Privacy Policy

Shapeform is operated by ZekerCRM, trading as Shapeform (KvK 42148584), a eenmanszaak (sole proprietorship) established in the Netherlands (“Shapeform”, “we”, “us”). You can reach us about anything in this policy at support@shapeform.net.

This policy explains what personal data we process, why, on what legal basis, who we share it with, how long we keep it and what rights you have.

We process personal data in two different roles under the General Data Protection Regulation (GDPR):

• As controller for data about our own users: people who create an account, build forms, join a workspace, or contact us. We decide why and how this data is processed.
• As processor for the answers that people (“respondents”) give in forms built with Shapeform. The person or organisation that published the form (the “form owner”) decides what to ask and what to do with the answers, and is the controller. We only process those answers on their behalf and according to their instructions, under the data processing terms in our Terms of Service.

If you filled in a form and have a question about your answers, please contact the form owner first: they decide what happens with them. If you can't reach them, email us and we'll help where we can.

Account data. Your name, email address, password (stored only as a secure hash), the workspaces you own or belong to, your role, and settings you choose. If you sign in with single sign-on, we receive your name and email address from your organisation's identity provider.

Content you create. Forms, templates, themes, logos and other material you upload or write, and settings such as custom domains, white-label branding and sending addresses.

Billing data. Your plan, billing interval, subscription status and the invoices for it. Card details are entered directly with our payment provider Stripe; we never see or store full card numbers. For business plans we may receive your company name, billing address and VAT or tax ID.

Payments you receive through forms. If you connect a Stripe account to take payments in forms, we store your connected account ID and its status, and a record of each payment (amount, currency, status, the form it belongs to and the payer's email if they gave one).

Connected apps. If you connect Google Sheets, Slack, Notion, Airtable, Discord or another service, we store the access tokens or URLs needed to send your responses there, encrypted, plus basic account details such as the connected account's name or email.

Usage and technical data. When you use Shapeform we process technical data such as IP address, browser and device type, pages requested and timestamps. This is needed to run the service securely (for example rate limiting and abuse prevention; IP addresses used for rate limiting are stored only as a salted hash) and appears in the audit log of Team, Agency and Enterprise accounts.

Form responses (as processor). The answers respondents give, files they upload, hidden fields the form owner added to the link, and metadata such as submission time, device type, country (derived from the IP address, which we do not store with the response), the page or app the visitor came from, and how far they got in the form.

Communication. Emails and messages you send us, and reports about forms or templates.

AI features. When you use the AI form generator, the description you type is sent to an AI model to draft the form. Don't include personal data in these prompts.

• Providing the service: creating your account, hosting your forms, collecting and showing responses, sending notifications, running integrations and payments. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
• Billing and accounting: charging for paid plans and keeping financial records. Legal basis: contract and our legal obligations under Dutch tax law (Art. 6(1)(b) and (c)).
• Security and abuse prevention: rate limiting, spam and bot protection, detecting phishing forms, handling abuse reports, and keeping logs. Legal basis: our legitimate interest in keeping Shapeform, our users and respondents safe (Art. 6(1)(f)).
• Service emails: account, security, billing and legal notices such as changes to these documents. Legal basis: contract and legitimate interest.
• Improving Shapeform: understanding how features are used in aggregate, fixing bugs and planning new features. Legal basis: legitimate interest. We don't sell personal data and don't use form responses to build profiles or to train AI models.
• Legal claims and compliance: responding to lawful requests and defending our rights. Legal basis: legal obligation and legitimate interest.

We use carefully selected service providers (sub-processors) that process data on our behalf under contracts that protect it:

• Vercel Inc.: hosting, content delivery, file storage (Vercel Blob) and the AI Gateway that routes AI requests. Hosting and file storage are in Dublin, Ireland.
• Turso (ChiselStrike Inc.): our database, hosted in Ireland (AWS eu-west-1).
• Stripe: subscriptions, invoices and payments taken in forms. When you take payments, Stripe also acts as an independent controller under its own privacy policy.
• Postmark (ActiveCampaign, LLC): sending emails such as notifications, confirmations, invites and password resets.
• Anthropic, via the Vercel AI Gateway: AI form generation and automated checks of public templates and forms for abuse.
• Cloudflare, Inc.: the optional bot check (Turnstile) on forms where the form owner enables it.

Services you connect yourself. When you connect Google, Slack, Notion, Airtable, Discord, Zapier, Make or a webhook, we send your responses to that service on your instruction. That provider handles the data under its own terms and privacy policy.

