MightyForms is now part of FormBuilder.AnnouncementMightyForms login

Privacy Policy

Last updated: August 18, 2026

Introduction

At FormBuilder, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our form building service.

By using FormBuilder, you agree to the collection and use of information in accordance with this policy.

Information We Collect

Personal Information

We may collect personally identifiable information, such as:

  • Name and email address
  • Billing information and payment details
  • Account preferences and settings
  • Communication history with our support team
  • Third-party integration settings you choose to configure

Usage Data

We automatically collect certain information when you use our service:

  • IP address and browser information
  • Pages visited and time spent on our service
  • Form creation and submission data
  • Connected integration status and delivery logs
  • Device and operating system information

Google Sheets Integration Data

If you choose to connect Google Sheets, FormBuilder uses Google OAuth to request access to your Google account only for the integration you configure. We may process your Google account email/profile information for connection status, spreadsheet and sheet metadata so you can choose where responses should go, and OAuth access or refresh tokens needed to keep the integration working.

FormBuilder uses this Google data to append form response rows to the Google spreadsheet and sheet you select. We do not sell Google user data, use it for advertising, or use it to train AI models. We do not read unrelated spreadsheet content except as needed to list spreadsheets, list sheet tabs, and append rows at your direction.

How We Use Your Information

We use the collected information for various purposes:

  • Provide, operate, and maintain our service
  • Improve and personalize your experience
  • Process payments and prevent fraud
  • Send important updates and notifications
  • Provide customer support
  • Analyze usage patterns to improve our service
  • Operate integrations you explicitly connect, including Google Sheets response sync

Google API Services User Data

FormBuilder's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and maintain user-facing Google Sheets integration features that you request.

  • We do not sell Google user data.
  • We do not use Google user data for advertising.
  • We do not use Google user data to train generalized AI or machine learning models.
  • We do not allow humans to read Google user data unless required for security, legal compliance, support you request, or with your explicit permission.
  • We share Google user data only with service providers needed to operate FormBuilder, or when required by law.

You can disconnect Google Sheets from your form's integration settings at any time. Disconnecting removes FormBuilder's stored Google OAuth token for your account and stops future Google Sheets syncs. You may also request deletion of your FormBuilder account data by contacting us.

Data Sharing and Disclosure

We do not sell, trade, or otherwise transfer your personal information to third parties, except in the following circumstances:

  • With your explicit consent
  • To trusted service providers who assist in operating our service
  • When required by law or to protect our legal rights
  • In connection with a business transfer or acquisition

AI Assistants, MCP Server and Connected Apps

FormBuilder can be used from AI assistants and developer tools (for example Claude, ChatGPT, Cursor or Gemini) through our Model Context Protocol (MCP) server at api.formbuilder.com/mcp, our REST API, and the open-source formbuilder-mcp package. When you connect one of these apps:

  • What is collected. You authorize the app with OAuth 2.0 on formbuilder.com; the app never sees your password. We issue it a scoped access token (forms, responses and, only if explicitly requested, webhooks) that expires after 30 days. The token is stored hashed and is listed under Settings → API keys, where you can revoke it at any time.
  • How it is used. The app can only perform the actions its scopes allow, on your own account, through the same API used by the FormBuilder website. Requests are logged (endpoint, timestamp, IP, token id) for security and abuse prevention; query strings and credentials are not logged.
  • Third parties. Data an app reads (for example form responses) is transmitted to that app's provider — such as Anthropic, OpenAI or Google — under their privacy terms, not ours. We do not send your data to any AI provider unless you (or an app you authorized) request it, and we do not use your form data to train AI models.
  • Accounts created by agents. An agent may create a free account for an email address you give it (via the /api/v1/signup endpoint or the formbuilder_signup tool). We email a claim link to that address; until it is claimed the account is limited, and you can delete it by contacting support.
  • Retention. OAuth authorization codes expire in 10 minutes, access tokens in 30 days and refresh tokens in 90 days; revoked tokens are deleted. Form and response data follows the retention rules described below.
  • Contact. Security or privacy questions about connected apps: [email protected].

Data Security

We implement appropriate security measures to protect your personal information:

  • AES-256-CBC encryption for all sensitive data at rest
  • TLS 1.3 encryption for all data transmission
  • Regular security audits and assessments
  • Restricted access to personal information
  • Secure data centers with physical security measures
  • Comprehensive audit logging and monitoring
  • Data integrity verification using cryptographic hashing
  • Automatic detection of suspicious access patterns

Your Rights

You have the following rights regarding your personal information:

  • Access and receive a copy of your personal data
  • Correct inaccurate or incomplete information
  • Delete your personal information
  • Restrict or object to certain processing
  • Data portability

HIPAA Compliance

FormBuilder is designed to support HIPAA compliance for healthcare organizations and covered entities. Our HIPAA-compliant features include:

  • Encryption: All Protected Health Information (PHI) is encrypted at rest using AES-256-CBC encryption and in transit using TLS 1.3
  • Access Controls: Role-based access control and comprehensive audit logging of all PHI access
  • Audit Trails: Complete audit logs tracking who accessed PHI, when, and for what purpose
  • Data Integrity: SHA-256 hashing ensures PHI has not been tampered with or altered
  • Automatic Data Retention: Configurable retention policies with automatic purging of deleted PHI after 90 days
  • Business Associate Agreement (BAA): Available for covered entities requiring HIPAA compliance

Important: HIPAA compliance requires both technical and administrative safeguards. Organizations using FormBuilder for PHI must:

  • Execute a Business Associate Agreement with FormBuilder
  • Train employees on HIPAA requirements
  • Implement appropriate administrative and physical safeguards
  • Conduct regular risk assessments
  • Maintain incident response procedures

GDPR Compliance

If you are located in the European Union, we comply with the General Data Protection Regulation (GDPR). This includes:

  • Lawful basis for processing your data
  • Right to be forgotten
  • Data protection by design and by default
  • Prompt notification of data breaches

Data Retention and Deletion

We retain your data only as long as necessary to provide our services and comply with legal obligations:

  • Active account data is retained while your account is active
  • Form responses are retained based on your configured retention settings
  • Deleted PHI is soft-deleted and permanently purged after 90 days
  • Audit logs are retained for 7 years for compliance purposes
  • You may request deletion of your data at any time

Cookies and Tracking

We use cookies and similar tracking technologies to enhance your experience. You can control cookie settings through your browser preferences.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

Contact Us

If you have any questions about this Privacy Policy, please contact us:

We use necessary cookies to run FormBuilder and optional analytics cookies to understand site usage. You can accept analytics cookies or keep only necessary cookies.