Privacy Policy

FormEmailAPI is operated by DocumentMind LLC, registered in Cheyenne, Wyoming, United States. For account data we are the controller; for submission data we are a processor acting on your instructions.

FormEmailAPI handles two distinct kinds of information, and they are governed differently. Almost every question about this policy comes down to which of the two you are asking about.

For submission data we act as a processor on your behalf. You decide what your form asks for, how long it is kept, and when it is deleted. We process it to deliver it to you and to run the spam checks you enabled — nothing else.

Account data: your email address, authentication records, plan and usage counters, and — if you subscribe — a customer reference held by our payment processor. We never see or store full card numbers.

Submission data: the fields your form sends, plus limited request metadata used for abuse prevention — IP address, user agent, and the referring page. Metadata is shown to you alongside the submission and is removed when the submission is.

To deliver submissions to the address you configured, to apply the spam controls you turned on, to enforce plan limits, to bill you if you are on a paid plan, and to respond when you contact support.

We do not use submission content to train models, we do not build advertising profiles of the people who fill in your forms, and we do not sell any data to anyone.

Submissions expire on their own, according to your plan. You can also delete an individual submission, or an entire form and everything attached to it, at any time from the dashboard — that deletion is immediate and permanent.

Account data is deleted when you close your account, except records we are legally required to keep, such as invoices. Export everything you want to keep first — as CSV or JSON from the dashboard, or through the submissions API.

Submissions, attachments and account data are processed and stored in the United States. If you or your visitors are in the EEA, the UK or Switzerland, that is an international transfer; we rely on the European Commission's Standard Contractual Clauses, which form part of our Data Processing Agreement.

We use the following providers to run the service. Each processes data only on our instructions and is bound by its own data processing terms. We will update this list before adding anyone new.

If you enable webhooks or a chat integration, submissions are also sent to whichever destination you configured. Those are your processors, not ours — what happens to the data after it arrives there is governed by that service and by your agreement with it.

We set one kind of cookie: the session cookie that keeps you signed in to the dashboard. It is strictly necessary for the service to function and is not used for tracking. There are no advertising or profiling cookies anywhere on this site.

We measure site traffic with a privacy-friendly analytics tool that sets no cookies, records no personal data, and does not follow visitors across sites. It runs on our marketing pages only — never inside your forms or your visitors' submissions.

Data is encrypted in transit and at rest. Access to production systems is restricted and audited. Each form's endpoint is scoped to a single destination address, so a copied endpoint cannot be used to read your submissions or redirect them elsewhere.

No system is perfect. If we ever become aware of a breach affecting your data, we will tell you promptly and describe what happened.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to certain processing. The dashboard covers most of this directly — export and deletion are self-service.

For anything the dashboard does not cover, send a message from the contact page and we will respond within thirty days. If you need a signed Data Processing Agreement for your own compliance, one is published at /dpa, and /gdpr explains how the roles divide up.

You control what your form asks for, so you are responsible for telling your visitors how their information will be used and for having a lawful basis to collect it. If your form asks for sensitive information, that responsibility is heavier — please make sure you actually need it.

If this policy changes materially, we will update the date at the top and notify account holders by email before the change takes effect.