Privacy Policy

1. Roles, Scope, and Definitions

1.1 Personal Information. For purposes of this Privacy Policy, “Personal Information” means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to a particular individual or household, and includes, where applicable, “personal data” as defined under the EU General Data Protection Regulation (the “GDPR”) and the United Kingdom General Data Protection Regulation (the “UK GDPR”), “personal information” as defined under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (collectively, the “CCPA”), and analogous terms under other applicable data-protection laws. Personal Information does not include information that has been irreversibly de-identified, anonymized, or aggregated such that it cannot reasonably be used to identify a particular individual.

1.2 Our Role as Controller. With respect to the processing of Personal Information about visitors to the Service, Account holders, billing contacts, marketing recipients, prospects, and other individuals who interact with Springform directly, Springform acts as the “controller” (or, where applicable, the “business”) of such Personal Information.

1.3 Customer-Controller Relationship for Submitter Content. When a Customer uses the Service to collect submissions, applications, or other content from Submitters, Springform processes the Personal Information contained in Submitter Content on behalf of, and at the direction of, that Customer. In such processing, the Customer is the “controller” (or, where applicable, the “business”) of such Personal Information, and Springform is the “processor” (or, where applicable, the “service provider” or “subprocessor”). Submitters with questions about, or requests concerning, the processing of their Personal Information by a Customer should contact the relevant Customer directly. Springform will, upon receipt of any such request, use commercially reasonable efforts to route the request to the relevant Customer and provide reasonable assistance to the Customer in responding in accordance with applicable law and any data processing addendum (a “DPA”) in effect between Springform and the Customer.

1.4 Capacity and Authority. The Service is intended for use by individuals who are at least eighteen (18) years of age, except that an individual between sixteen (16) and eighteen (18) years of age may use the Service solely in the capacity of a Submitter, and only with the consent of a parent, legal guardian, or the organization administering the relevant program. Customers using the Service to collect Personal Information from minors are responsible for compliance with the Children's Online Privacy Protection Act of 1998, as amended (“COPPA”), and analogous laws, as set forth in Section 1.3 of the Terms.

2. Information We Collect

We collect Personal Information from and about you: (a) directly from you; (b) automatically through your use of the Service; (c) from third parties as described below; and (d) where you are using the Service as a Customer to collect Submitter Content, indirectly from your Submitters as your processor.

2.1 Information You Provide Directly. When you access or use the Service, you may provide us with the following categories of Personal Information:

(a) Account Information. When you create an Account, we collect information such as your name, email address, password (stored in hashed form), profile photo (if you choose to upload one), the name of your workspace or organization, and your role within that workspace.

(b) Billing Information. When you sign up for, upgrade to, or maintain a Paid Plan, our payment processor (“Payment Processor”) collects payment-card and bank-account information directly from you on Springform's behalf. Springform does not store full payment-card numbers or full bank-account numbers. From our Payment Processor, we receive a transaction token and limited information such as the last four digits of your payment instrument, the card brand or bank name, billing name and address, billing email, and transaction status.

(c) Communications. If you contact us by email, in-Service messaging, or other means (for example, to request a demo or support, respond to a survey, or provide feedback), we will collect the contents of your communication and any information you choose to provide.

(d) Customer Content. Anything you submit, upload, transmit, or create through the Service constitutes Customer Content, as defined in the Terms. Customer Content may include Personal Information about you, your colleagues and other Account users, and (in the case of Submitter Content) your Submitters.

2.2 Information Collected Automatically. When you access or use the Service, Springform and our service providers may collect certain information automatically, including:

(a) Device and Connection Information. We collect information about the device you use to access the Service, including device type, operating system, browser type and version, screen resolution, language preferences, time zone, and unique device or browser identifiers; and information about your internet connection, including your internet protocol (IP) address and approximate geographic location derived from your IP address.

(b) Usage Information. We collect information about your interactions with the Service, including pages and screens viewed, features and actions used, timestamps, click and scroll events, referring and exit pages, AI Feature interactions, and session-level performance and error information.

(c) Cookies and Similar Technologies. Springform and our service providers use cookies, pixels, web beacons, software development kits, and similar technologies to collect Personal Information. We describe our use of these technologies, and the choices available to you, in our Cookie Notice at https://springform.app/cookies (the “Cookie Notice”), which is incorporated into this Privacy Policy by this reference.

