Privacy

Privacy

Who processes data

Formgong is the controller for your Formgong account data and for visits to formgong.com. For privacy questions or requests, write to support@formgong.com.

For leads from your site you remain the controller, and Formgong is the processor.

What is stored

Account: email, language, plan.

Signup source: the first Formgong page or blog post you opened, the domain of the site that linked to it (not the full address), and any ref or utm_source, utm_medium, utm_campaign tag in a Formgong link. Before signup it sits in a first-party cookie for up to 7 days, then it is stored with the account. No third-party trackers or ad pixels.

Setup steps: which setup steps you reached in the dashboard (opened the install wizard, moved to the next step, copied the code, sent a test), with the first and last time and a count. We use it only to see where setting up a form gets hard. It is deleted with the account.

Submission: form fields, time, page URL, user agent, and an IP hash. The raw IP is not stored.

Delivery status for email, Telegram, webhooks, and Google Sheets. The Google refresh token, when you connect Sheets, is stored encrypted.

Form analytics: a view, a start, the field touched before leaving, and the submission. Country comes from the Cloudflare header, plus device type and source (UTM or referrer domain). Ad click ids are not stored — only the platform, for example Google Ads.

Review photos and videos (every Reviews plan, Free included): files a reviewer attaches are stored in Cloudflare R2, created with EU jurisdiction. They are shown only after the site owner approves the review, and they are deleted with the review, the site or the account.

Editing your own review: if you leave an email address with a review, we email you one link to edit or delete it. The link works for one year, and we store only a keyed hash of it with the review. A saved edit goes through the site's checks again, and the site owner sees the previous version. Deleting removes the review, its photos and video, and the copy the site owner received.

Questions to reviewers (“Ask the author”, only on review sites that turn it on, and only under reviews whose writer ticked the box): we store the shopper's question and email address to send the question to the reviewer and the answer back to the shopper. Neither address is ever shown to the other person or to the site owner, and the IP address is kept only as a keyed hash for the daily limits. The question and the shopper's email are deleted 90 days after the question, or 30 days after the answer, whichever comes first. If you allow questions on your review, we keep your email address while that is on, so questions can reach you; it is never shown to anyone, and the Stop questions link in every question email turns it off. If the reviewer chooses to publish the question and answer under the review, that text stays on the site without any email address until the site owner hides it or the review is removed.

Voice messages (only on forms whose owner turned on file uploads): a recording is stored like any other attachment, in Cloudflare R2 with EU jurisdiction. Unless the visitor typed a transcript, an audio file of up to 4 MiB is sent once to Cloudflare Workers AI (the speech-to-text model @cf/openai/whisper-large-v3-turbo) to write one. Cloudflare may process it outside the EU. The transcript is stored with the submission in the EU database and is deleted with it.

Review emails for online stores (only when a store sends its orders to Formgong through the Formgong WordPress plugin, the orders API, a CSV upload, or the Formgong Shopify app once the store turns review emails on): for each order we store the order number, the buyer's email address and first name, language, billing country and marketing consent as the store sent them, and the ordered products (name, link and image). We use them only to send that store's review request, at most one reminder and, if the store offers one, a coupon, and to mark reviews sent from that email as from a verified buyer. The store is the controller of this data and Formgong processes it on the store's behalf. An order is deleted 30 days after its last email was sent, skipped or cancelled, and at once when the store deletes its review site or account. The link in the email holds no address and stops working after 90 days. The email log keeps a masked address (o***@example.com) for 30 days. If a buyer uses the unsubscribe link in the email, we keep only a keyed hash of the store and the address, so that store does not email the address again. If they use the unsubscribe button of their email app instead, the address goes on Formgong's do-not-email list, so no site or store using Formgong emails it again, and it stays there until the buyer asks us to remove it. The address behind that button is kept for 90 days after the last email.

A store can choose to send these emails through its own Klaviyo, SendGrid, Mailgun, Postmark or Brevo account instead of Formgong's sender. Then Formgong hands each email to that account with the store's own API key; with Klaviyo it records an event with the buyer's email address, first name and the email's content, and the store's Klaviyo flow sends it. That provider is the store's own choice and processes the data for the store under its own terms; it is not a Formgong sub-processor. The API key is stored encrypted, and only its last four characters are shown again.

A form can add the visitor who agreed to a list in the customer's own email-marketing account (Mailchimp, Klaviyo, Brevo, MailerLite or Kit), under the form's Settings → Email lists. Then Formgong sends that visitor's email address, and the name fields the customer maps, to that account with the customer's own API key. That service is the customer's own choice and processes the data for the customer under its own terms; it is not a Formgong sub-processor. The API key is stored encrypted, and only its last four characters are shown again.

Why

To deliver the lead by email, Telegram, webhook, and, when you connect it, Google Sheets, show it in the dashboard, and enforce the plan limit. Email is sent through UniOne (EU); Formgong’s own mail server in the EU (Contabo) sends part of it and is the fallback. Sheets rows are sent to Google.

