Privacy Policy

1. Information We Collect

We collect information to deliver reliable form ingestion and billing services:

• Account Information: Name, work email address, company/project name, and encrypted password credentials when registering an account.
• Form Submission Payloads: Form data submitted by website visitors (e.g. names, inquiry messages, email addresses, uploaded attachments) according to the schema configured by the account owner.
• Telemetry & Security Logs: Request timestamps, HTTP method, client IP address (for rate limiting and bot mitigation), and CORS request origin headers.
• Billing & Transaction Details: Customer name, billing email, phone number, and transaction identifiers.

2. Payment Processing & Zero Card Storage

Zero Card Data Storage Guarantee: FormLynk NEVER collects, processes, or stores your raw credit/debit card numbers, CVVs, expiry dates, netbanking passwords, or UPI PINs on its servers.

All online payments for subscription upgrades are securely handled by our PCI-DSS compliant payment gateway partner, Razorpay Software Private Limited. Razorpay handles payment authorization under bank-grade tokenization and SSL/TLS encryption.

3. How We Use Collected Data

Collected data is used strictly for operational purposes:

• Ingesting form submissions and delivering email notifications via background queue workers.
• Executing spam mitigation (honeypot field verification and Cloudflare Turnstile).
• Authenticating API keys against whitelisted origin domains.
• Providing submission history, analytics, and CSV exports in your Admin Portal.
• Generating tax-compliant invoices and managing subscription statuses.
• Delivering vital system notifications, account security alerts, and technical support.

4. Data Retention & Deletion

Form submissions and uploaded attachments are retained based on your active plan tier:

• Hobby (Free): 30 days retention.
• Developer (Pro): 90 days retention.
• Agency (Business): 365 days retention.
• Enterprise: Custom retention window or zero-retention ephemeral pass-through mode.

You can manually delete individual submissions, purge forms, or delete your entire account and associated data directly through your dashboard at any time.

5. Cookies & Local Storage

FormLynk uses essential browser cookies and local storage exclusively for session authentication, security CSRF validation, and UI preferences (e.g. theme, active currency toggle). We do not use intrusive third-party cross-site advertising trackers.

6. Data Sharing & Third-Party Subprocessors

We do not sell, rent, or trade your personal or customer data. We share data only with verified subprocessors necessary to deliver our services:

• Payment Partner: Razorpay (for secure Indian and international payment processing).
• Transactional Mail Relays: Dedicated or shared SMTP relays (e.g. SendGrid, Postmark, AWS SES) for delivering notification emails.
• Cloud Infrastructure: Managed cloud database clusters with AES-256 encryption at rest.

7. Indian Legal Compliance & Grievance Redressal

This Privacy Policy is formulated in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act (DPDP Act).