Privacy Policy

Peliform is a backend for website forms. This policy explains what we collect when you use peliform.com, the Peliform dashboard, and the form endpoints, and what we do with it. The short version: we collect what we need to run the service, we don't sell data, and we don't use it for advertising.

1. If you have a Peliform account

• Account details: your name, email address, and a hashed password (we never store it in plain text).
• Sessions: when you sign in, we set a session cookie and record the IP address and browser user agent of the session, to keep you signed in and to spot suspicious sign-ins.
• Your forms: their names, settings, field rules, allowed sites and redirect addresses.
• Billing: when paid plans launch, payments will be handled by a payment provider. We'll keep your plan and billing history, not your card number.
• Messages: anything you send us, such as support emails.

We use this to run your account and your forms, keep the service secure, answer you, and tell you about changes that affect you. Our legal basis is performing our contract with you and our legitimate interest in keeping the service secure.

2. If you filled in a form that uses Peliform

The website that showed you the form decides what it asks for, and is responsible for that data. Peliform stores it on the website owner's behalf, as their processor. With each submission we store:

• the fields of the form, as you filled them in;
• your IP address and browser user agent, used to filter spam and abuse;
• the page and site the form was sent from (the Referer and Origin headers).

Only the website owner can see the submission in their dashboard. To access, correct or delete what you sent, contact the website owner. If you can't reach them, write to us and we'll pass your request on. Peliform doesn't accept password or card number fields, and doesn't place cookies or scripts on websites that use it.

3. When you visit this website

peliform.com sets no cookies and runs no analytics or advertising trackers. If you switch between light and dark themes, your choice is saved in your browser's local storage and never sent to us. The site loads its typeface from Google Fonts, so your browser connects to Google's servers, which see your IP address. Our hosting provider keeps short-lived request logs for security.

The abuse report form stores what you enter, plus the technical details listed in section 2, and is read only by the Peliform team.

4. Who processes data for us

• Cloudflare hosts the website, the dashboard, the form endpoints and the database.
• Google Fonts serves this website's typeface.

We'll update this list before adding a provider that handles personal data, such as an email or payment provider. Cloudflare runs a global network, so data may be processed outside your country, under the safeguards its data processing terms provide. We'll share data with authorities only when the law requires it, or to stop abuse such as phishing.

5. How long we keep it

• Account data: for as long as the account exists.
• Submissions: until the account owner deletes them, deletes the form, or they pass the history limit of the owner's plan.
• Abuse reports: for as long as needed to handle them and to prevent repeat abuse.
• When an account is deleted, its forms and submissions are deleted with it. Deleted data can remain in database backups for up to 30 days before it is gone for good.

6. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict how we use it, and to complain to your data protection authority. Account owners can do most of this from the dashboard. For anything else, emailprivacy@peliform.com and we'll answer within 30 days.

Peliform isn't meant for children under 16, and we don't knowingly collect their data.

7. Changes

If we change this policy in a way that matters, we'll email account owners before the change takes effect, and update the date at the top of this page.