Privacy Policy

This policy explains how Wisecat Software LLC, operating Nextforms (“we”, “us”), handles personal data. Nextforms is a form and workflow platform, which means we handle data in two distinct roles:

• For form owners (our customers): we are the data controller for your account information.
• For form respondents: the form owner who created the form is the controller of the data you submit. We process that data on the owner’s behalf as a processor. If you filled out a form built with Nextforms and have questions about your data, contact the form owner — they decide what is collected and why. Our processor obligations to owners are set out in our Data Processing Addendum.

Data we collect

Account data — name, email address, password (stored hashed), and organization details you provide when signing up.

Billing data — handled by our payment processor, Stripe. We never see or store full card numbers; we retain only subscription status and invoice metadata.

Customer content — the forms you build and the submissions you collect, including any files respondents upload. This may contain personal data of respondents, which the form owner controls.

Integration credentials — when you connect a service (such as Gmail, Outlook, Google Sheets, Slack, SMTP, SES, or Mailgun), we store the tokens or credentials needed to act on your behalf, encrypted at rest. OAuth tokens are used only to perform the actions you configure.

Usage and technical data — server logs (IP address, browser type, timestamps) for security and troubleshooting, and aggregate form-view counts. When a form owner limits a form to one response per person, we store a salted hash of the identifier the owner chose (such as the respondent’s IP address) solely to detect duplicates — never the raw value, and it is deleted with the submission. Our form analytics are first-party and aggregate; we do not use third-party advertising trackers.

Website analytics — our marketing website uses Cloudflare Web Analytics to count visits and see which pages people find useful. It is measurement, not tracking: it sets no cookies, uses no device fingerprinting, does not follow you across other websites, and does not build a profile of you. What it records is the page visited, the referring site, and coarse technical details such as browser and country. This runs on our marketing pages only — never inside a form a respondent is filling in.

Cookies and browser storage — we use essential cookies only: session authentication for the dashboard, Cloudflare Turnstile for bot protection on account and form endpoints, and a preference cookie that remembers your light/dark theme choice when you set one. We do not use advertising cookies.

One further piece of storage is worth naming, because it holds answers rather than settings. While someone is filling in a form, their in-progress answers are kept in that browser’s own storage, so a closed tab or a flat battery does not lose a half-finished form. Those answers stay on the device — they are not sent to us and not readable by the form’s author — and they are cleared as soon as the form is submitted, or after seven days if it never is. The form’s author can switch this off for a form, which is what we recommend for kiosks and shared devices.

How we use data

To provide and operate the Service; to execute the workflows you configure (sending emails, writing to spreadsheets, calling webhooks — strictly as you instruct); to process payments; to secure the platform against abuse; to provide support; and to send transactional messages about your account. We do not sell personal data, and we do not use Customer Content for advertising or to train machine-learning models.

Google user data

Nextforms’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Our Google Sheets integration uses the minimal drive.file scope: we can only access spreadsheets you explicitly pick or that the integration creates, and we use that access solely to provide the spreadsheet features you configure — never for advertising, and never transferred to third parties except as needed to provide the feature or as required by law.

Subprocessors

We share data only with service providers that help us run Nextforms:

• Amazon Web Services — email delivery (SES) and file storage
• Stripe — payment processing
• Cloudflare — DNS, content delivery, and bot protection (Turnstile)
• Google — sign-in and the integrations you connect (Sheets)
• Microsoft — sign-in and the integrations you connect (Outlook)
• Slack Technologies — the Slack integration, when you connect it
• Mailgun — email delivery, when you connect it

Integration providers (Google, Microsoft, Slack, Mailgun, your SMTP provider) receive data only when you connect them and only the data your workflows send them. We will update this list before adding subprocessors that process respondent data.

Data retention and deletion

Customer Content is retained while your account is active. Deleting a submission permanently removes it, including uploaded files. Deleting your account permanently deletes your Customer Content within 30 days, except where law requires longer retention. Suppression records (bounced or complaining email addresses) are kept as long as needed to protect deliverability.

Your rights

Depending on where you live (including under the GDPR), you may have rights to access, correct, export, or delete your personal data, to object to or restrict processing, and to lodge a complaint with a supervisory authority. Account holders can exercise most of these directly in the product; for anything else, email us. Respondents should direct requests to the form owner; we assist owners in fulfilling them.

International transfers

We are a US company and process data in the United States. Where we transfer personal data from the European Economic Area, the UK, or Switzerland, we rely on Standard Contractual Clauses and equivalent safeguards, as described in our Data Processing Addendum.

Security

We protect data with encryption in transit (TLS), encrypted storage of integration credentials, access controls, and tenant isolation. If we become aware of a personal data breach affecting your data, we will notify you without undue delay, consistent with applicable law and the DPA.

Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data as a controller. Form owners are responsible for ensuring their forms comply with laws protecting children’s data.

Changes

We may update this policy from time to time. Material changes will be announced by email or in-app notice before they take effect.

Contact

Wisecat Software LLC · operating Nextforms Email: [email protected]