2.3 Information from Third Parties. We may receive Personal Information about you from the following categories of third parties:

(a) Single Sign-On Providers. If you choose to sign in to the Service using a third-party identity provider (for example, Google or Microsoft), we receive from that provider the information you have authorized them to share with us, which typically includes your name, email address, and profile photo.

(b) Payment Processor. We receive transaction and billing-related information from our Payment Processor as described in Section 2.1(b).

(c) Service Providers. We receive information from Springform's service providers (such as error-monitoring, analytics, hosting, and email-delivery providers) that they collect in the course of providing services to us, as further described at https://springform.app/subprocessors (the “Subprocessors Page”).

(d) Permitted Sources. We may receive Personal Information about you from your organization (for example, if you are invited to a workspace by a workspace Owner or Admin), from publicly available sources, and from other third parties where the third party has the right to share that information with us.

2.4 Submitter Content. When you are using the Service as a Customer to host a submission form, evaluation criteria, or similar feature, you (and not Springform) determine what Personal Information your Submitters are asked to provide and the purposes for which it will be used. The categories of Personal Information collected in Submitter Content will therefore vary depending on the Customer's configuration of the Service. Springform processes such Submitter Content on the Customer's behalf and in accordance with Section 1.3.

3. How We Use Personal Information

Springform uses Personal Information described in Section 2 for the purposes set forth below. Where you are located in the European Economic Area (the “EEA”), the United Kingdom, or Switzerland, the legal bases on which Springform relies under the GDPR or UK GDPR (as applicable) are identified in parentheses; these legal bases include the performance of a contract with you (“Contract”), compliance with a legal obligation (“Legal Obligation”), Springform's or a third party's legitimate interests (“Legitimate Interests”), and your consent where applicable (“Consent”). Springform uses Personal Information to:

(a) provide, operate, secure, and maintain the Service, including to authenticate your Account, host and process Customer Content, deliver the AI Features, route email and notifications, render the user interface, and otherwise make the Service available to you (Contract; Legitimate Interests);

(b) process payments, manage subscriptions, and administer billing through our Payment Processor (Contract; Legal Obligation);

(c) communicate with you about your Account, including to send transactional messages (such as receipts, confirmations, and security alerts), respond to your inquiries, and provide customer support (Contract; Legitimate Interests);

(d) send you marketing communications about Springform products, features, and events, where permitted by applicable law, with the right to opt out at any time (Legitimate Interests; Consent where required by applicable law);

(e) improve and develop the Service, including by understanding how the Service is used in the aggregate, troubleshooting and debugging, conducting research, and developing new features (Legitimate Interests);

(f) personalize your experience of the Service, including by remembering your preferences and presenting relevant content (Legitimate Interests; Consent where required by applicable law);

(g) operate, secure, and improve the AI Features in accordance with Section 4 (Contract; Legitimate Interests);

(h) detect, investigate, prevent, and respond to fraud, abuse, security incidents, violations of the Terms, and unauthorized or unlawful activity, and to enforce Springform's agreements and policies (Legitimate Interests; Legal Obligation);

(i) comply with applicable laws, regulations, and legal process, including tax, accounting, anti-money-laundering, sanctions-screening, and recordkeeping requirements, and to respond to lawful requests from public authorities (Legal Obligation);

(j) establish, exercise, and defend legal claims, and to protect the rights, property, and safety of Springform, our users, and the public (Legitimate Interests; Legal Obligation); and

(k) for any other purpose disclosed to you at the time of collection or for which Springform has obtained your Consent.

Where Springform relies on Legitimate Interests, Springform has considered and balanced those interests against your rights and freedoms and, where required by applicable law, will provide you with further information regarding such balancing upon request.

4. AI Features and Automated Processing

4.1 Processing for AI Features. The Service includes AI Features (as defined in the Terms) that may process Customer Content (including Personal Information contained therein), inputs and instructions you provide, and certain Service usage data, in order to produce AI Outputs. The AI Features are delivered together with third-party AI providers identified on the Subprocessors Page.

4.2 No Training on Customer Content. Springform does not use Customer Content to develop, improve, or train generalized artificial-intelligence or machine-learning models. Springform's AI providers do not use inputs to, or AI Outputs from, the Service to develop, improve, or train their respective generalized models. The foregoing commitments are subject to Springform's right to use de-identified, aggregated technical metadata about Service usage to operate, secure, evaluate, and improve the Service.

