Privacy Policy — SimplyForms
Version 1.2 · Effective: December 1, 2026 (for new registrations from the date of publication)
The Czech version is the controlling version. This English translation is for convenience.
1. Controller
The operator of the SimplyForms service (the "Service") and the controller of customers' personal data is:
Adam Todt, self-employed person Business ID (IČO): 19197438 Tax ID (DIČ): CZ8909294592 (identified person under Section 6g of the Czech VAT Act; NOT a VAT payer) Registered office: Drahy 1625, 696 42 Vracov, Czech Republic Registration: Register of Persons (ROS) Data protection contact email: privacy@simplyforms.app
Adam Todt has not appointed a Data Protection Officer (DPO) under Art. 37 GDPR, as the core activities involve neither large-scale regular and systematic monitoring nor large-scale processing of special categories of personal data.
2. The two roles of SimplyForms — a key distinction
SimplyForms processes personal data in two different roles, depending on the context:
2.1 SimplyForms as controller (Art. 4(7) GDPR)
Vis-à-vis the Customer of the Service (the person or company that registers and obtains an API key), SimplyForms is the controller of the following data:
- Account email, password hash, form identifier (
form_id), - API key (stored as a SHA-256 hash),
- billing data and the customer identifier at Paddle,
- security logs (login, login IP address, refresh tokens),
- records of acceptance of the ToS, the DPA and related consents (audit trail).
2.2 SimplyForms as processor (Art. 4(8), Art. 28 GDPR)
Vis-à-vis visitors to the Customer's website who submit a form, SimplyForms is merely a processor acting on behalf of the Customer. The Customer is the controller — the operator of the website on which the form is embedded. The Customer is responsible for:
- obtaining a valid lawful basis under Art. 6 (and, where applicable, Art. 9) GDPR from its visitors,
- informing visitors under Art. 13 GDPR in its own privacy policy,
- handling data-subject requests (Art. 15–22) concerning form content.
This Privacy Policy does not apply to the content of forms submitted by visitors to our Customers' websites. The Customer's own privacy policy governs that matter.
For this role SimplyForms enters into a Data Processing Agreement (DPA) with the Customer — automatically accepted at registration; full text at simplyforms.app/en/legal/dpa.
3. Service architecture — a stateless email relay
SimplyForms is a stateless email relay. The content of submitted forms is not stored in any database or application log. The backend receives the HTTP POST, validates it, hands the email over to the Operator's outbound SMTP server and discards the payload from working memory. In the SMTP server queue the message is temporarily stored solely until delivery to the Customer's inbox, for no longer than 5 days; it is then irreversibly deleted. The SMTP server logs contain only addresses and message identifiers, not content.
We DO NOT STORE in the database:
- form content (no field, no value),
- the Submitter's IP address,
- the Submitter's user agent,
- the Submitter's referrer (only the domain is stored, see clause 4.2),
- uploaded files (passed on in the email, not persisted locally).
We process for a short time the Submitter's IP address in order to protect the Service: in memory (Redis) for the duration of the rate-limit window, for no longer than 60 seconds, and in the operational logs of the reverse proxy and of the application (IP address, time, request path without parameters) for the duration of log rotation, for no longer than 30 days. Lawful basis: legitimate interest in the security of the Service (Art. 6(1)(f) GDPR).
The SMTP relay is operated by Adam Todt on his own infrastructure in the European Union (data centre of Hetzner Online GmbH, Nuremberg). No third-party email service provider (e.g. SendGrid, Mailgun, Postmark, Resend, Amazon SES) is in the data path between the Service and the recipient's inbox.
Optional exceptions (always opt-in, configured by the Customer in the dashboard, available from the EXTEND plan):
- Webhook with metadata: if the Customer activates a webhook with opt-in metadata, the Submitter's IP address, user agent and referrer are sent to the Customer's webhook URL. No copy remains with us.
- Autoresponder: a confirmation email to the Submitter (requires an
emailfield in the payload). - Server-side validation (ENTERPRISE): checking of fields on the server before relaying. No persistence.
