Privacy Policy

2. The role we play

There are two distinct roles we can hold, depending on the data:

• Data controller — for your account data. We decide how your name, email, and account settings are used.
• Data processor — for responses submitted through forms you have published. You decide what your forms ask, and we handle the responses only as you instruct.

This distinction matters. It means that if you publish a form and collect responses, you are the data controller for those responses, and you are responsible for your own compliance with UK GDPR, PECR, and any other applicable law.

3. Information we collect

Account information

When you sign up, we collect your email address and, if you provide it, your full name. We also record which organisation you belong to, the plan you are on, and your account status.

Form content

When you generate a form, we store the form description you enter, the form schema we generate for you, and any edits you make to it. If you use our AI generator, your description is sent to a third-party AI provider — see section 5 below.

Responses

When someone fills out a form you have published, we store their answers, along with basic technical metadata: their IP address, their browser's user-agent string, the referring page, and any UTM parameters included in the URL they arrived from.

Webhook configuration

If you connect a webhook destination (such as LeadPath, Pipedrive, or Zoho CRM), we store the credentials and configuration you provide so that we can dispatch responses on your behalf.

Contact form submissions

If you use our contact page, we collect the name, email, subject, and message you provide.

4. How we use your information

We use your information to:

• Provide, operate, and secure the B2B Forms service.
• Generate form schemas in response to your descriptions.
• Store and display the responses you collect through your published forms.
• Dispatch responses to webhook destinations you have configured.
• Send you transactional emails, such as account confirmations, password resets, and notifications about your service.
• Respond to messages you send us through the contact page.
• Comply with our legal obligations.

We do not use your data for advertising, and we do not sell your data to anyone.

5. AI form generation

When you use the AI form generator, the business description you enter is sent to DeepSeek, an AI language model provider, so that it can generate your form. The response we receive is a form schema, which we then store.

We recommend that you do not include personal information about yourself or anyone else in your business descriptions. Describe the business and the form you need, not the people involved.

DeepSeek is based in China, which means your description is transferred outside the UK. We have put contractual safeguards in place to protect this transfer, and DeepSeek is used only for the purpose of generating forms.

6. Responses collected through your forms

When you publish a form, it becomes publicly accessible at a unique URL, and anyone can submit a response without creating an account. As the form owner, you are the data controller for the responses you collect.

This means you are responsible for:

• Telling your respondents how you will use their data.
• Honouring any consent they give or withdraw.
• Complying with your own legal obligations under UK GDPR, PECR, and any other applicable laws.

We handle responses only as you instruct — storing them, showing them to you in your dashboard, exporting them when you ask, and dispatching them to any webhook destinations you configure.

7. Webhooks and CRM connections

When you connect a webhook destination (such as LeadPath, Pipedrive, or Zoho CRM), every response submitted through your published forms is automatically sent to that destination. Once the data has been transferred, its handling is governed by the destination's own privacy policy and your agreement with them.

You are responsible for choosing destinations that are appropriate for the type of data you collect and for complying with any obligations you have towards your respondents.

8. Data storage and security

• Your account, form, and response data are stored using Supabase, encrypted in transit and at rest.
• Transactional emails are delivered through Resend.
• When you connect a CRM or webhook destination, credentials are stored with your organisation and are only visible to administrators of your account.
• We apply reasonable administrative, technical, and organisational safeguards to protect your information.

No system is completely secure. While we work to protect your information, we cannot guarantee absolute security.

9. Third-party services

We rely on the following trusted providers to operate B2B Forms. Their handling of information is governed by their own privacy policies.

Additional providers may be added as the service grows. When we add a new provider that processes personal data, we will update this section.

10. Cookies

B2B Forms uses only essential cookies to keep you signed in and to secure your session. We do not use analytics cookies, advertising cookies, or cross-site tracking.

Because we only use essential cookies, no cookie consent banner is required under UK PECR. If we ever introduce non-essential cookies, we will update this policy and add a consent mechanism before doing so.

11. International transfers

Our primary data storage is in the European Union, which is covered by the UK's adequacy regulations. Some processing happens outside the UK:

• DeepSeek processes AI generation requests in China. We rely on contractual safeguards for this transfer.
• Resend may process email delivery data in the United States. They maintain UK GDPR-compliant safeguards.

If you would prefer not to have any data processed by DeepSeek, do not use the AI form generator. You can still create forms manually by contacting us to discuss alternative arrangements.

12. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Ask us to correct inaccurate or incomplete information.
• Ask us to delete your account and associated data.
• Request a portable copy of your data.
• Object to certain types of processing.
• Lodge a complaint with the Information Commissioner's Office (ICO).

To exercise any of these rights, contact us through our contact page. We may need to verify your identity before completing certain requests.

13. Data retention

• Account information is retained while your account is active.
• Forms, responses, and webhook configuration are retained while your account is active.
• When you delete a form, its responses are deleted along with it.
• Contact form messages are retained for up to 12 months and then deleted.
• You may request deletion of your account and associated data at any time.

14. Changes to this policy

We may update this Privacy Policy to reflect changes to B2B Forms, our service providers, legal requirements, or our privacy practices. The updated version will be posted on this page with a revised date.

15. Contact us

If you have questions about this policy or want to exercise a privacy right, please use our contact page.