Privacy Policy
Last updated: May 7, 2026
1. Who We Are
PaceForms ("we", "our", "us") provides an online form builder and form backend service at paceforms.com and app.paceforms.com. We are the data controller for information collected through our website and platform.
For questions about this policy or your data, contact us at: privacy@paceforms.com
2. What Data We Collect
2.1 Account Data
When you create an account we collect your name, email address, and encrypted password. If you sign up via OAuth (Google, GitHub), we receive your name and email from that provider.
2.2 Form Submission Data
When visitors submit a form you have built with PaceForms, we store the submitted field values, submission timestamp, and the submitter's IP address (for spam prevention). You — the form owner — are the data controller for this data. We process it on your behalf.
2.3 Usage Data
We collect basic usage events such as pages visited, forms created, and features used. This data is aggregated and used to improve the product.
2.4 Technical Data
We automatically log IP addresses, browser type, device type, and referring URLs when you access our services. This data is used for security, debugging, and analytics.
2.5 Payment Data
We use Stripe to process payments. We do not store your full card number — Stripe handles all cardholder data. We retain billing history (invoices, plan changes) associated with your account.
2.6 Cookies
We use essential cookies to keep you logged in and maintain your session. With your consent, we also use analytics cookies. See our Cookie Policy for full details.
3. Legal Basis for Processing (GDPR)
If you are in the European Economic Area (EEA), UK, or Switzerland, we process your personal data under the following legal bases:
| Purpose | Legal Basis |
|---|---|
| Providing the service | Contract performance |
| Billing and invoicing | Contract performance / Legal obligation |
| Security and fraud prevention | Legitimate interests |
| Product analytics | Legitimate interests |
| Marketing emails | Consent |
| Analytics cookies | Consent |
4. How We Use Your Data
- → To operate and improve the PaceForms platform
- → To authenticate you and maintain your session
- → To store and deliver form submissions to you
- → To process payments and send invoices
- → To detect and prevent abuse, spam, and security threats
- → To send transactional emails (submission alerts, account notifications)
- → To send product updates and feature announcements (with your consent, opt-out any time)
- → To comply with legal obligations
5. Data Storage and Security
All data is stored on servers located in the European Union (Frankfurt, Germany). Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). We implement access controls, audit logs, and regular security reviews.
No system is 100% secure. If a breach occurs that affects your personal data, we will notify you and the appropriate supervisory authority within 72 hours as required by GDPR.
6. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data | Until account deletion + 30 days |
| Form submissions | Until you delete them or close your account |
| Billing records | 7 years (legal requirement) |
| Server logs | 90 days |
| Analytics data | 26 months |
7. Third-Party Services
| Service | Purpose |
|---|---|
| Stripe | Payment processing |
| Postmark / Resend | Transactional email delivery |
| Cloudflare | CDN, DDoS protection |
| Vercel Analytics | Anonymised page analytics (with consent) |
We do not sell your data to third parties. We only share data with processors that have signed a Data Processing Agreement (DPA) with us.
8. Your Rights
Depending on your location, you have the following rights regarding your personal data:
- Access — Request a copy of the personal data we hold about you.
- Rectification — Ask us to correct inaccurate or incomplete data.
- Erasure — Request deletion of your personal data ("right to be forgotten").
- Restriction — Ask us to limit how we process your data in certain circumstances.
- Portability — Receive your data in a machine-readable format (JSON/CSV).
- Objection — Object to processing based on legitimate interests.
- Withdraw Consent — Withdraw marketing or cookie consent at any time without affecting prior lawful processing.
To exercise any right, email privacy@paceforms.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
9. International Transfers
Our primary infrastructure is in the EU. Where we use sub-processors outside the EEA, we ensure adequate protections via Standard Contractual Clauses (SCCs) or an equivalent approved transfer mechanism.
10. Children's Privacy
PaceForms is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or via a notice in the product at least 14 days before the change takes effect. Continued use after that date constitutes acceptance of the updated policy.
12. Contact
For any privacy-related questions or requests: