Skip to content
peachform

This English version is a translation for convenience: if it differs from the Spanish version, the Spanish one prevails.

Privacy

Last updated: 2026-10-28

Who is the controller

The owner of Peachform. You can write to us at hello@peachform.app about any privacy matter.

Two different roles

  • Your data as a customer (account, billing, usage): we process it as controller.
  • The data your forms collect (the answers and files of the people who fill them in): we process it on your behalf, as processor. You decide which questions you ask and why, and you are the controller of that data. It is governed by the data processing agreement.

What data we process

If you have an account

  • Your email and the identifier of the method you sign in with (Google or email link). There are no passwords.
  • Your forms: titles, descriptions, questions and settings.
  • If you are part of a team, the relationship with the owning account and the invitations sent.
  • If you buy a paid plan: the plan, the subscription status and the Stripe identifiers. Card details, address and tax ID are collected and stored by Stripe; we do not see them.
  • Usage counters (responses this month, storage) and technical logs without the content of the responses.

If you fill in a form

  • What you type or choose in the form and the files you upload.
  • The hidden fields the owner has set up (for example, utm_source), visible in the page address.
  • If the form has anti-spam protection turned on, Cloudflare Turnstile analyses signals from your browser to tell people from automated programs. We do not receive those signals, only the result.

What we do not store

  • We do not store the IP address or browser of people who answer a form. The IP is only used in memory to limit abuse.
  • We use no trackers, third-party analytics with cookies or advertising.
  • On the informational pages (not in the dashboard or in forms) we may count visits in aggregate with Cloudflare Web Analytics, which uses no cookies and identifies nobody.
  • We do not record the content of responses in technical logs.

Why, and on what legal basis

  • Providing the service, charging for it and supporting you: performance of the contract.
  • Telling you about new responses, your monthly usage or changes to the service: performance of the contract.
  • Protecting the service against abuse and fraud: legitimate interest.
  • Keeping invoices: legal obligation.

Who it is shared with

Only with the providers we need to operate, who act on our behalf:

  • Cloudflare: Hosting of the application, database (D1), uploaded files (R2), anti-spam protection (Turnstile) and network. Database and files stored in the EU (European jurisdiction of D1 and R2); global network and company based in the US..
  • Resend: Sending emails: response notifications, copies for respondents, sign-in links, invitations and usage warnings. Sent from the EU (Ireland); account data in the US..
  • Stripe: Charging for paid plans, invoices and taxes (only data of the person who subscribes). EU and US..
  • Google (only if you choose to sign in with Google): Sign-in: it gives us your verified email. US..

If you set it up, each new response is sent by email to your account, to your webhook address or to a Google Sheets spreadsheet in the Google account you connect; that destination is outside our control. For Google Sheets we keep, encrypted, the authorisation you give us, which only reaches the spreadsheets Peachform creates; we drop it when you disconnect. We do not sell data to anyone.

For how long

  • Your account, forms and responses: while the account exists. You can delete responses, forms or the account whenever you want; deletion is permanent.
  • Uploaded files are removed from storage within 24 hours after their response, form or account is deleted. Files uploaded without the form being submitted, within 48 hours.
  • Invoices, for the periods required by tax and commercial law, even if you delete your account.
  • Technical backups may keep data for a limited period.

Cookies and local storage

We only use strictly necessary technical cookies: the session cookie when you sign in and a temporary one (10 minutes) while signing in with Google. Both are HttpOnly. People who only fill in a form get no cookies from us; if the form uses anti-spam protection, Cloudflare may use its own for that check.

The browser's local storage (localStorage), which is never sent to our servers, keeps for up to 7 days the answers someone leaves half-finished, the team workspace you choose in the dashboard, the language you use Peachform in and how many responses you have seen for each form.

Your rights

You can access your data, correct it, delete it, take it with you, object or ask us to restrict its processing. Many of these actions are in Settings: download your account data (JSON), each form's responses (CSV) and delete the account. For anything else, write to hello@peachform.app. If you think we have not handled your request well, you can complain to the Spanish Data Protection Agency (aepd.es) or to your local supervisory authority.

If you filled in someone else's form, contact them first: they are the controller of that data and we will help them handle your request.

Security

Encrypted connections (HTTPS), sessions with secure cookies, tokens stored only as a cryptographic hash, isolation between accounts checked with tests, and files that only the form's owner (or their team) can download and that are never opened inside our website.

Start for free