This policy explains what personal data FormThunder handles and why. There are two kinds. Account data is about you, our customer, and we decide how it's used. Form submissions are data your visitors send to you, and we process those for you, on your instructions, so your own privacy policy should cover them too.
Account data
- What we collect: your email address, name, password hash or Google account ID if you sign in with Google, team members, brand kit, billing details through Stripe, and logs of what changes on your account.
- Why: to run the service, send you service emails such as limit warnings, take payment, prevent abuse and fix problems.
We don't sell it. We don't send marketing email without a basis to do so, and you can opt out.
Form submissions
- What we store: the fields a visitor submits, any files they attach, and technical details: IP address and a hash of it, browser user agent, origin and referrer page.
- Why: to deliver the submission to you, show it in your dashboard, and detect spam and abuse.
- Retention: history in the dashboard is kept for 30 days on Free and 1 year on Pro and Agency, then deleted. Deleting an account removes its data from the live service, and backups age out in the normal cycle.
If you've submitted a form on someone else's website and want your data changed or deleted, please contact that website's owner. They control it. If you can't reach them, write to us.
Who else handles data
| Provider | What for |
|---|---|
| Amazon Web Services | Hosting, database, file storage and sending email (SES) |
| Resend | Sending email when the primary route fails |
| Stripe | Payments |
| Anthropic | Writing email templates, only when an account uses the template generator. It receives website and brand details, and not submissions |
| hCaptcha, Cloudflare Turnstile, Google reCAPTCHA | Spam checks, when a form's owner turns one on |
| Slack, Discord, Telegram, Google and webhook endpoints | Deliveries a form's owner has set up. They receive what the owner configures |
Cookies
We use a cookie to keep you logged in. The marketing site doesn't set analytics or advertising cookies.
AI crawlers and agents
Our public pages are open to search engines and AI crawlers. Your submissions and dashboard aren't public. An AI agent connected with your API key can read what that key allows, so only connect ones you trust.
Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, and to object to some uses of it. Most of it is available in your dashboard. For anything else, email support@formthunder.com. You can also complain to your local data protection authority.
International transfers
Our providers may process data in other countries. Where the law requires a safeguard for that, we rely on the mechanisms those providers offer.
Changes
We'll post changes here and tell you by email if they matter.
Last updated 5 November 2026.