4. What data we process and on what lawful basis
4.1 Customer data (where we are the controller)
| Data category | Purpose of processing | Lawful basis (Art. 6 GDPR) | Retention |
|---|---|---|---|
| Account email + password hash, form and template configuration | Account operation, authentication | Art. 6(1)(b) — performance of a contract | For the life of the Account; on deletion of the Account deleted immediately; in encrypted backups for no more than a further 30 days |
| Unverified registration | Completion of registration | Art. 6(1)(b) | 30 days, then automatic erasure |
form_id, API key (SHA-256 hash) |
Authentication of API requests | Art. 6(1)(b) | For the life of the Account |
| Billing data, customer and subscription identifier at Paddle | Performance of a contract, accounting | Art. 6(1)(b) + Art. 6(1)(c) | 10 years (Section 31 of Act No. 563/1991 Coll. on accounting) |
| Login refresh tokens | Keeping the session, logging out all devices | Art. 6(1)(b) + Art. 6(1)(f) | 30 days or until logout |
| Email communication with support | Handling the inquiry | Art. 6(1)(b) + Art. 6(1)(f) | 24 months |
| Record of acceptance of the ToS / DPA / consents (version, time, IP address, user agent at registration and at activation of a paid plan) | Evidence of conclusion of the contract and of consents | Art. 6(1)(b) + Art. 6(1)(f) | For the life of the Account + 4 years (general limitation period) |
| Operational logs (reverse proxy, application): IP address, time, request path without parameters | Security, debugging | Art. 6(1)(f) | Rotated by volume, no longer than 30 days |
| Records of payment events (Paddle webhook, without payment details) | Plan billing, dispute resolution | Art. 6(1)(b) | 90 days |
4.2 Anonymous form-submission metrics
| Category | Purpose | Lawful basis | Retention |
|---|---|---|---|
form_id, timestamp, referrer domain, success flag (the IP address is NOT STORED) |
Customer statistics, abuse prevention, infrastructure optimization | Art. 6(1)(f) — legitimate interest in security and in providing statistics to the Customer | 90 days, then automatic erasure |
| Aggregate Submission count per form and the time of the last Submission | Customer statistics, plan limits | Art. 6(1)(b) | For the life of the Account |
These metrics do not enable the identification of an individual Submitter and are not regarded as personal data within the meaning of Art. 4(1) GDPR. We retain them as an anonymous aggregation for the purposes of billing against plan limits and for abuse detection.
4.3 Data in the case of a webhook with opt-in metadata (EXTEND+)
If the Customer actively enables opt-in metadata for the webhook in the dashboard:
| Category | Purpose | Lawful basis | Retention by us |
|---|---|---|---|
| Submitter's IP address, user agent, referrer | Passing on to the Customer for its own purposes | Art. 6(1)(b) performance of the contract with the Customer; the Customer is the controller of that data vis-à-vis the Submitter | 0 days — pass-through only, no copy kept by us |
4.4 Submitter data (where we are a processor for the Customer)
The content of the form completed by the Submitter. We do not store it. We merely relay it by email to the Customer's inbox.
5. Recipients of data (sub-processors)
We use the following sub-processors to operate the Service:
| Sub-processor | Purpose | Location | Transfer outside the EU | Safeguards |
|---|---|---|---|---|
| Hetzner Online GmbH | Infrastructure hosting (application server, server for the SMTP relay and CI/CD, encrypted backups on a Storage Box) | Germany (EU) | No | DPA, ISO 27001 |
Both the SMTP relay and CI/CD run on servers leased by Adam Todt from Hetzner and administered exclusively by him — no third-party email provider and no third-party CI operator processes the content of relayed emails or has access to production data.
Paddle is not a sub-processor. Paid plans are sold to the Customer by Paddle.com Market Ltd (30 Old Bailey, London EC4M 7AU, United Kingdom) as the seller (merchant of record). Paddle decides on the purposes and means of processing payment data itself and is therefore an independent controller in relation to that transaction, not a processor acting for us. We pass it the Customer's email address and account identifier; form Submitters' data never reaches Paddle at all. We never see or store a payment card or its number. Paddle terms: paddle.com/legal/checkout-buyer-terms; privacy policy: paddle.com/legal/privacy.
We maintain the current list publicly at simplyforms.app/en/legal/sub-processors. We notify changes by email to the Account address at least 30 days in advance; the Customer has the right to object to a change in accordance with the DPA and to terminate the Agreement free of charge on that ground.
Customer's optional integrations (Google reCAPTCHA, Cloudflare Turnstile, custom webhook URL): these are not SimplyForms sub-processors — where activated by the Customer, they constitute separate processing controlled by the Customer; the Customer is responsible for informing its Submitters about transfers of data outside the EU (in particular to the USA in the case of Google).
6. Transfers outside the EU
The entire SimplyForms infrastructure runs in the EU (Hetzner Nuremberg). As a rule no transfer of Customers' personal data to third countries takes place.
Exceptions:
Paddle (an independent controller, see Article 5) processes billing data in the United Kingdom and possibly also in the USA. The transfer is based on:
- the European Commission's adequacy decision for the United Kingdom of 19 December 2025 (valid until 27 December 2031, replacing Decision (EU) 2021/1772),
- for any onward transfers to the USA (Paddle.com Inc.), on the Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914, or on the EU-US Data Privacy Framework where Paddle.com Inc. is certified. Further information: paddle.com/legal/privacy.
Google reCAPTCHA / Cloudflare Turnstile activated by the Customer — the data flow takes place directly between the Submitter's browser and Google/Cloudflare. SimplyForms is not a processor in that data flow. The Customer must inform its Submitters about that data flow in its own privacy policy.
7. Cookies and localStorage
7.1 Marketing site (simplyforms.app)
No trackers, no third-party analytics. The site stores only strictly necessary items under Section 89(3) of Act No. 127/2005 Coll. (the Czech Electronic Communications Act):
- the cookie
i18n_redirected— remembering the chosen language, 365 days, localStoragenuxt-color-mode— display mode (the site is always dark; the value is stored automatically by the framework),localStoragesf-cookie-consent— record of the cookie consent decision, 12 months.
These items are not subject to consent under Art. 5(3) of ePrivacy Directive 2002/58/EC — the "strictly necessary" exemption. We do display a cookie banner on the marketing site; today the "Analytics" and "Marketing" choices switch no script on or off, because we load no such script.
7.2 Dashboard (dash.simplyforms.app)
We use only strictly necessary items under Section 89(3) of Act No. 127/2005 Coll.:
- login tokens in the cookies
auth.token(JWT) andauth.refresh-token— without them logging in is not possible, - the language cookie (
i18n_redirected) and preferences inlocalStorage: display mode (nuxt-color-mode), the last selected form, the template editor layout and the dismissed document-change notice.
These are not subject to consent under Art. 5(3) of ePrivacy Directive 2002/58/EC — the "strictly necessary" exemption. The dashboard does not display a cookie banner.
7.3 Planned analytics
If we introduce analytics or marketing trackers in future, we will ask for your consent again — specifically for the tools we will use, and always before their scripts are loaded. We will not rely on a choice recorded before they were introduced. We will also publish an update to the Cookie Policy. Current status: no analytics deployed.
Full cookie policy: simplyforms.app/en/legal/cookies.
8. Security measures (Art. 32 GDPR)
- TLS 1.3 for all communication (Caddy reverse proxy + Let's Encrypt, HSTS preload)
- API keys stored only as a SHA-256 hash (never in plaintext)
- Passwords stored as a bcrypt hash (cost ≥ 12)
- JWT with a short validity (30 minutes) + refresh token rotation
- Principle of least privilege (Docker
no-new-privileges, separate containers, read-only filesystem where possible) - No storage of form content = there is no attack surface for a payload leak
- Rate limiting + IP blocking in the event of abuse (Redis-backed)
- Regular code reviews and security audits
- Hosting in an ISO 27001 certified data centre (Hetzner Nuremberg)
- Encrypted database backups (AES-256)
For strategic reasons we do not publish specific security details; they are described in internal documentation available in audit mode.
