The short version
- We collect what we need to run the Service: your account, the forms you build and the responses they receive.
- We don't sell personal data, use it for ads, or use your forms and responses to train AI models.
- Form responses reach ChatGPT only when you ask about them.
- Responses belong to the form's owner. We process them on the owner's behalf.
- You can access, export or delete your data at any time.
Who we are
Formloop is operated by wisegrids ("we", "us", "our"), wisegrids. You can reach us about privacy at wisegrids@gmail.com.
For your account and the forms you build, we decide how personal data is used (we are the "controller").
For responses submitted to a form, the person or organisation that owns the form is the controller, and we process the responses on their behalf (we are their "processor"). If you filled in a form and have a question about your answers, please contact the form's owner. If you can't reach them, contact us and we'll pass your request on where we can.
Information we collect
Account information
Your email address, and your name if you provide it. How you sign in determines what else we hold:
- If you set a password, we store only a salted, one-way hash of it, never the password itself.
- If you sign in with a third-party provider such as Google, we receive your name, email address and account identifier from that provider.
We also store preferences such as your light or dark theme.
Forms you create
The questions, settings and design of your forms, and their version history. When you build or edit forms through ChatGPT, we receive the instructions ChatGPT sends to Formloop to carry out your request.
Form responses
For each submission we store:
- the answers respondents submit
- when they submitted them
- how long the form took to complete
- which version of the form they saw
We don't store respondents' IP addresses with their responses. Test responses you create are marked as tests.
Usage and technical information
- Activity in the Service. We record actions such as creating, publishing or closing a form, and aggregate counts such as form views. We use these to operate, secure and improve the Service.
- IP addresses. To stop abuse, we hold IP addresses in memory for about a minute to rate-limit form submissions.
- Access logs. Our hosting and network providers may keep standard access logs, including IP address and browser type, for a limited time for security.
Information from ChatGPT
When you connect Formloop to ChatGPT, you sign in to Formloop through a secure OAuth flow. After that, ChatGPT sends us the requests needed to do what you ask, along with technical details such as your locale. We don't receive your ChatGPT conversation history, only the content of the requests ChatGPT sends to Formloop.
Payment information
Paid plans are handled by our payment provider. We never receive or store full card numbers. We receive billing details such as your name, email address, country, plan and payment status.
Support
What you send us when you contact support.
How we use information
- To provide the Service: building, hosting and publishing your forms, collecting responses, showing them to you, and computing insights.
- To run your account: signing you in, and sending sign-in and essential service emails.
- To keep the Service safe: preventing fraud, spam and abuse, and enforcing our Terms of Service.
- For billing: on paid plans.
- To improve the Service: using usage information.
We don't look at the content of your forms or responses, except when you ask us to help with support, when we investigate a reported abuse, or when the law requires it.
We do not sell personal data. We do not use it for advertising. We do not use your forms or responses to train AI models.
AI processing and ChatGPT
When you use Formloop inside ChatGPT, OpenAI processes your messages and the results Formloop returns under OpenAI's own terms and privacy policy. Those results include form outlines and any response data you ask about.
- Formloop returns response data to ChatGPT only when you ask for it.
- Insights computed by Formloop never include names, email addresses, phone numbers or links taken from responses.
- Think about which response details you ask ChatGPT to retrieve, especially for forms that collect personal information.
We don't send your forms or responses to any other AI provider. If a future feature changes this, we'll update this policy before it launches.
Legal bases (EEA and UK)
We process personal data on these legal bases:
- Contract: to provide the Service you signed up for.
- Legitimate interests: to keep the Service secure, prevent abuse and improve it.
- Consent: where we ask for it. You can withdraw consent at any time.
- Legal obligation: where the law requires us to keep or disclose information.
How long we keep information
- Account information: for as long as your account is open.
- Forms and responses: until you delete them, or until your account is deleted.
- Deleted accounts: the data is removed within 30 days. Backups that still contain it are overwritten within a further 30 days.
- Billing records: for as long as tax and accounting laws require.
We keep information longer only when the law requires it.
Security
We protect data with:
- encryption in transit (HTTPS)
- signed, HTTP-only session cookies
- a strict content security policy on public form pages
- hashed passwords
- access to production systems limited to the people who need it
No system is perfectly secure. If a breach affects your personal data, we'll notify you and the authorities as the law requires.
Where data is stored
Our servers are located in Germany. If you use the Service from another country, your data is transferred there. Where the law requires it, we use appropriate safeguards for international transfers, such as the European Commission's Standard Contractual Clauses.
Your rights and choices
Depending on where you live, you may have the right to:
- access your data and get a copy
- correct it
- delete it
- export it (you can download responses as CSV from the dashboard at any time)
- object to or restrict certain processing
- withdraw consent
- complain to your data protection authority
California: you have the right to know, delete and correct personal information, and you won't be discriminated against for using these rights. We don't sell or "share" personal information for cross-context behavioural advertising.
India: under the Digital Personal Data Protection Act, 2023, you have rights to access, correction and erasure, to have your grievances addressed, and to nominate someone to exercise your rights.
To use any of these rights, email wisegrids@gmail.com. We may need to verify your identity, and we'll respond within 30 days. If you responded to a form, please contact the form's owner first.
Children
The Service is not intended for children. You must be an adult to hold an account (see our Terms), and we don't knowingly collect personal data from children under 16 for our own purposes.
Form owners must follow the laws on collecting children's data, including getting verifiable parental consent where it's required.
If you think a child has given us personal data, contact us and we'll delete it.
Changes to this policy
When we update this policy, we'll change the date at the top of this page. If a change is significant, we'll also tell you by email or in the Service before it takes effect.
Contact and grievances
wisegrids
wisegrids
wisegrids@gmail.com
The same contact handles privacy questions and grievances, including under India's Digital Personal Data Protection Act, 2023.