Retention

Free keeps submissions for 30 days. Pro can extend that or keep them until you delete them. If a form had a longer period on Pro and the plan ends, the form keeps that period until you change it in the form settings; you can shorten it or delete submissions at any time.

Raw analytics events are deleted after 90 days. Daily totals stay so the dashboard does not rescan every event.

Deleting the account from the dashboard removes forms, submissions, and sessions.

Help chat

On formgong.com and on sites whose owner added the Formgong chat, your chat messages and the bot's replies are stored in the EU database for 30 days and then deleted. We use them to answer and to improve answers (for example, to see unanswered questions). The raw IP address is not stored, only a keyed hash for rate limits.

To write a reply, your message and excerpts of the site's pages are sent to Cloudflare Workers AI. Your message and the bot's reply are also sent there for an automated check for harmful content. Cloudflare may process the data outside the EU. Do not type passwords or card numbers into the chat.

The “Try it on your own site” demo on formgong.com/chat stores the public text of the pages it reads from the site you enter for up to two hours, and sends excerpts of that text to Cloudflare Workers AI to write its answers.

When you are signed in on formgong.com, the bot sees only your forms' names and settings and recent delivery errors, to help you, and changes nothing. The team receives the conversation and your email only after you press “Talk to a human” and agree. On other sites the site owner is the controller of the chat data and Formgong is the processor.

Shopify order lookups and product suggestions based on earlier purchases are not currently offered in the help chat. In a shop whose owner linked the chat to the Formgong Shopify app, Shopify customer data requests and deletions (GDPR) cover that shop's chat conversations.

Legal basis and your rights

We process account data to provide the service you signed up for (GDPR Art. 6(1)(b)) and to keep it secure and working (legitimate interest, Art. 6(1)(f)).

You can ask for access to your data, correction, deletion, export, or restriction of processing, and you can object to processing. Write to support@formgong.com; much of this is also available in the dashboard. You can also complain to a data protection supervisory authority.

Support tickets

If you ask the help chat to open a support ticket, we store your email, the ticket text, its category, any fields you fill in, a short excerpt of the chat and the replies, in the EU database. A ticket is kept for 24 months after it is closed and then deleted. To get a copy or have it deleted earlier, write to support@formgong.com.

On other sites, the site owner who turned tickets on is the controller of this data and Formgong is the processor.

Payments

Formgong never sees or stores card numbers. The reseller that acts as merchant of record collects payment and billing details under its own privacy policy, shown at checkout. Records of earlier purchases stay with the reseller that processed them.

Optional AI form checker

The public form checker uses AI only when you select that option. It sends field names and types, required-field flags and diagnostic codes to Cloudflare Workers AI. Page URLs, field values, hidden fields, access keys and customer submissions are excluded. Formgong does not store the fetched page or AI result. Cloudflare may process the structural report outside the EU under its own retention policies. The basic check works without AI.

Google user data (Google Sheets)

Data we access. Only when you connect Google Sheets in a form's settings, Formgong asks Google for: your Google account email address and account ID (scopes openid and email), to show which account is connected; and the drive.file permission, which covers only spreadsheets Formgong creates for you or that you select yourself in the Google Picker. Formgong cannot see, list or open any other file in your Google Drive. In those spreadsheets Formgong reads the spreadsheet title, the tab names and the first (header) row, and writes new rows. Signing in with Google uses only openid and email.

How we use it. Only to provide the Google Sheets feature you turned on: create the spreadsheet, keep the header row in line with your form, append one row per accepted submission, send a test row when you ask, and show the connected account and spreadsheet in your dashboard. We do not use Google user data for advertising, profiling, credit decisions or any purpose other than this feature, and we do not read spreadsheet contents beyond the header row.

Storage and deletion. Formgong stores your Google email, account ID, the granted scopes and an encrypted (AES-GCM) refresh token in its EU database, plus the spreadsheet ID, title and tab name for each form. Rows are written straight to your spreadsheet and are not copied to Google from anywhere else. "Disconnect Google" in the form settings revokes the token at Google and deletes these records at once; deleting your Formgong account deletes them too. You can also remove access at myaccount.google.com/permissions.

Sharing. Formgong does not sell, rent or trade Google user data and does not share, transfer or disclose it to third parties, except: Google itself (the Sheets and Drive APIs receive the rows you send); Cloudflare, our hosting and database sub-processor bound by a data processing agreement, which stores the encrypted token; and where the law requires it. Formgong staff do not read Google user data unless you ask us to for support, to investigate abuse or security issues, or to comply with the law.

Limited Use. Formgong's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

No AI training. Formgong does not use Google user data, raw, aggregated, anonymised or derived, to create, train or improve any artificial intelligence or machine learning model, generalized or not, and does not send it to any AI or machine learning service. Formgong's AI features never receive data obtained from your Google account.

Google API Services User Data Policy

Does formgong.com use cookies?

