Effective 2026-05-09

Privacy Policy

1. Who we are

ONE FORMS ("we", "us") operates oneforms.in from Mumbai, India. We are the data controller for personal data collected via this site and a data processor for any personal data submitted to forms hosted on the platform by our customers.

2. What we collect

From visitors and account holders we collect:

• Account data — your email, name, hashed password, plan, last-login timestamp.
• Billing data — your GSTIN, billing address, billing state (only if you provide them), payment method tokens (held by Razorpay or as UPI transaction references — we never see your card number or full UPI PIN).
• Form definitions — the schema and configuration you build in our dashboard.
• Usage telemetry — IP address, user-agent, request paths, hashed for spam control.
• Cookies — a single first-party JWT cookie/localStorage entry to keep you signed in. No third-party tracking cookies.

From form submissions on customer forms we receive:

• Whatever fields the customer chose to expose (name, email, message, files, etc.).
• Submitter IP address and user-agent for spam control and rate-limiting.
• A timestamp.

3. Why we collect it

• To run your account, deliver submissions to you, and bill you.
• To prevent spam and abuse via rate-limiting, honeypots, and optional captchas.
• To meet legal and tax obligations (GST invoicing in India).
• To respond to support emails when you contact us.

We do not sell, rent, or trade personal data. We do not use submission contents to train models.

4. Where data is stored

All primary data is stored in PostgreSQL on our Oracle Cloud server in ap-mumbai-1(Mumbai, India). Daily encrypted backups are stored in the same region. File attachments, if enabled, are stored in Cloudflare R2 in the region nearest to our origin.

Email is delivered through Resend (resend.com). Outgoing transactional emails transit their infrastructure. Razorpay (razorpay.com) processes card and UPI payments and holds payment-instrument data on its servers in India.

5. Retention

• Free plan submissions: retained for 30 days, then permanently deleted by an automated nightly job.
• Hobby plan submissions: 180 days.
• Pro plan submissions: 365 days.
• Audit log: 12 months.
• Account data: until you delete your account (see Section 7).
• Backups: rolling 30 days, then overwritten.

6. Your rights (GDPR, DPDP Act 2023)

You may, at any time, without giving a reason:

• Export everything we hold on you in a single JSON file via Account → Export.
• Permanently delete your account and all linked data via Account → Delete account (irreversible).
• Edit your billing profile and email address.
• Withdraw consent to receive marketing email (we don't send any today, but should that change you can opt out).
• Lodge a complaint with your local data protection authority (in India: the Data Protection Board; in the EU: your national DPA).

7. Sub-processors

We use the following third parties strictly to deliver the service:

8. Customers as data controllers

When ONE FORMS is used as a form backend, the customer is the data controller for the submissions they collect from their visitors. We are a processor on the customer's behalf and only use submission contents to deliver them as configured. Customers must publish their own privacy policy covering the data they collect.

9. Children

The service is not intended for users under 16. We do not knowingly collect data from children. If you believe a child has signed up, email us at privacy@oneforms.inand we will delete the account.

10. Changes

We will email account holders at least 30 days before any material change to this policy. The current version's effective date is at the top of this page.

11. Contact

Privacy questions: privacy@oneforms.in.
General support: hello@oneforms.in.