Privacy policy

Last updated: October 22, 2026

This privacy policy describes how splitforms.com ("we", "us") collects, uses, and protects information about you when you use our service. We aim for the shortest, plainest policy we can write while still being honest. The service is operated by TownMediaLabs; operator contact details are in the DPA.

What we collect

Account data. When you sign up, we store your email address and (optionally) a display name. If you sign in with Google, we additionally receive the email address and name from your Google profile. We do not request or store any other Google data unless you connect Google Calendar to Booking (described below). If you record electronic acceptance of the DPA, we also store your customer legal name and mailing address, authorized signer’s name, role, contact email, agreement version and acceptance time with your account for contractual records.

Google Calendar (Booking). If you connect Google Calendar to a booking page, we ask Google for permission to view and edit events on your calendars. We use it for two things only: we read the start and end times of your events (and whether each one is marked busy) so busy times aren't offered on your booking page, and we add, move and delete an event for each booking, with a Google Meet link when a service asks for one. Event titles, descriptions and guests of your own events are not stored or shown to anyone; busy times are kept in memory for about a minute. Access tokens are stored encrypted, and you can disconnect at any time in Booking › Settings › Calendar & video, which deletes the access we saved; you can also remove splitforms from your Google Account's third-party access page at any time. splitforms' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, sell it, or use it to train AI models.

Form submissions. When a visitor submits a form using your access key, we store the submitted fields, the visitor's IP address, user agent, and referer. Submissions are visible only to you (the form owner) and our service operators for support and spam-prevention purposes.

Usage. We log basic request metadata (IP, path, status code) for operational monitoring and abuse prevention. We do not run third-party analytics on your dashboard.

What we don't do

We don't sell or rent your data. We don't share submission contents with third parties unless legally required. We don't send marketing emails to your form submitters — they only receive mail you (or your auto-responder) explicitly send.

Data retention

Submissions have no automatic expiry on any plan, Free included: they are kept until you delete them or delete your account. Uploaded files are kept alongside their submissions, including submissions in the Spam folder, until you delete them. You can delete individual submissions or your entire account at any time from the dashboard. A deleted submission moves to the recycle bin and is permanently deleted after 180 days, or immediately if you empty the bin. When you delete your account, its primary data is removed and associated backups rotate within 30 days.

If a paid plan lapses, the account falls back to the Free tier rather than being deleted: you can still sign in and export your data. Stored files are kept for 30 days after the lapse and then deleted; submissions themselves are not deleted.

Subprocessors

We use the following services to operate splitforms.com:

• Supabase / AWS (database, auth, file storage) — submissions, account data, and connected storage uploads are stored on Supabase-managed AWS infrastructure.
• Hostinger (application hosting) — runs the splitforms application and serves the dashboard and API; also acts as one of our outbound email relays.
• Cloudflare (DNS, CDN, edge) — provides DNS, proxies and caches traffic, and terminates TLS at the edge.
• Google (email delivery, OAuth, integrations) — Google Workspace relays notification and auto-responder email; Google OAuth powers "Continue with Google" sign-in; and the Google Sheets and Google Drive integrations access only the files splitforms creates in your Google account, when you connect them; Booking reads busy times from and adds booking events to a Google Calendar you connect.
• Zoho ZeptoMail (email delivery) — relays transactional and notification email.
• Amazon SES (email delivery) — an additional email delivery provider in our sending pool.
• Stripe (billing and payments) — processes plan payments and, where a form owner connects Stripe, form payments. splitforms never sees or stores card numbers.
• Square (payments) — processes form payments for owners who connect a Square account. splitforms never sees or stores card numbers.

Security

All traffic is encrypted in transit via TLS. Submissions are encrypted at rest. Database access is restricted to a small set of service operators. Form submissions are protected by per-form access keys, rate limits, quotas, honeypot filtering, and key rotation.

Your rights (GDPR, CCPA)

You can access, correct, export, or delete any of your data at any time from the dashboard. For GDPR/CCPA-specific requests, email hello@splitforms.com and we'll respond within 30 days.

Changes

If we make material changes to this policy, we'll email registered account holders at least 30 days before the change takes effect.

Contact

Questions or concerns? hello@splitforms.com