Privacy Policy

Last updated: July 21, 2026

This Privacy Policy explains how Formit AI collects, uses, shares, and protects personal data when you visit our website, create an account, build and publish forms, or respond to a form hosted on our platform.

Who we are

Formit AI is an AI-powered form building platform operated from Lahore, Pakistan. Our services let you create forms with the help of artificial intelligence, publish them, collect submissions, analyze responses, and collaborate with your team.

This policy applies to:

  • Account holders — people who register and use Formit AI to create and manage forms, workspaces, and organizations.
  • Respondents — people who fill in and submit a form created with Formit AI.
  • Visitors — people who browse our website without an account.

Questions are welcome at tahir@neurodek.com.

Our role: data controller vs. data processor

For account holder data (registration info, billing, usage analytics) we are the data controller. For respondent submission data collected through forms you create, you are the controller and we act as your processor.

What we collect

We collect information in the following categories:

  • Account information: name, email, password hash, profile settings, organization membership.
  • Form content: form definitions, questions, logic rules, themes — created by account holders.
  • Submission data: responses submitted by respondents to forms you publish.
  • Usage data: pages visited, features used, form analytics events, device and browser metadata.
  • Technical data: IP address, browser fingerprint (for duplicate submission prevention), cookies.

How we use your data

  • Provide, maintain, and improve the Services;
  • Process AI form generation and follow-up question requests;
  • Send notifications you opt into (submission alerts, account emails);
  • Generate analytics about form performance;
  • Prevent fraud, abuse, and enforce our Terms;
  • Comply with legal obligations.

Who we share data with

  • AI providers (OpenAI): prompts and form context sent for AI generation. We do not send respondent personal data to AI models.
  • Infrastructure providers: hosting, database, email delivery services needed to operate.
  • Integrations you enable: Google Sheets, Zapier, Slack, WhatsApp — only the data relevant to the integration.
  • Legal requirements: when required by law or to protect rights and safety.

We do not sell personal data.

Data retention

Account data is retained while your account is active. After account deletion, primary data is permanently removed after a 7-day recovery window. Backup copies are purged within 30 days. We retain limited records (billing, legal compliance) as required by law.

Submission data is retained according to the form creator's policies. Respondents should contact the form creator to request deletion of their submission data.

Your rights

Depending on your jurisdiction, you may have rights to:

  • Access the personal data we hold about you;
  • Correct inaccurate data;
  • Request deletion of your data;
  • Restrict or object to certain processing;
  • Data portability;
  • Withdraw consent where processing is based on consent.

To exercise these rights, email tahir@neurodek.com.

Security

We implement technical and organizational measures including TLS encryption in transit, encrypted storage, access controls, and regular security reviews. No system is perfectly secure, but we take reasonable steps to protect your data.

Changes to this policy

We may update this policy from time to time. Material changes will be notified by email or through the Services at least 30 days before taking effect.

Contact

Related policies