Your privacy matters.

01 — Information We Collect

We collect the following types of information when you use WittyForm:

• Account Information — Your name, email address, and password when you create an account.
• Form Data — The forms, quizzes, and surveys you create, along with the responses submitted to them.
• Usage Analytics — Aggregated data about how you interact with our platform to help us improve the experience.
• Optional Maps Data — When a form creator enables Maps features, we process the address text, place IDs, route endpoints, travel mode, and validation or route results needed to provide autocomplete, address verification, location-type rules, and distance pricing.
• Device & Browser Info — Browser type, operating system, IP address, and device identifiers for security and troubleshooting purposes.

02 — How We Use Your Information

We use the information we collect to:

• Deliver our services — Provide, operate, and maintain WittyForm's core functionality including form creation, response collection, and analytics.
• Improve our platform — Analyze usage patterns to enhance features, fix issues, and develop new capabilities.
• Communicate with you — Send transactional emails, product updates, and respond to support inquiries.
• Ensure security — Detect and prevent fraud, abuse, and unauthorized access to protect your account and data.

03 — Data Storage & Security

We take the security of your data seriously and employ industry-standard measures to protect it:

• Encryption in transit — All data is transmitted over TLS 1.3, and stored integration credentials are encrypted with AES-256-GCM.
• Encryption in transit — All data transmitted between your browser and our servers is protected by TLS 1.3.
• Cloud infrastructure — Our services are hosted on secure, enterprise-grade cloud infrastructure with redundancy and failover protections.
• Regular backups — Automated backups every 6 hours, encrypted with AES-256, ensure your data can be recovered in the event of any incident.

04 — Data Sharing & Third Parties

We do not sell your personal data. We share information only with trusted third-party services ("sub-processors") that are necessary to operate and improve WittyForm. Each provider is bound by a data processing agreement.

• Authentication — Clerk manages sign-up, login, and session management. Your email, name, and authentication tokens are shared with Clerk.
• AI generation — OpenAI and Anthropic power our AI form and quiz generation features. Your prompts and form content are sent only when you explicitly use AI features and are not used to train their models.
• Email delivery — Resend powers our transactional emails including notifications, password resets, and form-response alerts.
• Payment processing — Stripe handles all payment transactions. We never store your full credit card details. Shopify manages purchase and license management for our platform.
• User-initiated integrations — When you connect Slack, Google Sheets, or Google Drive, form response data or uploaded files are shared with those services at your direction.
• Google Maps Platform — When a form creator enables Google address, place, validation, route, or distance features, WittyForm sends only the relevant address query, place ID, route endpoints, travel mode, and session information to Google using the workspace owner's configured API key. Google processes that data under the Google Privacy Policy. WittyForm does not send the rest of the form response in these Maps requests. Signed verification, fare, and location-type proof is transient and removed before responses, exports, webhooks, CRM records, or integrations are stored or sent.
• AI chatbot knowledge — Pinecone stores knowledge-base embeddings for our AI chatbot feature. No personally identifiable information is stored—only vector embeddings of your uploaded knowledge-base content.
• Analytics — Google Analytics collects IP address, browser information, and behavior data to help us understand usage patterns. Google Analytics cookies are only loaded after you provide consent.

Complete Sub-Processor List

We will update this list whenever a sub-processor is added or removed and notify affected users at least 14 days in advance.

05 — Your Rights (GDPR)

Under GDPR and other applicable data protection laws, you have the following rights regarding your personal data:

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

06 — Cookie Policy

We use a minimal set of cookies to operate WittyForm. Analytics cookies are only loaded after you provide explicit consent via our cookie banner. For full details, see our Cookie Policy.

• Necessary cookies (always active) — Clerk authentication session cookies are required for sign-in and session management. These cannot be disabled as they are essential for the service to function.
• Analytics cookies (consent required) — Google Analytics cookies are only loaded after you give consent. These cookies collect anonymized usage data such as pages visited, session duration, and browser type. You can withdraw consent at any time.
• No marketing cookies — We do not use advertising pixels, cross-site trackers, or any marketing cookies.
• localStorage for preferences — User interface preferences such as theme selection and sidebar state are stored locally in your browser and are never transmitted to our servers.

07 — Data Retention

We retain your data only for as long as necessary to provide our services and meet legal obligations:

• Active accounts — Your data is retained for as long as your account remains active and in good standing.
• Deleted accounts — When you delete your account, all personal data is permanently purged within 30 days, except where retention is required by law.
• Form responses — Response data is retained until the form owner explicitly deletes it. Respondents can request deletion by contacting the form owner or our support team.

08 — Children's Privacy

WittyForm is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13 years of age. If we become aware that a child under 13 has provided us with personal data, we will take immediate steps to delete that information.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at [email protected] so we can take appropriate action. We comply with the Children's Online Privacy Protection Act (COPPA) and similar international regulations.

09 — International Data Transfers

All of the sub-processors listed above are based in the United States (Shopify also operates in Canada). If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, your personal data is transferred to the US for processing. We ensure these transfers are lawful and secure through the following mechanisms:

• Standard Contractual Clauses (SCCs) — We use the European Commission's approved Standard Contractual Clauses with each sub-processor for transfers outside the European Economic Area.
• EU-US Data Privacy Framework — Where applicable, we rely on our sub-processors' certifications under the EU-US Data Privacy Framework (DPF) as an additional safeguard for transatlantic data transfers.
• Data processing agreements — All third-party processors are bound by data processing agreements that require equivalent levels of data protection and restrict them from using your data for their own purposes.
• Transparency — The full list of countries where your data may be processed is available in our sub-processor table. You may also contact us at any time for additional details.

10 — Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes:

• We will update the "Last updated" date at the top of this page.
• For material changes, we will notify you via email or an in-app notification at least 14 days before the changes take effect.
• Your continued use of WittyForm after the effective date constitutes acceptance of the updated policy.

We encourage you to review this page periodically to stay informed about how we protect your data. This policy is part of our Terms of Service.