When you open a page on formgong.com without being signed in, we count the visit: the page, the domain of the site that linked to it, your country, the name of your network operator, your browser's user-agent string, how long the page was on screen, how far you scrolled, and whether you moved the mouse, touched the screen or pressed a key (to tell people from bots). These are kept under a daily code made from your IP address and browser with a server secret. The IP address itself is not stored, and the code changes every day. Records are deleted after 12 months. We use them only for statistics about this website (legitimate interest, GDPR Art. 6(1)(f)) and do not share them.

To tell a returning visit from a new one, the first-party cookie fg_seen holds only the date of your first visit, with no identifier, for up to 13 months. It is not renewed and not shared. If your browser sends Global Privacy Control, the cookie is not set. You can turn visit counting off in this browser:

Don't count my visits

Emails about your account and offers

If you have a free account and stop using it, we may send you one email with an offer for Formgong itself, for example a free month of Pro. We never send offers from other companies. Every such email has a link to stop them, and you can turn them off under Account → Email preferences ("Tips").

Product questions

On shops whose owner turned on product questions, the question you type in the “Questions about this product” box is stored in the EU database with the product and the page it was asked on. To write the automatic answer, your question, this product's catalogue details, excerpts of the shop's pages and some of the product's approved reviews (without reviewers' names) are sent to Cloudflare Workers AI, which may process them outside the EU. Your question and the answer are also checked there for harmful content. The automatic answer is shown only to you. The shop owner sees your question and may publish it on the product page with their answer, without your name or email address. An unpublished question is deleted 90 days after you asked it, and the chat record behind it after 30 days. We do not store your IP address, only a keyed hash for rate limits. If you press “Send the question to the shop” and agree, your email address and the question go to the shop so it can reply. The shop owner is the controller of this data and Formgong is the processor.

Spam protection signals

To keep automated spam out, each submission is checked with short-lived technical signals. Formgong computes a keyed hash of the sender's IP address, browser user agent and language with a key that changes every UTC day, and keeps only that hash in hourly counters that are deleted within 48 hours. The raw values are not stored. When the site uses fg.js, the browser also sends how long the form took to fill, whether its fields received typing or paste events (counts only, never the keys pressed), and the result of a small proof-of-work calculation. These signals only raise a spam score. They create no cookie, no persistent identifier and no browser fingerprint. The daily hash is compared across Formgong forms only to spot bursts from one sender; it is not used to follow visitors across websites, for profiling or for advertising. Legal basis: legitimate interest in protecting the service and our customers' inboxes from abuse (Art. 6(1)(f) GDPR).

Product news

Product news is optional: about one email a month on what changed in Formgong. The sign-up box starts unchecked. If you tick it, use the subscribe form in the footer or on the blog, or press Subscribe in Account → Email preferences, Formgong stores your email address, the time, where you subscribed and your language in its own database (Cloudflare D1, EU jurisdiction) and sends one confirmation email through its own mail server in the EU. No news is sent until you press the button in that email; an address that is not confirmed within 30 days is deleted. Formgong sends the news itself, from its own mail server in the EU (mail.formgong.com), so no newsletter service gets your address. Links to formgong.com in the news carry the issue name, so clicks are counted per issue, not per person; there is no tracking pixel. Every issue has a one-click unsubscribe link, and Account → Email preferences has an Unsubscribe button. After you unsubscribe, the address stays marked as unsubscribed so no more news reaches it; deleting your account deletes it. Legal basis: consent under GDPR Article 6(1)(a).

Shopify app

When a store installs the Formgong Shopify app, Formgong reads the shop name, contact email, myshopify.com domain, primary domain and timezone from Shopify, and stores an offline access token encrypted in the EU database. The app's theme blocks collect what a shopper submits: contact-form fields, and for reviews the name, email, star rating, review text, optional photos or video and the Shopify customer id when the shopper is signed in to the store. This data is handled by the same sub-processors this page already lists. Uninstalling the app deletes the access token at once; 48 hours later Shopify's shop/redact request deletes the store's forms, messages and reviews, and the account too when the app created it and nothing else uses it. Shoppers send access or deletion requests through the store owner, and Formgong answers them through Shopify's customers/data_request and customers/redact webhooks. If the store turns on review emails, Formgong also receives the store's fulfilled and cancelled orders from Shopify: the order number, the buyer's email address, language, billing country, email marketing consent and the ordered products. They are used only to send that store's review request and at most one reminder, and to mark reviews sent from that email as from a verified buyer; they are deleted 30 days after the order's last email.

AI search statistics

When an AI assistant (for example ChatGPT or Perplexity) fetches a public review page or form, or a visitor arrives from an AI assistant's site, we add one to a daily counter for that page and assistant. We store only the date, the page, the assistant name and the count: no IP address, no full user agent, no query string and nothing about the person. Counters are deleted after about 13 months or when the page is deleted.

Attachments

When attachments are enabled, PDF, JPEG and PNG files are scanned by private ClamAV on a server operated by Formgong at Contabo and stored in private EU-jurisdiction Cloudflare R2. Only the signed-in form owner can download them. File contents are never sent to an AI provider. Files follow form retention and are deleted with submissions, forms or accounts; storage outages are retried and download access is revoked immediately.

Contact

Questions about privacy, these terms, or your data go to Formgong: support@formgong.com