9. Your rights (Art. 15–22 GDPR)
As a data subject you have the right:
| Right | GDPR Article | How to exercise it |
|---|---|---|
| Access — to obtain confirmation and a copy of the data processed | Art. 15 | Email to privacy@simplyforms.app or GET /user/{form_id}/export in the dashboard |
| Rectification — to correct inaccurate data | Art. 16 | Directly in the dashboard (Account section) |
| Erasure ("right to be forgotten") | Art. 17 | DELETE /user/{form_id}/account in the dashboard or by email |
| Restriction of processing | Art. 18 | Email to privacy@simplyforms.app |
| Data portability (machine-readable JSON export) | Art. 20 | GET /user/{form_id}/export in the dashboard |
| Objection to processing based on legitimate interest | Art. 21 | Email to privacy@simplyforms.app |
| Withdrawal of consent (without affecting processing before withdrawal) | Art. 7(3) | Directly in the dashboard or by email |
| Not to be subject to automated decision-making with legal effects | Art. 22 | SimplyForms uses rate limiting and IP blocking, but these do not constitute decisions with legal effects within the meaning of Art. 22(1) |
Time limit for handling a request: 30 days from receipt (extendable by 60 days in complex cases under Art. 12(3) GDPR).
If you are a visitor to a website who submitted a form operated by our Customer, please contact primarily the operator of that website — it is the controller of your data. We may, however, assist with erasure/export at the Customer's request.
10. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with the Czech Office for Personal Data Protection: Pplk. Sochora 27, 170 00 Prague 7 www.uoou.gov.cz
Or with the supervisory authority in the country of your habitual residence.
11. Customer obligations when processing Submitters' personal data
When using SimplyForms the Customer represents and warrants that:
- it has its own valid lawful basis under Art. 6 GDPR (and, where applicable, Art. 9 GDPR) for every form field whose data it processes;
- it will not process special categories of data under Art. 9 GDPR (health, racial/ethnic origin, political opinions, religious beliefs, sexual orientation, biometrics, genetic data) or criminal-offence data under Art. 10 GDPR through the Service without explicit consent from the Submitter and a completed DPIA;
- it informs its Submitters in its own privacy policy under Art. 13 GDPR, including of the fact that the data is transferred to SimplyForms as processor;
- in the case of opt-in features (webhook metadata, autoresponder, reCAPTCHA, Turnstile) it discloses the relevant data flows;
- the Service is not intended for children under 16 (Art. 8 GDPR); the Customer is responsible for age verification where relevant.
A breach of these obligations entitles SimplyForms to suspend or terminate the Account immediately without any entitlement of the Customer to a refund of Fees (see Articles 11 and 14 of the Terms of Service).
12. Personal data breaches
In the event of a personal data breach likely to result in a risk to the rights and freedoms of data subjects, we will:
- notify the Czech Office for Personal Data Protection within 72 hours of becoming aware of it (Art. 33 GDPR),
- notify the affected Customers without undue delay in high-risk cases (Art. 34 GDPR), or under Art. 33(2) GDPR for processor → controller notification.
13. Changes to this Policy
Material changes will be notified:
- by email to the Account address at least 30 days before they take effect,
- by a notification in the dashboard,
- by publication of the new version at simplyforms.app/en/legal/privacy stating its effective date.
Continued use of the Service after the changes take effect is deemed to be agreement with the new wording.
We will provide previous versions on request at privacy@simplyforms.app.
14. Contact
For data protection matters:
- Email: privacy@simplyforms.app
- Post: Adam Todt, Drahy 1625, 696 42 Vracov, Czech Republic
Version 1.2 · Effective: December 1, 2026
Document hash (SHA-256): 006e65a65c45d60fdce90a5ac78f8117eb08d86d749a1de7634e317d34591591