Privacy Policy

1. Introduction

FormJay ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our AI-powered document processing and form-filling service (the "Service").

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address
• Name (if provided)
• Payment information (processed securely through Stripe)

2.2 Customer Data

You are the controller of Customer Data. FormJay is the processor. When you use the Service, we may store and protect:

• Form templates and documents you upload
• Submission answers and files from your respondents
• Filled and summary PDFs, tables, and other content your company puts into the Service

We use Customer Data to provide, secure, and support the Service, or as required by law. We do not use identifiable Customer Data for our own purposes.

We may use aggregated, de-identified data that cannot reasonably be linked to any individual, respondent, or customer to understand usage patterns and improve the Service. Builder-flagged sensitive fields are encrypted at rest. Access to those values by a user on your account is logged.

2.3 Usage Data

We automatically collect certain information about how you interact with the Service, including pages visited, features used, and technical information.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process payments and manage your subscription
• Send you service-related communications
• Detect and prevent fraud or abuse
• Comply with legal obligations

4. Data Processing and AI

The Service uses artificial intelligence to process documents. When you upload a document:

• The document is sent to our secure servers for processing
• AI models analyze the document to extract relevant information
• Extracted data is used solely to fill your forms

We do not use Customer Data to train our own AI models.

We use third-party AI providers, including OpenAI, to process documents. These providers process data under their business/API terms, which do not use submitted content to train their models. Documents are stored securely and can be deleted as described in Section 7.

5. Data Sharing and Third Parties

We do not sell your personal information to third parties.

We share data only with service providers necessary to operate the Service (such as hosting, payment processing, e-signature, and AI processing providers), and only to the extent needed to provide the Service.

6. Data Security

We implement industry-standard security measures to protect your data, including encryption in transit and at rest, secure authentication, and regular security reviews. Security is a top priority. No system connected to the internet can be guaranteed impenetrable, and we are committed to continually strengthening our defenses against evolving threats.

7. Data Retention and Deletion

7.1 While Your Account Is Active

We retain your account information and Customer Data while your account is active. You may export your submission data at any time using the export tools in the Service (CSV, filled or summary PDF, and ZIP archives of selected or all submissions).

7.2 After Cancellation

Cancelling your subscription is a downgrade: you keep access on the free tier and your data stays. Closing your account is different: your access is ended, your public forms and workflows stop being served, and your Customer Data is held for 30 days and then deleted. Export your data before you close, as you cannot sign in afterward.

7.3 Your Retention Obligations

Retention required by your own laws or policies is your responsibility. If you must keep records longer than we do — including OSHA or other workplace records that can run 30 years — you must export and retain your own copies. FormJay is not your archive for that purpose.

7.4 Deletion on Request

Upon written request following account closure, we will permanently delete your Customer Data — including submissions, forms, templates, workflows, tables, and uploaded files — and destroy the company encryption key, rendering the encrypted field data unrecoverable going forward. Deletion is permanent and irreversible. A written request is processed within 7 days; in-product deletion runs immediately. Copies of signed documents held by our e-signature provider (SignWell) are outside this deletion.

7.5 What We Retain After Deletion

Separate from Customer Data, FormJay maintains a privacy access log. When someone on your account reveals a sensitive field, archives a submission, or downloads an artifact containing a sensitive field, we write an access-log event. These events contain metadata only — timestamps, action types, and field identifiers — and contain no Customer Data. Copies are retained in an append-only store for seven (7) years for security and compliance purposes and cannot be deleted during that period. This is FormJay's record of who accessed sensitive Customer Data. It is not retention of the Customer Data itself, and it is not a backup you can export in place of CSV, PDF, or ZIP.

Backup copies persist for our retention period. Database snapshots taken before key destruction may still contain the encryption key for approximately 120 days; snapshots taken afterward cannot decrypt the data. Retained file versions persist for 90 days and are not affected by key destruction.

8. Your Rights

8.1 Account Holders

If you are an account holder, you may access and correct your own account information, and you may request deletion of your account and Customer Data as described in Section 7. Access to your Customer Data is provided through the export tools in the Service. You may correct your Customer Data using the editing tools in the Service.

8.2 Respondents and Data Subjects

If you are a respondent — an individual who submitted information through a form created by a FormJay customer — the customer who created that form is the controller of your data. Depending on your location, you may have rights to access, correct, or delete your personal information. Please direct such requests to the customer who collected your data. FormJay, as the processor, will assist our customers in responding to these requests.

9. Cookies and Analytics

We use cookies necessary for the operation of the Service, including keeping you signed in.

On our public marketing pages, we use third-party analytics, including Google Analytics, to understand how visitors find and use our site. We do not run third-party analytics on pages where form content appears — form-filling pages, signing pages, workflow pages, and the signed-in dashboard are excluded, so information you or your respondents enter into a form is never shared with an analytics provider.

You can block or delete cookies in your browser settings; essential cookies are required to stay signed in.

10. Children's Privacy

The Service is not intended for use by individuals under 18, and we do not knowingly collect account information from children.

Customer Data may include information about minors — such as dependent information on benefits or enrollment forms — that our customers collect from adult respondents. We process such information as a processor on the customer's behalf. The customer is responsible for having a lawful basis to collect and use it.

11. Changes to This Policy

We may update this Privacy Policy at any time by posting the revised Policy on this page and changing the "Last updated" date. The most recent version supersedes all prior versions. Continued use of the Service after a change constitutes acceptance of the revised Policy.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us through our website.