Draft. The highlighted details aren’t filled in yet, and these documents need a lawyer’s review before EscForms takes real customers.
Privacy Policy
What personal data EscForms handles, why, how long we keep it, and what you can do about it. We don’t sell personal data, and this site runs no advertising or analytics.
Who is responsible for your data
It depends on how we came to hold it.
- If you have a EscForms account or you tried the delivery test, EscForms decides how your data is used and is responsible for it (the “controller” or “data fiduciary”).
- If you filled in a form on someone else’s website and that form uses EscForms, the website’s owner is responsible for your data, and we handle it on their instructions (as a “processor”). Contact that business first about your information. If you can’t reach them, we’ll help where we can.
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Your name, agency name, email and a scrambled form of your password | To run your account | Contract |
| If you sign in with Google or GitHub: the name, email address and account ID that service shares with us. We never see your password there, or anything else in that account | To create your account and sign you in | Contract |
| If you add a passkey: its public key, a label such as “Chrome on Windows”, and when it was added and last used. Your fingerprint, face or PIN stays on your device and never reaches us | To sign you in | Contract |
| A one-way hash of a random value for each browser you’ve confirmed with an email code | To protect your account if your password is stolen, without asking for a code every time | Legitimate interests |
| Your plan, Dodo Payments customer reference and payment records. Dodo Payments holds your card details, not us | To take payment and keep tax records | Contract, legal obligation |
| When you accepted our terms, and which version | To show what was agreed | Legitimate interests, legal obligation |
| The email you type into the delivery test on our home page | To send the one test email you asked for. The address isn’t saved | Your request |
| Everything submitted through a customer’s form, the time it arrived, and a shortened IP address | To store, filter and forward it for our customer | Our customer’s instructions |
| Your full IP address, briefly and in memory only | To limit abuse and keep the service secure | Legitimate interests |
We shorten IP addresses before storing them (203.0.113.42 becomes 203.0.113.0). We don’t use your data to make automated decisions that have legal effects on you. Our spam check does decide automatically whether a submission looks like a bot, and our customers can review everything it quarantined.
Who at EscForms can see your account
To run the service and support you, the founder has a dashboard showing your name, agency name, email, plan, signup date, whether you chose product updates, and how many forms and leads you have. It can also find an account by form name or endpoint ID. It doesn’t show your leads, password or sign-in tokens. Opening it takes a separate email code, and each unlock, export and plan change is logged. Those logs are kept for 2 years.
Product updates
We only send product updates if you tick the box at signup or turn them on under Your data in your dashboard, and you can turn them off there at any time. Account, security and billing emails aren’t affected.
Who we share it with
Only the companies that help run the service, listed on our Subprocessors page, and only as far as they need it. A customer’s form may also send leads to Discord or Slack if the customer has connected them. We’d disclose data to authorities only where the law requires it.
International transfers
Our providers may process data outside your country, including in the United States. Where the law requires a safeguard for that, we rely on measures such as the European Commission’s Standard Contractual Clauses.
How long we keep it
| Data | Kept for |
|---|---|
| Leads | 12 months, or until the customer deletes them. Each form keeps its most recent 50,000 |
| Quarantined submissions | 30 days. Each form keeps its most recent 500 |
| Your account and forms | Until you delete your account, which erases them immediately |
| Signups that never confirmed their email | Up to 7 days, then deleted |
| Login sessions | 30 days after your last visit to the dashboard, or until you sign out. If you untick “Keep me signed in”, up to 24 hours and only until you close the browser |
| Remembered browsers | 180 days after your last sign-in on that browser, or until you sign out everywhere else or change your password |
| Passkeys | Until you remove them or delete your account |
| Email sign-in codes | 10 minutes at most, as a one-way hash in memory, and never written to disk |
| Password reset links | 1 hour, or until used |
| Delivery test address | Not stored. A one-way fingerprint stays in memory for up to an hour, to stop one address being flooded |
| Payment and tax records | As long as tax and accounting law requires, even after an account closes |
Backups are kept for up to 14 days, so deleted data can remain in them for that long before it’s gone for good. Our email and payment providers keep their own records under their own policies.
How we protect it
Passwords are stored as salted scrypt hashes, and login sessions and remembered browsers as one-way hashes, so none can be read from our data. A new browser must confirm a code sent to your email, even with the right password. Connections use HTTPS, each account can only reach its own data, and we limit repeated attempts. No system is perfectly secure. If a breach is likely to put you at risk, we’ll tell you and the relevant authorities as the law requires.
Your rights
You can do most of this yourself in your dashboard’s Settings, without asking anyone:
- See and download your data: Settings, Export my data.
- Correct it: Settings, Profile.
- Delete it: Settings, Delete account.
Depending on where you live, the law gives you further rights. For anything else, write to privacy@escforms.com. We’ll reply within one month, and we won’t treat you differently for asking.
- EU, EEA and UK: you can also restrict or object to how we use your data, and withdraw consent where we rely on it. You can complain to your local data protection authority, which in the UK is the ICO.
- India: under the Digital Personal Data Protection Act, 2023 you can access, correct and erase your data, have your grievances heard, and nominate someone to act for you. Our Grievance Officer is [grievance officer name], reachable at privacy@escforms.com. We acknowledge complaints within 24 hours and aim to resolve them within 15 days. You may then go to the Data Protection Board of India.
- California and other US states: you can know, delete and correct your data. We don’t sell personal data or share it for targeted advertising.
Cookies
We set two, both only when you sign in: one keeps you signed in, and one remembers a browser you’ve confirmed. There’s more on our Cookies page.
Children
EscForms is for businesses and isn’t meant for anyone under 18. We don’t knowingly collect data from children.
Changes
If we change this policy in a significant way, we’ll email account holders before it takes effect and update the version above.
Contact
EscForms, [registered business address], INDIA. Email privacy@escforms.com.