Security and data protection
Formboost receives other people's personal data on your behalf — names, email addresses, and whatever else your forms ask for. This page sets out what we do with it, who else sees it, and what you can do about it.
We never sell your data
Submissions are not sold, rented, brokered, or used for advertising or profiling. Formboost makes money from subscriptions, not from your data.
Your submissions are yours
You can export everything as CSV at any time, and delete a form or your whole account whenever you want. Deleting a form deletes its submissions with it.
Encrypted in transit
Every request — the public form endpoint, the dashboard, the API, and outgoing webhooks — is served over TLS. Webhook destinations must be public HTTPS URLs.
Who controls the data
Under the GDPR, you are the controller of the submissions your forms collect: you decide what to ask for, why, and how long to keep it. Formboost is your processor — we store and deliver that data on your instructions and do nothing else with it.
That means the people filling in your forms are your data subjects, not ours. If one of them asks you for a copy of their data or asks you to erase it, you can action it yourself from the dashboard, and we will help if you need us to.
For your own account — your email address and billing details — Formboost is the controller, and the privacy policy covers what we do with it.
What we store
| Submission content | Whatever fields your form posts, stored as JSON exactly as submitted. |
| Submission metadata | Timestamp, spam score, read state, and the form it belongs to. |
| Account data | Your email address, and a bcrypt-hashed password or a Firebase identity. |
| Integration config | Destination URLs and any custom headers you add, used to deliver submissions. |
| Billing records | Subscription and payment references. Card details never touch our servers — Razorpay handles them. |
We do not run trackers or fingerprinting on the forms you host. The submission endpoint records what your form posts — nothing about the visitor beyond that.
How it is protected
Transport security
TLS on every endpoint, terminated at the edge. Standard security headers are set on API responses via Helmet.
Authentication
Dashboard access uses signed JWTs, and new accounts must verify their email address before the API accepts a request from them.
Endpoint hardening
The public submission endpoint is rate limited per IP, rejects oversized bodies, and screens for spam before anything is stored.
Webhook delivery
Destinations must be public HTTPS URLs — private and loopback addresses are rejected, which prevents Formboost being used to reach internal networks. Authenticate deliveries with your own custom headers.
Who else processes it
Running Formboost means using a small number of other services. These are the ones that can see personal data, and what they see. We do not add a subprocessor that touches submission content without updating this list.
| Service | Purpose | What it can see |
|---|---|---|
| Google (Gemini API) | Spam screening | Submission content, when your plan's advanced or AI screening tier is active |
| Google (Firebase) | Sign-in | Account email and authentication identifiers |
| Razorpay | Payments and subscriptions | Billing identifiers and payment details you enter with them |
| Email delivery provider | Notification emails | Recipient address and submission contents included in the notification |
| Tawk.to | Support chat on this website | Whatever you type into the chat widget, only after you accept optional cookies |
| Google Analytics | Website analytics | Usage data on formboost.app only — never submission data, and only after consent |
Submissions are also delivered to whichever destinations you configure — your Slack workspace, your Discord server, your Telegram chat, your own webhook endpoint. Those are your choice and your responsibility, and we deliver only where you tell us to.
Retention and deletion
Submissions are kept until you delete them. There is no automatic expiry today, so data minimisation is in your hands: delete submissions you no longer need, and delete forms you have finished with. Deleting a form removes its submissions, and deleting your account removes everything associated with it.
We would rather tell you that plainly than imply a retention schedule we do not yet enforce. Scheduled retention is on the roadmap; until it ships, exports and deletion are the controls you have.
Exercising GDPR rights
- →Access and portability: export any form's submissions as CSV from the dashboard, or pull them through the API.
- →Erasure: delete individual submissions, a whole form, or your account.
- →A data processing agreement: email us and we will put one in place for your account.
What we do not claim
Formboost is a young product, and it is worth being straight about where we are. We hold no third-party certifications — no SOC 2 report, no ISO 27001, no independent penetration test to share yet. Anyone claiming otherwise about us is wrong.
If your organisation requires a certified processor today, we are not the right fit yet, and we would rather say so than lose your trust later. If you need something specific to sign off on Formboost, ask us and we will tell you honestly whether we can meet it.
Reporting a vulnerability
If you have found a security issue, email [email protected] with enough detail to reproduce it. We will acknowledge your report, keep you updated while we fix it, and we will not pursue action against good-faith research that respects other people's data. Please do not test against forms that are not yours.
Questions about how we handle your data?
Ask us anything about processing, subprocessors, or a data processing agreement.