Tracking set up by form owners. Form owners on paid plans can add Google Analytics, Google Tag Manager or a Meta Pixel to their forms. Those tools then collect data about visitors of that form for the form owner, who is responsible for having a legal basis and, where required, asking for consent.

Your workspace. Other members of a workspace you belong to can see that workspace's forms and responses, and its owner can see the audit log of actions taken in it.

Legal requirements. We may disclose data when required by law, a court order or a competent authority, or to protect the rights, property or safety of our users, respondents or the public.

Business transfers. If Shapeform is sold or merged, data may transfer to the new owner, who will remain bound by this policy until changed with notice.

We never sell personal data.

We sometimes contact businesses that might benefit from Shapeform by email or LinkedIn. For that we process business contact details (name, work email, company, job title, website, LinkedIn profile, country) that we found in public sources such as company websites, LinkedIn and business directories, or that you gave us.

Legal basis: our legitimate interest in promoting Shapeform to businesses (Art. 6(1)(f) GDPR), within the limits of e-privacy rules; for consumers and where the law requires it, only with your consent. We keep a record of where each contact came from.

Your choice: every email has an unsubscribe link, and replying “stop” works too. After that we never contact you again: we keep your address on a do-not-contact list, used only for that purpose. You can ask us at any time where we got your details, or to delete them, at support@shapeform.net. After deletion we keep only a one-way hash of your address, so we can still recognise it and never contact you again.

How long: if you don't respond, we delete your details within 12 months of our last contact. Outreach emails are sent from a separate domain we use for this purpose (for example getshapeform.net) and replies are handled by our team.

Shapeform's application, database and file storage are hosted in the European Union (Ireland). Some of our providers are based in, or have staff in, the United States or other countries outside the European Economic Area, notably for email delivery, payments and AI features. Where data leaves the EEA, we rely on an adequacy decision (such as the EU-U.S. Data Privacy Framework for certified companies) or on the European Commission's Standard Contractual Clauses, together with additional safeguards such as encryption in transit and at rest. You can ask us for more information about these safeguards.

• Account data and content: for as long as your account exists. When you delete your account we delete your account data, forms and responses immediately from our live systems; backups roll over within 30 days.
• Form responses: until the form owner deletes them, deletes the form, or an automatic retention period they set removes them.
• Billing records: 7 years, as required by Dutch tax law.
• Payment records for payments taken in forms: kept as financial records for as long as needed for accounting, disputes and refunds, and at most 7 years.
• Audit log: 12 months.
• Security and rate-limit records: from 24 hours up to a few weeks.
• Support emails: up to 2 years after the conversation ends.

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy;
• have incorrect data corrected;
• have your data deleted (you can delete your account yourself in Settings);
• restrict or object to processing based on our legitimate interests;
• receive your data in a structured, machine-readable format (you can export responses as CSV at any time);
• withdraw consent where we rely on it, without affecting earlier processing.

To use these rights, email support@shapeform.net from the address on your account. We'll answer within one month and may ask you to confirm your identity. For answers you gave in someone else's form, contact the form owner; we will pass on requests we receive and help them respond.

You also have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens; if you live elsewhere in the EU you can also contact your local authority. We'd appreciate the chance to solve your concern first.

We keep this minimal and don't use advertising cookies of our own.

• sf_session: keeps you logged in (strictly necessary, 30 days).
• sf_done_<form>: remembers that you already answered a form that allows one response per person (strictly necessary for that feature, 1 year).
• sf_vid (local storage): a random identifier used only to count unique views of a form for its owner, without tracking you across sites. Session storage is used to avoid counting the same view twice.
• Cloudflare Turnstile: if a form uses the bot check, Cloudflare may process technical signals to tell people from bots.
• Form owner tracking: forms may contain analytics or advertising tags added by the form owner (see “Who we share data with”).

We protect data with encryption in transit (HTTPS) and at rest, hashed passwords, encrypted storage of integration tokens and secrets, access controls, audit logging, rate limiting and regular updates. No system is perfectly secure; if a personal data breach affects you, we will inform you and the authorities as the law requires.

Shapeform accounts are for people aged 16 and over. Form owners who collect answers from children are responsible for doing so lawfully, including obtaining parental consent where required.

We don't make decisions with legal or similarly significant effects about you based solely on automated processing. Automated checks (for example spam detection or flagging possible phishing forms) can block a submission or hold a form for review; you can always contact us to have a person look at it.

We may update this policy, for example when we add features or providers. For material changes we'll notify you by email and in the app at least 14 days before they take effect, and show the date they apply from at the top of this page. Each version keeps its date so you can see what changed.

Questions about privacy or this policy: support@shapeform.net. Our details are listed at the bottom of this page.