Privacy Policy

1. Information We Collect

Account Information

When you create an account, we collect your name, email address, and authentication credentials. You may also provide a profile picture, workspace details, and other optional information.

Form & Response Data

We store the forms you build (structure, questions, logic, and settings) and the responses you receive. Responses may include personal data, uploaded files, signatures, and recorded audio or video, depending on how you design your forms. You are the controller of the response data you collect from your respondents; we process it on your behalf.

Contacts (CRM)

When a respondent provides an email address or phone number, the Service may create or update a Contact record in your workspace, including the submissions, bookings, emails, tasks, and activity associated with that person, so you can manage your relationships.

Bookings & Calendar Data

If you use bookings, we store appointment details (event type, time, host, and the linked response and contact). If you connect Google Calendar, we process the calendar data described in Section 3.

Payment & Order Information

When you subscribe to a paid plan, our payment processor collects and processes your billing information; we do not store full card numbers. When you sell products or collect payments through your forms, those payments are processed through your own Stripe or PayPal account. We store order metadata (items, amounts, status) but never receive or store your customers' full card details.

Connected Accounts

When you connect a third-party account (such as Google, Airtable, Slack, HubSpot, or Mailchimp), we store the access tokens needed to provide the integration. These tokens are encrypted at rest. We access only the data required for the feature you enabled, as described in Section 3.

Usage Data

We collect information about how the Service is used, including pages visited, features used, IP address, browser and device information, and referral sources, to operate and improve the Service.

2. How We Use Information

We use the information we collect to:

• Provide, operate, and maintain the Service and its features
• Build your CRM, process bookings, and handle payments and product delivery you configure
• Send autoresponders, notifications, and reminders that you set up
• Process subscription transactions and send related communications
• Send you updates, security alerts, and support messages
• Respond to inquiries and provide customer support
• Analyze usage to improve the Service
• Detect, prevent, and address technical issues, abuse, or fraud
• Comply with legal obligations and enforce our terms

We do not sell your personal information, and we do not use the content of your connected Google accounts to serve advertising or to train generalized artificial-intelligence or machine-learning models.

3. Google User Data & Google API Services Limited Use

Some Crispforms features rely on Google APIs and require your explicit authorization through Google's OAuth consent screen. You choose whether to connect a Google account, you see exactly which permissions are requested, and you can disconnect at any time. We request the narrowest scopes needed for each feature.

Send email from your Gmail

If you connect Gmail, we use the Gmail "send" permission so that the autoresponders, team notifications, and reminders you configure are delivered from your own email address instead of a generic Crispforms address. We use this access only to send the emails you have set up. We do not read, scan, index, store, or analyze your inbox or existing messages, and we do not use Gmail access for any purpose other than sending the messages you configure. If sending from Gmail ever fails, we fall back to our own delivery so your workflow is not interrupted.

Google Calendar for bookings

If you connect Google Calendar, we access your calendar's free/busy availability so that booking forms only offer times when you are genuinely free, and we create, update, or cancel the specific events that result from confirmed bookings. We access only the calendar data necessary to provide scheduling; we do not read unrelated event details for any other purpose, and we do not sell or share this data.

Google Sheets & Drive

If you enable the Google Sheets integration, we use an app-scoped permission (the ability to create and manage only the files the app creates). Crispforms creates a spreadsheet in your Drive and appends a row for each submission based on the field mapping you define. We do not access other files in your Drive.

Limited Use Disclosure

Crispforms' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, with respect to data obtained from Google APIs, we affirm that we:

• Only use the access to provide or improve the user-facing features that are prominent in the requesting experience;
• Do not transfer or sell this data for serving advertisements, including retargeting, personalized, or interest-based advertising;
• Do not use or transfer this data to determine creditworthiness or for lending purposes;
• Do not allow humans to read this data unless we first obtain your affirmative consent for specific messages, it is necessary for security purposes (such as investigating abuse) or to comply with applicable law, or the data has been aggregated and anonymized; and
• Do not use this data to develop, improve, or train generalized or non-personalized artificial-intelligence or machine-learning models.

Revoking access

You can disconnect any Google connection from within Crispforms at any time, or revoke access directly from your Google Account permissions page. Revoking access stops further use and deletes the stored tokens.

4. Cookies

We use cookies and similar technologies to keep you logged in, remember your preferences, and understand how the Service is used. You can control cookies through your browser settings; disabling them may limit some features.

5. Other Third-Party Services

In addition to the Google services above, we rely on trusted providers that may process data on our behalf or at your direction:

Stripe & PayPal

Used to process subscription payments and the payments you collect through your forms. Their privacy policies apply: stripe.com/privacy and paypal.com/privacy.

Google Analytics

Used to understand how visitors use our marketing website. You can opt out using the Google Analytics Opt-out Browser Add-on.

Integrations you enable

When you connect services such as Airtable, Slack, Discord, Microsoft Teams, Zapier, Make.com, HubSpot, or Mailchimp, or configure a webhook, we send the data you map to those destinations at your direction. Each provider's own privacy policy governs its handling of that data.

6. How We Share Information

We do not sell your personal information. We share data only with: service providers who process it on our behalf under appropriate confidentiality and security obligations; destinations you explicitly connect or direct (such as your integrations); and authorities where required by law or to protect rights, safety, and security. Your workspace data is isolated and accessible only to your team and the integrations you authorize.

7. Data Security

We implement technical and organizational measures to protect your data, including encryption in transit (TLS), strict workspace isolation enforced on every request, and authenticated AES-256-GCM encryption at rest for sensitive secrets such as connected Google tokens and payment keys. No method of transmission or storage is completely secure, but we are committed to protecting your information and continually improving our safeguards.

8. Data Retention

We retain your account, form, response, and contact data for as long as your account is active. We use soft deletes so data can be recovered for a limited window, after which it is removed. You can export or request deletion of your data at any time. If you delete your account, we delete or anonymize your personal data within a reasonable period, except where retention is required by law. Connected-account tokens are deleted when you disconnect the integration.

9. Your Rights

GDPR (European Union / UK)

If you are in the European Economic Area or the UK, you have the right to access, correct, erase, restrict, or port your personal data, to object to processing, and to withdraw consent. You may also lodge a complaint with your local data protection authority. To exercise these rights, contact us at ady@crispforms.com.

CCPA (California)

California residents have the right to know what personal information is collected, to request deletion, to opt out of the sale of personal information (we do not sell personal information), and to non-discrimination for exercising these rights. To exercise these rights, contact us at ady@crispforms.com.

We respond to verifiable requests within the timeframes required by applicable law.

10. International Data Transfers

We may process and store information in countries other than your own. Where we transfer personal data across borders, we use appropriate safeguards consistent with applicable law.

11. Children's Privacy

The Service is not intended for children under 16. We do not knowingly collect personal information from children under 16. If you believe we have inadvertently collected such information, contact us at ady@crispforms.com and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Information

If you have questions about this Privacy Policy or our data practices, contact us at:

Email: ady@crispforms.com

Website: crispforms.com

Application: form.crispforms.com