Privacy Policy

This Privacy Policy explains how Velopulent LLP ("Velopulent", "we", "us", or "our"), the operator of Puffin Forms, collects, uses, stores, and protects personal information in connection with the Puffin Forms services ("Services").

By using the Services, you agree to the practices described in this Privacy Policy.

When you create forms and collect submissions using Puffin Forms, you act as the data controller for that data. We act as a data processor on your behalf.

For account registration, billing, and operational data, Velopulent LLP acts as the data controller.

Account Information

Name and email address provided during registration.

Form Submission Data

Data submitted through forms created using the Services, which may include names, email addresses, text inputs, and uploaded files.

Integration Data

If you connect third-party services such as Telegram, Discord, Slack, or others, we store access tokens in encrypted form.

Payment Information

Payments are processed exclusively by Polar.sh. We do not collect or store payment card information.

Technical and Usage Data

IP address, browser type, device information, and operational logs for security and performance.

We process personal data based on:

• Performance of a contract
• Legitimate interests in operating and securing the Services
• Legal obligations
• Consent, where required

• Provide and operate the Services
• Authenticate accounts
• Deliver form submissions
• Enable integrations
• Provide support
• Maintain security
• Comply with legal obligations

Optional AI features such as spam detection, translation, and summarization are executed only when enabled by the user.

When enabled, relevant submission data may be processed by third-party AI service providers solely to deliver these features.

Application data is hosted in Germany on Hetzner infrastructure.

File uploads are stored via Cloudflare R2.

Some service providers may operate outside your country of residence. Where required, we rely on appropriate safeguards such as contractual protections to ensure lawful data transfers.

We retain account data while your account is active.

Form submission data is retained until deleted by you or upon account deletion.

Backup data may persist temporarily in secure archives until overwritten.

Depending on your jurisdiction, you may have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion
• Restrict or object to processing
• Request data portability
• Withdraw consent where applicable

To exercise your rights, contact us using the details below. We may require verification of identity before fulfilling requests.

We will respond within a reasonable timeframe and in accordance with applicable law.

We do not sell personal data.

We may share information with:

• Hosting providers
• Cloud storage providers
• AI service providers (if enabled)
• Payment processor (Polar.sh)
• Authorities when legally required

We implement reasonable technical and organizational safeguards including encryption in transit and encryption of OAuth tokens at rest.

No system can guarantee absolute security.

We may update this Privacy Policy from time to time. Continued use of the Services constitutes acceptance of the revised version.

If you have questions about these Terms or the Services, you may contact us using the details below: