Privacy Policy
What Onlyform processes, why, who receives it and your choices.
1. Who we are
Onlyform is an online form builder operated by Webbebo Technologies, H946, Phase 4, Ganapathy Maanagar, Coimbatore, Tamil Nadu 641006, India ("Webbebo Technologies", "we", "us"). This Privacy Policy covers onlyform.com, app.onlyform.com, our APIs, our support channels and the forms hosted on our service. You can reach us about privacy at support@onlyform.com.
We act in two roles. For account administration, billing, security and our own communications, we decide how and why personal data is used and are the controller (the Data Fiduciary under Indian law). For the answers and files that respondents submit to a customer's form, the customer that owns the form is the controller and we process that data on its behalf as its processor, under our Data Processing Agreement. If you answered a form built with Onlyform, the form owner's privacy notice explains how it uses your answers.
2. Information we collect
| Category | Information and source | Why we use it |
|---|---|---|
| Account and workspace | Name, email address, optional phone number and profile image, password hash, sign-in provider identifiers, two-factor and passkey settings, workspace membership and roles. Supplied by you, by a colleague who invites you, or by Google or Apple when you use their sign-in | To create and run your account, sign you in securely and manage collaboration |
| Forms and responses | Form content, logic and settings, and the answers, signatures and files that respondents submit | To host forms, collect and display answers, and export results on the customer's instructions |
| Response activity | IP address, browser user agent, device type, approximate country, campaign (UTM) parameters, timestamps, completion time and question-level progress events | To deliver submissions, show the form owner completion analytics, troubleshoot and prevent abuse |
| Billing | Billing name and address, tax details you provide, plan, invoices, payment status and payment processor reference identifiers | To process purchases, keep accounting records and manage subscriptions |
| AI features | Prompts, conversation history, current form content, images you supply and text extracted from attachments you upload | To generate or edit forms and content when you use an AI feature |
| Connected services | Integration account identifiers, access and refresh tokens, configuration and the data you choose to send | To connect the services you authorise and deliver notifications, exports and follow-ups |
| Support and technical records | Messages you send us, sign-in and security events, and error logs | To answer requests, keep the service running and investigate incidents |
What a respondent submits depends on the questions the form owner asks. Public forms, shared reports, exports and integrations can make content visible outside your account, so check who can see them before you share.
3. Payments
Subscription payments are processed by Stripe. You enter card and other payment details directly into Stripe's payment interface. We never receive or store full card numbers or security codes; we keep Stripe's customer and subscription references and the payment results. Stripe also uses payment information for its own fraud prevention and regulatory obligations under the Stripe Privacy Policy.
Cryptocurrency payments are processed by Coinfat. We send Coinfat the invoice amount and a reference linking the payment to your account and plan, and we keep the invoice status and the period purchased. Coinfat and the blockchain networks involved process wallet addresses and transaction identifiers under their own terms. Blockchain transactions are public and permanent, and deleting your Onlyform account cannot erase them. Never send us a wallet seed phrase or private key.
Payments that a customer collects through its own form are transactions between the respondent and that customer. The customer and its chosen payment provider are responsible for that payment data.
4. How we use information and our legal grounds
We use account and billing information to provide the service you sign up for, support you, administer purchases and tell you about security issues and important service changes. We use technical information to keep the service secure, prevent fraud, enforce our Acceptable Use Policy and fix faults. We process customer content only to carry out the customer's instructions, including the integrations and follow-ups it configures.
Where the GDPR or UK GDPR applies, we rely on: performance of our contract with you for account and purchase processing; legal obligation for tax, accounting and compliance records; legitimate interests for security, troubleshooting and running our business, balanced against your rights; and consent for optional cookies and marketing. Under Indian law we process personal data with your consent or for a legitimate use permitted by the Digital Personal Data Protection Act, 2023. You can decline optional information or withdraw consent at any time; if information is needed for a feature you asked for, we will explain what will no longer work.
Accepting our Terms of Service does not mean you consent to marketing. We send marketing email only with your permission, and every marketing email contains an unsubscribe link.
5. AI features
When you use an AI feature, we send the information needed for that request to our AI model provider. This can include your prompt, the form you are editing, the conversation so far, images you supply and text extracted from documents you upload. Our default provider is Anthropic, and some features may use OpenAI. Both are listed in our Service Providers and Sub-processors register.
We do not use your content to train AI models, and our providers process it under API terms that do not permit them to train on it. AI output can be wrong, so review it before you publish or rely on it. Do not enter confidential or sensitive information into an AI feature unless you are entitled to share it.
6. Who receives information
Information is available to the members of your workspace according to their roles, and to the service providers that help us run Onlyform, such as hosting, storage, email delivery, payments and AI. Each is listed in our Service Providers and Sub-processors register.
When you connect Google Sheets, Microsoft services, Slack, Notion, Mailchimp, Zapier, a webhook or another integration, the data you select is sent to that destination on your instructions. Disconnecting an integration stops future transfers but does not delete copies already delivered; the receiving service's own terms govern those copies.
We disclose information when the law requires it, to establish or defend legal claims, or to a successor if our business is reorganised or sold, with notice where required. We do not sell personal information.
7. International transfers
We are based in India, and our providers process data in other countries, including Germany, other European Union countries and the United States. Our backend and database run on Hetzner, files are stored on Cloudflare, and payment and AI providers process data in the countries described in their own terms.
Where personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or the Swiss equivalent, which are incorporated into our Data Processing Agreement, together with the safeguards described in it.
8. How long we keep information
We keep information only as long as we need it for the purposes above, for the customer's instructions and for our legal obligations.
| Information | How long we keep it |
|---|---|
| Account and workspace information | For as long as the account is open, then deleted when the account is closed, except records we must keep by law |
| Forms, responses and files | Until the customer deletes them or closes its account. Forms moved to trash are permanently deleted after 30 days |
| Unfinished uploads | Removed automatically when the upload expires |
| Billing and transaction records | For the period required by Indian tax and accounting law |
| Security and operational logs | For as long as needed to secure and troubleshoot the service, and any period required by law |
| Backups | Overwritten on a rolling schedule; deleted data disappears from backups when they are rotated |
Cancelling a subscription does not delete your account, and deleting a form does not delete the account. To close your account and erase its data, contact support@onlyform.com.
9. Your rights
Depending on where you live, you can ask us to give you access to your personal data or a copy of it, correct it, delete it, restrict or object to its use, port it to another service, or withdraw consent. In the EEA and UK you can object to direct marketing at any time and complain to your data protection authority. In India you can ask for a summary of the processing, correction and erasure, grievance redressal, and nominate another person to exercise your rights. In US states with privacy laws you may have rights to know, access, correct and delete data, to opt out of sale, targeted advertising or profiling, and to appeal our decision.
To exercise a right, follow the steps in Data Rights and Requests or email support@onlyform.com. We may need to verify your identity first. We respond within 30 days, and we never charge you or treat you differently for exercising a right. If you answered a customer's form, contact that customer first; we will help it respond.
11. Children
Onlyform is not directed at children, and a person who does not have legal capacity to enter a contract may only open an account with the consent of a parent or guardian. Customers who direct forms at children, or collect children's data, must provide the notices and obtain the verifiable parental consent that applicable law requires before collecting it. If you believe a child's information has been submitted to us without proper consent, email support@onlyform.com with the form URL and we will investigate.
12. Security
We protect information with encryption in transit (TLS), hashed passwords, HttpOnly session cookies, optional two-factor authentication and passkeys, role-based workspace access, and access for our personnel only when needed for support, security or legal reasons. Files stored with Cloudflare R2 are encrypted at rest. No system is completely secure; if a breach affects your personal data, we will notify you and the relevant authorities as the law requires.
13. Changes to this policy
We update this policy when our practices or the law change. The date at the top of this page shows when it last changed. If a change materially affects you, we will tell you by email or in the dashboard before it takes effect.
14. Contact and grievances
Email support@onlyform.com with any question about this policy or how we handle your data.
For a grievance under Indian law, email support@onlyform.com with the subject "Grievance". We acknowledge grievances within 24 hours and resolve them within 15 days.