4.3 No Solely Automated Decisions with Legal or Similarly Significant Effects. Springform does not use the AI Features to make decisions that produce legal effects concerning you, or that similarly significantly affect you, based solely on automated processing, within the meaning of Article 22 of the GDPR. AI Outputs are intended to assist, not replace, human review. Customers may use the AI Features to support their own decision-making (for example, to inform the evaluation of a submission), but a Customer that uses AI Outputs to make a decision about an individual is responsible, as the relevant controller, for ensuring that such decision complies with applicable law and is reviewed by a qualified human where required.

4.4 AI Output Accuracy. As more fully described in Section 5.3 of the Terms, AI Outputs may be inaccurate, incomplete, biased, or otherwise unreliable. You should not rely on AI Outputs as a substitute for professional advice (including legal, financial, medical, tax, or accounting advice) or for human review where the underlying decision has legal, financial, safety, employment, admissions, evaluation, or other material consequences for any person.

5. How We Share Personal Information

Springform shares Personal Information with the following categories of recipients, in each case subject to appropriate contractual and security safeguards:

5.1 Service Providers and Subprocessors. Springform shares Personal Information with third parties that provide services to Springform in connection with the Service, including hosting, infrastructure, database, payment processing, email delivery, transcription, AI model inference, error monitoring, analytics, customer support, and similar services. The current list of Springform's subprocessors, including each subprocessor's purpose, the categories of data they process, and their primary processing location, is available on the Subprocessors Page. Springform's subprocessors are contractually bound to process Personal Information only on Springform's documented instructions and to maintain appropriate technical and organizational safeguards.

5.2 Workspace and Collaboration. The Service is designed for collaboration. When you join a workspace, accept an invitation, submit content through a form hosted by a Customer, or otherwise share content with other users of the Service, the Customer Content you contribute (which may contain Personal Information) will be accessible to other authorized users of that workspace or program in accordance with the roles, permissions, and configuration set by the workspace Owner or Admin. Workspace Owners and Admins may also have visibility into Account-level activity, such as which Account members have accessed the Service and when.

5.3 Public Content. If you choose to make Customer Content publicly accessible (for example, by listing it in a public area of the Service or by sharing it via a publicly accessible link), that Customer Content, including any Personal Information it contains, may be viewed, accessed, copied, downloaded, indexed by search engines, archived, and further shared by others. You are responsible for what you choose to make publicly accessible.

5.4 Business Transfers. Springform may share Personal Information in connection with, or during negotiations of, any merger, acquisition, financing, reorganization, change of control, sale of assets, dissolution, bankruptcy, or similar transaction, in which event Personal Information held by Springform may be among the assets transferred. Springform will use commercially reasonable efforts to require any successor entity to honor the commitments in this Privacy Policy with respect to your Personal Information, or to provide you with notice and choice as required by applicable law.

5.5 Legal Process and Protection. Springform may disclose Personal Information when Springform has a good-faith belief that disclosure is necessary to: (a) comply with applicable law, regulation, legal process, or governmental or regulatory request; (b) enforce the Terms or any other agreement with you, including to investigate any potential violation; (c) detect, prevent, or otherwise address fraud, security, or technical issues; or (d) protect the rights, property, or safety of Springform, our users, or the public.

5.6 Aggregate or De-Identified Information. Springform may share aggregate or de-identified information that does not identify any individual, for any lawful purpose. Springform will not attempt to re-identify such information and will require its recipients to refrain from doing so.

5.7 With Your Consent or at Your Direction. Springform may share Personal Information for any other purpose disclosed to you at the time of collection or pursuant to your Consent or direction.

5.8 No Sale of Personal Information. Springform does not “sell” Personal Information in exchange for monetary consideration. To the extent the term “sale” or “sharing” under the CCPA or under analogous laws of other U.S. states is construed to include certain disclosures of Personal Information to advertising, analytics, or marketing service providers, Springform describes such disclosures (if any), and your rights to opt out of them, in the Cookie Notice and in Section 9 of this Privacy Policy.

6. International Transfers of Personal Information

Springform is headquartered in the United States, and Springform's service providers and subprocessors may be located in the United States or in other countries. As a result, your Personal Information may be transferred to, and processed in, jurisdictions other than your own, including jurisdictions that may not provide the same level of data protection as the laws of your country of residence.

