Privacy policy

Controller

Philipp Staudt IT-Dienstleistungen, Ursulinenstraße 40, 66111 Saarbrücken, Germany, hello@formfeed.dev is the controller for this website and the Formfeed service.

This website

The site and the documentation (docs.formfeed.dev) are static, set no cookies, and no third-party script runs on them. Our host, Cloudflare (Cloudflare Germany GmbH / Cloudflare, Inc.), processes connection data such as IP address and user agent to deliver the pages and to defend against attacks (Art. 6 (1) f GDPR).

For usage statistics we run Umami ourselves, on a server we rent from IONOS SE in Germany; its script is served from formfeed.dev. When you open a page, click through to the app, download an example or use one of the tools, it records the page, the referring website, browser, operating system, device type, screen size, language and the country derived from your IP address; for a click through to the app, also which of the page’s buttons it was. It sets no cookie, stores nothing in your browser and does not store your IP address, and we use the statistics only to see which pages are read and which lead to sign-ups (Art. 6 (1) f GDPR). This needs no consent.

With your consent (Art. 6 (1) a GDPR, § 25 (1) TDDDG) your browser stores two things locally, which you can refuse or withdraw at any time through “Privacy choices” in the footer. We ask only when the address you arrive with carries one of them, a campaign or the click id of an advertisement; a visit that brings neither is not asked, and nothing is stored for it. An address without the click id of an advertisement is asked about the campaign only. “Where you came from”: the campaign values in the address you arrived with (source, medium, campaign, content and term) and the language of the site. Your browser keeps them until you create an account; they are then stored with the organisation you create and removed from the browser, so that the sign-up can be credited to the campaign that earned it. “Google Ads reporting”: additionally the click id of a Google ad (gclid), kept in the same way, so that a sign-up can be traced to the advertisement that led to it. We do not send it to Google at present; before we report completed sign-ups to Google Ireland Ltd., this notice will say so. Without consent neither is read or stored. Withdrawing your consent removes both from your browser at once; to have them removed from an organisation that already exists, write to hello@formfeed.dev.

Waitlist (closed)

Until 14 September 2026 you could join a waitlist on this site. For those who did, we keep the email address, language, time and the page they came from, which we stored to send an invitation (Art. 6 (1) b GDPR), and delete these entries by 14 September 2027 at the latest, or earlier when you ask us to. Whoever also ticked the consent box is on our product news list at Resend, Inc. (USA, EU standard contractual clauses) and can unsubscribe with every mail (Art. 6 (1) a GDPR).

Zapier in the app

The Integrations page of the app can show Zapier’s Zap templates and your Zaps. Nothing is loaded from Zapier until you click “Show Zapier”; the choice is remembered in your browser. From then on the page loads code from Zapier, Inc. (USA) and passes it your name and email address, so Zapier can create your Zapier account in one step if you have none (Art. 6 (1) b GDPR, at your request). What happens in Zapier is governed by Zapier’s privacy policy.

Tips and product news by email

If you tick the box when you create your first organisation, or subscribe in the email preferences of the app, we send you tips for getting started and product news: at most one email a week (Art. 6 (1) a GDPR). Nothing is sent before you confirm with the link we mail to your address (double opt-in). To prove your consent we keep the text you agreed to, the language, where and when you gave it, when you confirmed it and when you withdrew it, for as long as your account exists. You can withdraw at any time with the link in every such email, with the unsubscribe button of your mail program or in the email preferences, and it takes effect at once. The emails are sent through Resend, Inc. (USA, EU standard contractual clauses).

Signing in with Google or GitHub

Besides your email address, you can create your account and sign in with Google (Google Ireland Ltd.) or GitHub (GitHub, Inc., USA). You then sign in with the provider, which learns that you are signing in to Formfeed and sends us your email address, your name, the identifier of your account there and, if there is one, the address of your profile picture (Art. 6 (1) b GDPR). What the provider does is governed by its own privacy policy.

The Formfeed service

Accounts, templates and rendered documents are stored and rendered in the EU (Supabase, Frankfurt; Fly.io, Frankfurt; Cloudflare R2, EU jurisdiction); API requests reach Cloudflare at the location nearest to the caller and are passed on to Frankfurt. Transactional email goes through Resend. Payments are handled by Stripe as merchant of record; we do not see card data. Document data you send to the API is processed on your behalf under our data processing agreement (formfeed.dev/legal/dpa). Every service provider involved is listed at formfeed.dev/legal/subprocessors.

Errors in the app, the API and the render servers are reported to Sentry (Functional Software, Inc., USA, EU data region) with the error, the page or endpoint and technical details of the browser or server, without request bodies, so that we can find and fix them (Art. 6 (1) f GDPR). Better Stack (Better Stack, Inc., USA) checks that our public endpoints answer and runs the status page, status.formfeed.dev; when you open it, Better Stack processes your connection data to deliver it (Art. 6 (1) f GDPR).

Email to us

When you write to us, we use your address and your message to answer you (Art. 6 (1) b GDPR for questions about a contract, otherwise Art. 6 (1) f GDPR). Our mailboxes run on a server we rent from IONOS SE in Germany. We delete the correspondence when it is settled, unless commercial or tax law requires us to keep it.

Retention

Waitlist entries are deleted by 14 September 2027 at the latest, or earlier on request. Rendered documents expire according to your plan. Account data, including the campaign values and click id of an organisation, is deleted 30 days after you delete the organisation.

Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection (Art. 15–21 GDPR) and the right to lodge a complaint with a supervisory authority. Write to hello@formfeed.dev.