Privacy Policy

Last updated: 2026-07-31

FormHeron is operated by an individual in India. Contact: [email protected].

We process form submission data on behalf of our customers (they are the controller; we are the processor). Database hosting is in the EU (Amsterdam, Railway). Email and support operations are in India.

We do not store raw IP addresses. We store an HMAC hash for rate limiting. Session cookies are strictly necessary (httpOnly, Secure, SameSite=Lax). No analytics pixels.

Retention: Free 30 days, Indie 90 days, Pro 365 days, then hard-deleted. Project data export (JSON) and submission deletion are available under Dashboard → Data settings.

We do not claim to be "GDPR compliant" without qualification. See compliance status.