Where Personal Information of individuals located in the EEA, the United Kingdom, or Switzerland is transferred to a country that has not received an “adequacy” determination from the relevant data-protection authority, Springform relies on appropriate safeguards to protect such Personal Information, including the European Commission's Standard Contractual Clauses (Decision 2021/914) (the “SCCs”), the United Kingdom International Data Transfer Addendum to the SCCs (the “UK IDTA”), and the Swiss addendum to the SCCs, in each case as and to the extent applicable to the transfer. A copy of the SCCs or UK IDTA applicable to a specific transfer may be obtained by emailing hello@springform.app, subject to redaction of confidential commercial terms.

7. Data Retention

7.1 General Principles. Springform retains Personal Information for as long as is reasonably necessary to fulfill the purposes for which it was collected, to provide the Service to you, to comply with Springform's legal obligations (including tax, accounting, and recordkeeping obligations), to resolve disputes, and to enforce Springform's agreements.

7.2 Specific Retention Practices. Without limiting Section 7.1, Springform's general retention practices are as follows:

(a) Account Information. Account Information is retained for the duration of your Account and for a reasonable period thereafter to address residual operational, security, or legal needs.

(b) Customer Content. Customer Content is retained while it is hosted on the Service. As set forth in Section 10.2 of the Terms, upon deletion of your Account, Customer Content associated with that Account will immediately become inaccessible to you and may be deleted from Springform's production systems in Springform's sole discretion; copies that exist in routine backups or audit logs will be deleted in the ordinary course on the applicable retention cycle.

(c) Billing Records. Billing records are retained for the period required by applicable tax, accounting, and recordkeeping law.

(d) Security, Audit, and System Logs. Security, audit, and system logs are retained for limited periods reasonably necessary to operate, monitor, and secure the Service.

(e) Marketing Preferences. Records of your marketing preferences (including opt-out elections) are retained until your Account is closed, plus a reasonable period thereafter to honor your opt-out.

7.3 Submitter Content. Retention of Submitter Content is determined by the relevant Customer in its capacity as controller. Submitters seeking the deletion or correction of Submitter Content should contact the relevant Customer directly.

8. Security

Springform implements and maintains commercially reasonable administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized access, disclosure, alteration, and destruction.

You acknowledge, however, that no method of transmission over the internet, and no method of electronic storage, is one hundred percent (100%) secure; that the transmission of Personal Information to or through the Service is at your own risk; and that you are responsible for maintaining the confidentiality of your Account credentials. Springform does not warrant that the Service or its security safeguards are or will remain impenetrable, and Springform's liability with respect to security incidents is governed by Section 7.3 and Section 8 of the Terms.

In the event of a personal data breach (as defined under applicable law) involving Personal Information for which Springform is the controller, Springform will notify you without undue delay and as required by applicable law. Where Springform processes Personal Information as a processor or service provider on behalf of a Customer, Springform will notify the relevant Customer of any such incident in accordance with the applicable DPA and applicable law.

9. Your Privacy Rights

This Section 9 describes the rights that may be available to you with respect to your Personal Information. The rights available to you, and the manner in which you may exercise them, depend on the laws applicable to you. Springform will respond to verifiable requests as required by applicable law.

9.1 How to Exercise Your Rights. You may exercise any of the rights described in this Section 9 by emailing hello@springform.app or, where available, by using the in-Service tools provided in your Account settings. To protect your Personal Information, Springform will need to verify your identity before responding to a request, which may include verifying your control of the email address associated with your Account or requesting additional information reasonably necessary to confirm your identity. Springform will respond within the period required by applicable law. You may also designate an authorized agent to exercise your rights on your behalf in accordance with applicable law, provided that Springform may require the agent to provide written authorization from you and may require you to verify your identity directly.

9.2 Rights Under the GDPR, UK GDPR, and Swiss Law. If you are located in the EEA, the United Kingdom, or Switzerland, you may have the following rights with respect to Personal Information for which Springform is the controller, subject to the conditions, exceptions, and limitations set forth in applicable law:

(a) Right of Access. The right to obtain confirmation as to whether Personal Information concerning you is being processed and, if so, to access that Personal Information together with certain related information.

(b) Right of Rectification. The right to have inaccurate Personal Information about you corrected and to have incomplete Personal Information about you completed.

(c) Right of Erasure. The right to have Personal Information about you erased in certain circumstances.

(d) Right to Restriction of Processing. The right to restrict the processing of Personal Information about you in certain circumstances.

