CraftForm
Privacy Policy
Effective July 29, 2026
This policy covers two groups of people: the businesses that build forms with CraftForm, and the people who fill those forms out. What we collect, and who to ask about it, differs between them — section 2 explains which one you are.
1. What this policy covers
This policy explains what GreyBottle LLC ("GreyBottle", "we", "us") collects when you use CraftForm — the marketing site at craftform.io and the application at app.craftform.io — how we use it, how long we keep it, and what you can ask us to do about it. It does not replace our Terms of Service, which govern your use of the service.
CraftForm is offered to business customers located in the United States, and this policy describes rights available under United States state privacy laws. We do not offer rights under the General Data Protection Regulation or United Kingdom data protection law, and we have not appointed a representative in the European Union. Section 15 explains where your data is processed.
2. Customers and respondents
Two different groups of people show up in CraftForm, and this policy treats them differently because the law does.
Customers hold CraftForm accounts and build forms. If that is you, we collect information about you directly and we decide how it is handled — sections 3 and 13 apply to you.
Respondents fill out forms that Customers built. If that is you, the business whose form you filled out decides what is collected, why, and how long it is kept. We store and process those answers on that business's behalf and on its instructions — in the language of United States privacy law, they are the controller and we are their service provider. Beyond running the service for that business, we use respondent answers only as section 6 describes — keeping the service working and secure, metering usage for billing, and producing aggregated, de-identified statistics that are not linked to you.
This matters when you want something done. If you are a respondent and you want your answers corrected or deleted, ask the business that sent you the form. We will help them carry it out, but we will not act on their data without their instruction, and we usually have no way to know who you are. Section 13 covers this in more detail.
3. What we collect from customers
If you hold a CraftForm account, we collect:
- Account information — your name, email address, and authentication identifiers, handled by our authentication provider;
- Billing information — your billing contact details and subscription status. Payment methods are held by our payment processor. We never receive your card number;
- What you build — your forms, questions, templates, themes, and settings;
- AI prompts — the instructions you give our AI features and a summary of the changes they made;
- Usage data — token counts for each AI generation and each classified response, the structure of the forms you build, response timings, and which features you use;
- Support correspondence — what you write to us and what we write back.
Usage data is not optional. Token counts are how credits are metered and billed, so there is no setting that turns them off. It is first-party data recorded by CraftForm itself, not by a third-party analytics service — see section 8.
4. What we collect from respondents
When you fill out a form built with CraftForm, we store the answers you give, any files you upload, the time you submitted, your browser's user agent string — the text a browser sends identifying itself and your operating system — and the referring address, meaning the web address of the page that linked you to the form.
Your IP address is not stored. We read it while your submission is in flight, to enforce rate limits and block automated abuse, and it is held only in memory for that purpose. It is never written to our database and it is never attached to your response.
Beyond that, we know only what the form asked you. If the form does not ask for your name or email, we do not have them. Whether a form asks for identifying information is the form owner's decision, not ours.
5. If you're in the Tester Program
Inside the product, we collect exactly what we collect from every other account. Being a tester changes which features you can reach and what your usage limits are. It does not switch on any additional monitoring, and there is no tester-specific data collection in CraftForm.
What is different happens outside the product:
- Feedback calls. We take written notes. Calls are not recorded and not transcribed;
- Direct correspondence with our engineering team;
- Your application responses — what you told us on the Tester Program application form.
The application form is a CraftForm form that we own, so section 2 works in reverse for it: there, we are the controller rather than a service provider, and you can ask us directly about those answers under section 13.
What the program requires of you — cohort length, credits, and what happens when a cohort ends — is governed by separate Tester Program terms rather than by this policy.
6. How we use information
We use what we collect to:
- operate CraftForm and provide the features you use;
- provide support when you ask for it;
- keep the service secure and prevent fraud, spam, and automated abuse;
- meter usage and bill you correctly;
- send transactional messages — response notifications, billing notices, security alerts, and changes to our terms;
- produce aggregated and de-identified statistics about how the service is used.
That list is exhaustive, and it is consistent with the licence you grant us in section 5 of the Terms of Service. Aggregated statistics are not linked back to you or to any respondent.
7. AI features
CraftForm's AI features — form generation, adaptive follow-up questions, and response analysis — run on third-party AI providers. To provide them we send the relevant form content and responses to those providers through their commercial APIs. We may change providers, and we will tell you before we do.
Neither we nor our AI providers train or fine-tune models on your data. That commitment is a term of our agreements with them, and it covers your forms, your prompts, and every response your forms collect.
8. What we don't do
- We do not sell personal information and we have not sold any in the preceding twelve months;
- We do not share personal information for cross-context behavioural advertising — we do not disclose it to anyone for the purpose of targeting ads to you elsewhere;
- We do not advertise in the product or serve ads to your respondents;
- We do not train AI models on your data, and we do not permit our providers to;
- We run no third-party analytics. There is no Google Analytics, no product-analytics tool, no advertising pixel, and no session recording on craftform.io or in the application.
