What data Formif processes, for what purpose, on what legal basis, and for how long.
Last updated: October 1, 2026
Formif is responsible for the personal data described in this notice. For anything in it, write to info@formif.com. When you use Formif to run your own work, you decide what goes into your forms. For that data you are the controller and we are your processor — the Data Processing Agreement covers that relationship. This notice covers the data we handle as controller: your account, your use of the site, and your contact with us.
Account data: name, email address, the workspace and company you belong to, your role, and authentication details. If you sign in with Google, Microsoft or Apple we receive your name and email from them, never your password. Billing data: plan, seat count, invoices and payment status. Card details never reach Formif — Stripe and Mollie process them. Usage data: pages and features opened, requests to our API, device and browser type, IP address, and error reports. Retained to operate the service and identify technical issues. Contact data: whatever you send us by email or through the contact form.
To provide the service and honour our contract with you — account, workspaces, permissions, storage, invoicing (GDPR Art. 6(1)(b)). To keep the service secure and working: audit logs, rate limits, abuse prevention, backups (Art. 6(1)(f), our legitimate interest in a service that stays up and is not abused). To meet legal duties, mainly tax and accounting retention (Art. 6(1)(c)). To answer you when you get in touch (Art. 6(1)(b) and (f)). We do not sell personal data and we do not use your form content to train models.
Our processors, each bound by contract and only for what we ask them to do: Vercel for hosting the site and the app, Supabase for the database and file storage, Stripe and Mollie for payments, Microsoft 365 for transactional mail, and Vercel Web Analytics and Speed Insights for aggregate, cookieless usage and performance measurement. If you connect SharePoint, OneDrive, Google Drive, Dropbox or your own WebDAV server, files go where you point them and that provider is yours, not ours. We disclose data to authorities only where the law requires it.
Formif runs on servers in the European Union. Where a processor operates outside the EEA, the transfer is covered by the European Commission’s Standard Contractual Clauses or an adequacy decision. You can also choose to keep your files on your own storage, in which case they never sit on our infrastructure at all.
Account and workspace data for as long as the account is open, and up to 30 days after it closes so it can be restored if the closure was a mistake. Invoices and accounting records for the period tax law requires, currently ten years under Turkish commercial and tax law. Audit and request logs for 90 days. Backups roll over on a seven-day cycle.
You can ask for a copy of your data, ask us to correct or delete it, ask us to restrict or stop a particular use, and ask for it in a portable format. Where we rely on legitimate interest you can object. Where you gave consent you can withdraw it, without affecting what we did before. Write to info@formif.com and we will answer within one month. If you are not satisfied you can complain to your national data protection authority — in the Netherlands the Autoriteit Persoonsgegevens, in Türkiye the KVKK.
When this notice changes materially we will say so in the app and update the date at the top of this page before the change takes effect.