What data we collect
The application collects:
- Form submissions — whatever the form asks for.
- Audit log — who did what, when, from what IP address.
- Session data — login state, kept in the database.
Where the data lives
Everything stays on the operator's server. There is no third-party SaaS, no analytics pipeline, no central aggregation. The database, file storage, and email queue all live on infrastructure the operator controls.
Who has access
Access is controlled by the operator. Roles include Admin (full access), Builder (can create forms), Agent (can fill forms), and custom roles per tenant. Every access is logged.
Cookies
The application uses one first-party session cookie. It is HttpOnly and Secure (when HTTPS is detected). No third-party cookies, no tracking pixels, no analytics scripts.
Data subject rights
End users can request access to, correction of, or deletion of their data by contacting the operator directly. The operator handles these requests within the timeframe required by applicable law.
Contact
Questions about this privacy policy? Use the contact page or email .