The last point is about third parties, not about measurement in general. CraftForm records the first-party usage data described in section 3 — token counts, form structure, response timings — because metering and billing depend on it. That data stays with us and with the infrastructure providers listed in section 9.
9. Service providers
We use these companies to run CraftForm. They may handle your data only to provide their service to us, and they are bound by contract to do nothing else with it.
| Provider | What they do | What reaches them |
|---|---|---|
| Clerk | Authentication and account management | Name, email address, authentication identifiers |
| Stripe | Payments and subscription billing | Billing contact details and payment method. Card numbers go to Stripe directly and never reach us |
| Cloudflare R2 | File and image storage | Files uploaded through your forms |
| Resend | Transactional email | Recipient address and message contents |
| Knock | In-app and email notifications | Recipient identifiers and notification contents |
| Svix | Outbound webhook delivery | Event identifiers and timestamps, and the endpoint addresses you configure |
| Vercel | Website and application hosting | Request metadata |
| Render | Application servers and database hosting | All stored application data |
| AI providers | Form generation, adaptive questions, response analysis | Form content and responses relevant to the feature. Providers are not named here and may change on notice — see section 7 |
We may also disclose information in two other situations: where the law requires it, such as in response to a valid subpoena or court order, and in connection with a merger, acquisition, or sale of substantially all our assets. In that second case the information stays subject to this policy until you are given notice of any change.
Two smaller services see a narrow slice of data. The font provider that serves the typefaces on craftform.io receives visitors' network addresses as part of loading them. Our image search runs on our own servers, so when you search for a stock photo your search terms reach the image providers but your network address does not.
11. How long we keep data
| Data | How long |
|---|---|
| Account and profile | Life of the account, plus 30 days after it closes |
| Forms, responses, uploaded files | Until you delete them. After your account closes, a 30-day window to export, then deleted |
| Billing and tax records | 7 years, as tax law requires |
| Server and security logs | 90 days |
| Email and notification delivery records | 90 days |
| Tester call notes and application responses | Life of the program, plus 12 months |
| Backups | Deleted data can persist in encrypted backups for up to 30 days before being overwritten |
| Aggregated, de-identified statistics | Indefinitely. Not linked to you or to any respondent |
Deleting a response removes it from the application immediately. It can survive in an encrypted backup for a short period after that, as the table says, and it is overwritten on the normal backup cycle.
12. Security
Data is encrypted in transit and at rest. Access to production systems is limited to the people who need it to operate and support the service. Our infrastructure providers are listed in section 9.
If we discover a breach affecting your data, we will notify you without unreasonable delay and tell you what we know, what we are doing about it, and what you should do.
No service is perfectly secure, and we do not claim any security certification or completed third-party audit.
13. Your privacy rights
California and a growing number of other states give residents rights over their personal information. We extend the following to all our customers, wherever they live, rather than checking your state first:
- Know and access — what we hold about you and where it came from;
- Correct — fix information that is wrong;
- Delete — remove your information, except what we must keep by law, such as billing records;
- Portability — receive a copy in a usable format;
- Appeal — ask us to reconsider if we turn a request down.
You will not be charged, denied service, or given a worse price for exercising any of these rights.
Some state laws also give a right to opt out of the sale of personal information, of sharing it for targeted advertising, and of profiling that produces legal or similarly significant effects. None of those apply here, because we do none of them — see section 8. There is no opt-out link on this site for the same reason.
How to make a request. Email support@greybottle.com from the address on your account and tell us what you want. We verify requests against your account email, and we may ask for more if something does not line up. We respond within 45 days, and will tell you if we need the extension the law allows.
If you filled out someone else's form, contact the business that sent it to you. They control those answers, and we act on their instructions — in most cases we have no way to identify which response is yours. If you write to us anyway, we will pass the request on to the form owner where we can identify them.
An authorised agent may make a request for you if they give us written proof of your permission.
14. Children
CraftForm is a business product for adults. You must be at least 18 years old to hold an account, and we do not knowingly collect personal information from anyone under 18. If we learn we have, we delete it.
Our customers must not use CraftForm forms to collect personal information from children. If you believe a child has given us information through a form, tell us at support@greybottle.com and we will work with the form owner to remove it.
15. Where your data is processed
CraftForm is operated from the United States, and your data is stored and processed there by us and by the providers in section 9.
Respondents can be anywhere, and forms are often filled out from outside the United States. If that is you, your answers are transferred to and processed in the United States, where privacy law differs from your own country's. Submitting a form means your data goes there.
16. Changes to this policy
We may update this policy. For material changes we will give account holders at least 30 days' notice by email to the address on the account or by notice in the service, and the update takes effect at the end of that period. The version in force always carries the effective date shown at the top of this page.
17. Contact us
CraftForm is operated by GreyBottle LLC, a New Jersey limited liability company. For anything about this policy, including privacy-rights requests, write to support@greybottle.com.