Privacy Policy
Last updated: February 2026
Who We Are
SignalForm is operated by MPV Labs LLC. We're a small company building a form builder we'd want to use ourselves. This policy explains what data we collect and what we do with it.
Short version: we collect what we need to run the service, we don't sell your data, and we don't use it for advertising.
What We Collect
Account information
When you sign up, we collect your email address and name. If you use Google sign-in, we receive your name, email, and profile picture from Google. We store a hashed version of your password — we never store it in plain text.
Form data
We store the forms you create, including questions, themes, and settings. This is your content — you own it.
Response data
When someone fills out one of your forms, we store their answers. You're the controller of this data — we're processing it on your behalf.
Usage data
We collect performance and usage metrics through Datadog RUM (Real User Monitoring). This includes pages visited, features used, browser type, and performance data. We use this to monitor reliability and improve the product.
Payment data
Stripe handles all payment processing. We store your Stripe customer ID so we can manage your subscription, but we never see or store your card numbers.
AI generation prompts
When you use AI to generate a form, your prompt is sent to the Anthropic Claude API. Per Anthropic's API terms, inputs are not used for model training. We don't send response data to any AI service.
What We Collect About Form Respondents
When someone fills out a form you created, here's what we collect about them:
- The answers they submit.
- Submission timestamp.
- Basic metadata: browser, device type, and IP address (used for spam prevention).
Here's what we don't do:
- We do not set tracking cookies on respondents.
- We do not share respondent data with third parties.
- We do not use respondent data for advertising or profiling.
How We Use Your Data
- To provide and operate the service — hosting your forms, processing responses, managing your account.
- To process payments through Stripe.
- To send transactional emails related to your account (not marketing emails).
- To monitor performance, fix bugs, and improve reliability.
We do not:
- Sell your data to anyone, ever.
- Use response data for advertising.
- Use your data to train AI models.
Third-Party Services
We share data with these services to operate SignalForm:
- Stripe — payment processing.
- AWS — infrastructure hosting. Your data is stored in the us-east-1 region.
- Cloudflare — CDN, DNS, and DDoS protection.
- Anthropic — AI form generation. We send prompts only, not response data.
- Datadog — application monitoring and analytics.
- Google — OAuth authentication, only if you choose Google sign-in.
We may also share data if required by law or in response to valid legal process, or in connection with a merger, acquisition, or sale of assets.
Data Retention
- Account and form data: retained while your account is active.
- Response data: retained while the parent form exists.
- After account deletion: data is deleted within 30 days. Backups are purged within 90 days.
- Logs and analytics: retained for 90 days.
Data Security
We use encryption in transit (TLS) and follow security best practices for our infrastructure. Passwords are hashed, sensitive tokens are encrypted with AES-256-GCM, and we run daily backups.
That said, no system is 100% secure. If we ever discover a breach that affects your data, we'll notify you promptly.
Cookies
Here's what cookies we use:
- Authentication cookies (httpOnly, secure) — these keep you signed in. They're essential for the app to work.
- Datadog RUM may set performance monitoring cookies to track page load times and errors.
We do not use third-party advertising or tracking cookies. We don't use cookies on the public form renderer — your respondents are not tracked.
Your Rights
You can:
- Export your response data anytime (CSV export is built in).
- Delete your account and all associated data from your account settings.
- Request a copy of all data we hold about you by emailing us.
EU/EEA residents (GDPR)
If you're in the EU or EEA, you have additional rights under GDPR including access, rectification, erasure, data portability, and the right to object to processing. Contact us to exercise these rights.
California residents (CCPA)
If you're in California, you have rights under CCPA including the right to know what data we collect, the right to delete it, and the right to opt out of its sale. We don't sell personal information, so there's nothing to opt out of — but we respect your rights all the same.
Children
SignalForm is not directed at children under 13. We don't knowingly collect data from children under 13. If we learn we've collected such data, we'll delete it promptly.
Changes to This Policy
We may update this policy from time to time. We'll notify users of material changes and update the "Last updated" date at the top of this page. Continued use of SignalForm after changes take effect means you accept the revised policy.