FormVault

Privacy Policy

Last updated: September 2026

1. Data Controller

FormVault is operated as a data controller in accordance with the General Data Protection Regulation (GDPR). All personal data is processed lawfully, fairly, and transparently.

2. What Data We Collect

Account data: When you sign in via FjordID (our identity provider), we receive a user identifier, email address, and display name. We do not store passwords.

Form data: Forms and submission responses you create are stored encrypted at rest using AES-256-GCM. Only you and the people you authorise can decrypt and read them.

Usage data: We use self-hosted, cookieless analytics (Umami) for aggregate page-view counts — no cookies, no personal data collected, and no data leaves our EU servers. Basic server logs (IP address, timestamp, HTTP method) are retained for up to 30 days for security purposes.

Form view counts: When someone opens a published form, we record that a view happened, the time, and the website address it was linked from — the host name only, such as linkedin.com, never the full link. Referrer links can contain personal data in their path or query string, so we discard everything except the host before storing it. Visits with no referrer, or where the browser has stripped it, are recorded as direct. This tells the form's owner where their responses come from. No cookies are set, and nothing identifying the visitor is stored.

3. Legal Basis for Processing

We process personal data on the basis of:

  • Contract performance (providing the service you signed up for)
  • Legitimate interest (security logging)

4. Data Storage & Location

All data is stored on servers located in Germany (Hetzner Online GmbH, Nuremberg). No personal data is transferred outside the European Economic Area.

5. Retention

Your data is retained for as long as your account is active. You may delete your forms and submissions at any time from the application. Account deletion requests can be sent to the contact address below.

6. Your Rights

Under GDPR you have the right to access, rectify, erase, restrict, and port your personal data, as well as to object to processing. To exercise any right, contact us at the address below.

7. Contact

For privacy-related enquiries, email support@formvault.eu or use our contact form.