(e) Right to Data Portability. The right to receive Personal Information about you that you have provided to Springform in a structured, commonly used, and machine-readable format, and the right to transmit that Personal Information to another controller without hindrance from Springform, where the processing is based on Consent or Contract and is carried out by automated means.

(f) Right to Object. The right to object, on grounds relating to your particular situation, to processing of Personal Information about you that is based on Legitimate Interests, and the right to object at any time to processing of Personal Information about you for direct-marketing purposes.

(g) Right Not to Be Subject to Solely Automated Decision-Making. The right not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you, except as permitted by applicable law (see Section 4.3).

(h) Right to Withdraw Consent. Where processing is based on your Consent, the right to withdraw that Consent at any time, without affecting the lawfulness of processing based on Consent before its withdrawal.

(i) Right to Lodge a Complaint. The right to lodge a complaint with the supervisory authority in the member state of your habitual residence, place of work, or place of the alleged infringement.

9.3 Rights Under United States State Privacy Laws (Including California). If you are a resident of a U.S. state that has enacted a comprehensive consumer privacy law (including, without limitation, California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, New Hampshire, New Jersey, Minnesota, Maryland, Indiana, Tennessee, Rhode Island, and Kentucky, and other U.S. states that have enacted analogous laws), you may have certain rights with respect to Personal Information about you, subject to the conditions, exceptions, and limitations set forth in applicable state law, including:

(a) Right to Know. The right to know what categories of Personal Information Springform has collected about you, the sources from which the Personal Information was collected, the business or commercial purposes for collecting or sharing it, the categories of third parties to whom Springform has disclosed it, and the specific pieces of Personal Information Springform has collected about you.

(b) Right to Delete. The right to request the deletion of Personal Information about you that Springform has collected, subject to applicable exceptions.

(c) Right to Correct. The right to request the correction of inaccurate Personal Information about you.

(d) Right to Opt Out. The right to opt out of the sale of Personal Information and of the sharing of Personal Information for cross-context behavioral advertising, where applicable (see Section 5.8).

(e) Right to Limit Use of Sensitive Personal Information. The right to limit the use and disclosure of Sensitive Personal Information to the purposes permitted under applicable law.

(f) Right Against Discrimination. The right not to receive discriminatory treatment for exercising your privacy rights.

(g) Right to Appeal. Where provided by applicable state law, the right to appeal Springform's refusal to act on a privacy-rights request. You may submit an appeal by emailing hello@springform.app with the subject line “Privacy Rights Appeal.” Springform will respond to your appeal within the period required by applicable law.

9.4 California “Shine the Light” Law. California residents who have an established business relationship with Springform may, under California Civil Code Section 1798.83, request information regarding Springform's disclosure of certain categories of Personal Information to third parties for those third parties' direct-marketing purposes. To make such a request, please email hello@springform.app.

9.5 Submitter Requests. Where Springform processes Personal Information as a processor or service provider on behalf of a Customer, individuals seeking to exercise rights with respect to that Personal Information should contact the relevant Customer directly. If Springform receives any such request, Springform will, where reasonably practicable, route the request to the relevant Customer and, where required by applicable law or the applicable DPA, provide reasonable assistance to the Customer in responding.

10. Children's Privacy

The Service is not directed to children under thirteen (13), and Springform does not knowingly collect Personal Information from children under thirteen (13). If you are a parent or legal guardian and you believe that Springform has collected Personal Information from a child under thirteen (13) without verified parental consent, please contact us at hello@springform.app, and Springform will take commercially reasonable steps to delete such Personal Information in accordance with applicable law. Customers using the Service to collect Personal Information from minors are responsible for compliance with COPPA and analogous laws, as set forth in Section 1.3 of the Terms.

11. Changes to This Privacy Policy

Springform may update this Privacy Policy from time to time. If Springform makes a material change to this Privacy Policy, Springform shall provide notice — by email to the email address associated with your Account, by an in-Service notification, or by posting the updated Privacy Policy on this page with a revised “Last Updated” date — at least thirty (30) days before the change takes effect, except that changes required to comply with applicable law may take effect immediately upon posting. Your continued access to or use of the Service after the effective date of the change constitutes your acceptance of the updated Privacy Policy. If you do not agree to the updated Privacy Policy, your sole remedy is to stop using the Service before the change takes effect.

12. Contact

Questions, comments, or requests concerning this Privacy Policy or Springform's privacy practices may be directed to Springform at: