Privacy policy

Who handles your data?

Jeffrey Aldebert, publisher of FormHush, handles service administration and support. For customer forms, the customer is the controller and FormHush acts on their instructions under our data processing agreement. Contact hello@formhush.com.

Purpose, data and legal basis

We receive message text, optional names, email addresses and up to 20 additional text fields to classify and route enquiries. Customers determine the lawful basis for their forms and must inform senders. Account email, website origins, subscription identifiers and session records support registration, access, delivery and billing. Service administration and support are necessary to perform our agreement. Abuse prevention serves our legitimate interest in securing the service. A daily salted hash derived from the connecting IP enforces rate limits; we do not store the raw IP in the submission database.

Before sending a message to Jev, we mask email addresses and phone numbers in its text. Separate name, email and additional fields are never sent to Jev. Masking is not full anonymisation: other personal information in free text may remain. Do not submit passwords, payment card details or sensitive personal data. Demo text is not stored by FormHush. We count completed demos per day without message content or visitor identifiers. Account-level activation dates record the first form configuration, first useful submission, latest useful submission and first successful delivery.

Retention

Email sign-in links expire after 30 minutes and session records after 30 days. Account details and encrypted destination settings remain until you delete your account. Sent or failed account-email jobs are removed after 30 days; expired links and their associated mail jobs are removed sooner. Submissions and related notification jobs are automatically deleted after 30 days by a Worker task running every five minutes. This also applies to unsorted and undelivered messages. Rate identifiers expire within one day plus the cleanup interval. Monthly usage counters contain no message text and are removed after about one year. Payment event identifiers and salted hashes of deleted billing customer identifiers are retained for replay protection while the billing integration is operated; they contain no submission content. Copies delivered to your chosen channels follow those recipients' retention policies. An encrypted copy of the service database, which can include the data above, is made once a day for disaster recovery, kept for 30 days and then deleted automatically. If a copy is ever restored, data that should already have expired is deleted before the service resumes. Infrastructure recovery copies follow the hosting provider's lifecycle.

Providers and recipients

• Cloudflare, Inc.: website, Workers, D1 storage and optional cookieless Web Analytics (Cloudflare DPA).
• TypeSafe AI (Jev), United States: classification of masked message text when AI is enabled (TypeSafe agreement, privacy policy).
• Polar: Merchant of Record for checkout, subscription payments and billing records; its own privacy and legal retention rules apply to payment processing (Polar terms, privacy policy).
• Google, Microsoft (Clarity) and Meta Platforms Ireland: optional analytics and advertising measurement, only with your consent (Google, Microsoft, Meta).
• Resend, Inc., United States: confirmation links, account emails and form submission notifications (Resend DPA).
• Customer-selected Slack, Telegram and webhook destinations receive forwarded submissions on the customer's instructions.

Processing may involve countries outside the European Economic Area, including the United States. Before activating a provider, applicable processing terms and a lawful transfer mechanism, such as standard contractual clauses or an applicable adequacy decision, must be in place. This notice does not claim that an unconfigured integration is already operating.

Your rights

Contact the form owner for access, correction, deletion, restriction, portability or objection relating to a form submission. We assist the controller. For service administration data, contact hello@formhush.com. Where consent is the basis, you may withdraw it. You may complain to your competent data protection authority; for FormHush, as a publisher established in France, this is the CNIL (cnil.fr). Classification is advisory and can be reviewed by a person; it is not a decision about legal rights.

Cookies and analytics

Signing in sets an essential HttpOnly, Secure, SameSite=Lax session cookie that expires after 30 days. Sign out to revoke it. Email links expire after 30 minutes and work once. Destination credentials are encrypted at rest. Optional Cloudflare Web Analytics measures aggregate traffic and performance without cookies or local storage. Two separate, optional choices are offered, and FormHush works if you decline both. Analytics: Google Analytics, loaded through Google Tag Manager, and Microsoft Clarity (click maps and session recordings, with form fields masked) measure public page visits and accepted signup requests. Advertising: the Meta pixel (Meta Platforms Ireland) measures visits and accepted signup requests for our ads on Facebook and Instagram; its _fbp and _fbc cookies last up to 90 days, and Meta advanced matching is turned off. No Google, Microsoft or Meta tool loads before you choose, and a Global Privacy Control signal counts as a refusal. Choices are kept for six months in local storage and can be changed through Cookie settings in the footer, separately for analytics and advertising; withdrawing deletes the related cookies. Google Analytics cookies expire after six months at most and Microsoft Clarity cookies after one year at most. We do not send form contents, email addresses, account identifiers or sign-in tokens to Google, Microsoft or Meta. Dashboard and confirmation pages do not load Google, Microsoft or Meta tools; only the cookieless Cloudflare Web Analytics beacon described above may run on all pages.