Privacy
Last updated August 2026
What we hold
- Account details: your name, your business name and your email address.
- The documents you upload, and the completed documents produced from them.
- The answers your recipients submit, and the signature they draw.
- An audit trail of events — when a link was sent, opened, completed and signed, with the IP address and browser of the recipient at those moments.
What we do not hold
- We do not write form answers, signatures or signing links into application logs.
- We do not sell data, and we do not use your documents or your recipients’ answers to train anything.
How it is protected
- Submitted answers and signatures are encrypted with AES-256-GCM before they are written to the database.
- Files are stored privately and are only ever served through an authenticated route scoped to your organization.
- Signing links carry 256 bits of randomness and are stored only as a SHA-256 hash. They expire and can be revoked.
Sub-processors
- Hosting and database: Railway.
- Document understanding: OpenAI, when a key is configured, receives page images of an uploaded document during template creation only — never a recipient’s submitted answers.
- Email: the transactional email provider configured for your instance.
Retention and deletion
- You can set a retention period in Settings, and you can delete submissions, PDFs and signatures.
- Deleting an organization removes its documents and submissions.
Contact
- Questions about privacy can go to the address on your account.
These pages are written in plain language and have not been reviewed by a lawyer. Before FormFlow is used commercially they should be.