you add analytics, pixels or tag managers to a form, you must inform respondents and obtain consent before the tracking runs where the law requires it. Check the recipients and content of webhooks, email follow-ups, shared reports and integrations before turning them on, and do not use them to share information beyond what respondents were told. Review AI output before you publish it.

If we believe this policy has been broken, we may remove content, disable a form, suspend an account, preserve evidence or report the matter to the authorities. Where it is practical and lawful, we will tell you what we did and why, and you can ask us to review the decision by emailing support@onlyform.com. We may act without notice where people or the service are at risk.

To report a form or account that breaks this policy, email support@onlyform.com with the subject "Abuse report", the form URL and a short description. Do not send us illegal material or another person's sensitive information as evidence. To report a security vulnerability, email support@onlyform.com with the subject "Security" and a short description, and we will arrange a secure way to share details. Please do not access other people's data or disrupt the service while researching.