Legal
Privacy Policy
What Faldaro collects, what it stores, who controls it and how long it is kept — stated to match the product’s behaviour, not a template.
Last updated August 2026
1.Who is responsible for what
For your account details, Faldaro is the controller. For everything entered into a form — including submissions made anonymously through a public link — the organization that published the form is the controller, and we process that data on its behalf, under its configuration. To have information you submitted to a form corrected or removed, contact the organization that collected it; for account data, contact us directly.
2.What we collect
Account holders: your email address, password hash or sign-in identity, and the profile details you choose to add — display name, job title, phone number, locale, timezone and an avatar. Organizations: the forms, submissions, documents, reference data and configuration they create, and usage counts (submissions, storage, emails sent, AI credits) recorded per organization for the allowances on their plan. We also record the technical details of your own sessions and credentials — when a session started, the browser it began in, and when an API key was last used — so that you can review and end them. Actions taken in the platform are recorded in an append-only audit log that includes the acting user's email; audit entries cannot be edited or deleted, by anyone — that is the point of them.
3.Signing in through your organization
If your organization has configured single sign-on, signing in sends you to its own identity provider and we receive back only the identifier and email address that provider asserts about you — never your password, which we never see and never store. A session opened this way is confined to that organization and the organizations beneath it, even if you also belong to others. Whatever your provider requires of you at sign-in — multi-factor authentication, device checks — is its policy, applied before we are involved.
4.How we use it
Solely to provide the service: authenticating you, storing and processing form submissions, running the calculations and workflows an organization has configured, sending the notifications those workflows request, and metering plan allowances. We do not sell your data or use it for advertising.
6.Form analytics without tracking
Public form links count page views, form starts and completed submissions. These are counters and nothing else: no cookie is set for them, and no IP address, device identifier, user agent or any other per-visitor record is stored. The organization that published the link sees totals per day — it cannot see who visited, because nothing about who visited exists.
7.Anonymous submissions and download links
A form reached through a public link can be filled in without an account. What you submit goes to the organization that issued the link, and any files made available to you are collected through a private download link addressed only to you. Treat that link like a password: anyone holding it can use it.
8.Payments
When a form collects payment, your card details are entered into Stripe's own components and never touch Faldaro. We store the payment's amount, currency, status and Stripe references, which the organization uses to run its process (for example, releasing a purchased file once payment settles).
9.AI features
When you or your organization use an AI feature — the assistant, form generation, document import and prefill, plain-English search and reports, or standing agents — the content involved (your instructions, and the relevant form or submission data) is sent to our AI provider, Anthropic, to produce the result. AI features act only with the invoking user's permissions, agents only with the permissions their author explicitly granted, and usage is metered in credits. We do not use your data to train AI models.
10.Third parties
Beyond Anthropic and Stripe: Cloudflare Turnstile runs on public forms when an operator has enabled spam protection; Google provides optional sign-in and address autocomplete; and notification emails are delivered through the operator's configured email provider. Each receives only what its function needs. Separately, organizations can configure their own outbound integrations — Zapier, Slack and webhooks to endpoints of their choosing — and their own programmatic access through API keys; that sharing happens at the organization's direction and under its responsibility.
11.Retention and deletion
By default, submission data is kept for as long as the organization that owns it keeps it on the platform, and it remains available after a subscription lapses — nothing is deleted because a payment stopped. An organization can also set a retention period on any of its forms, after which submissions to that form are deleted automatically once they have gone unchanged for that long. That deletion is permanent and cannot be undone: the record, every revision of it, the files uploaded with it and the documents generated from it are all removed, and the deletion itself is written to the audit log so that it can be evidenced afterwards. Payment records survive, with their link to the deleted submission cleared, because financial records carry obligations of their own. Audit log entries are retained as a permanent record. Link analytics are daily counters retained indefinitely — they contain nothing about any individual. To have your information corrected or removed, contact the organization that collected it; for account data, contact us.
Contact
Questions about this policy? Email support@faldaro.com. Our Terms of Service describe the agreement under which the platform is provided.