Privacy
How Usable Forms handles public form responses.
Usable Forms stores form definitions and responses in the form owner's Usable workspace. The form owner controls the questions they ask, their purpose for collecting responses, retention choices, and who can access that workspace. This page supplements the general Usable Privacy Policy for public form respondents.
Who Is Responsible
For most public forms, the form owner is responsible for the content of the form and how they use submitted responses. Usable Forms provides the service that stores responses, applies workspace access controls, and helps secure the submission flow. If a form identifies a specific controller or contact person, use that information first for questions about that form.
What A Public Form May Collect
- Answers to questions, consent choices, and comments.
- Contact details such as name, email address, organization, or other details requested by the form owner.
- Scheduling availability, selected times, and related scheduling comments for scheduling-poll forms.
- Uploaded file names or file references where a form supports uploads.
- Basic technical metadata such as submission time, browser user agent, referrer, and, when enabled, a hashed IP address.
Why Data Is Processed
Responses are processed to receive and store form submissions, make responses available to people or agents with access to the owner's workspace, prevent abuse, investigate reports, maintain audit records, and comply with legal obligations. Usable Forms does not sell public form response data.
Who Can See Responses
Responses are written to the owner's Usable workspace and can be read by people or agents with access to that workspace. Public form pages show only the published form definition and do not expose response contents, internal workspace identifiers, owner notification settings, or export data.
Storage, Security, And Transfers
Usable Forms uses Usable workspace storage, authentication, encryption for protected response values, audit records, and role-based workspace access controls. We use cloud infrastructure and service providers to host, secure, observe, and operate the service. Where personal data is transferred internationally, appropriate safeguards such as adequacy decisions, Standard Contractual Clauses, or similar mechanisms may be used.
Retention
Form owners should state their intended retention period in the form privacy details where possible. If no form-specific retention period is shown, responses are generally kept while the relevant workspace, form, or account remains active, unless deletion, security, legal, accounting, backup, or dispute-resolution needs require a different period. Reports and audit records may be kept longer to preserve service integrity.
Your Privacy Rights
Depending on where you live, you may have rights to access, correct, delete, export, restrict, or object to processing of your personal data. To exercise rights about the form itself, contact the form owner if their details are shown. For Usable Forms platform privacy requests, email privacy@usable.dev with the subject "Privacy Request". We may need to verify your identity before fulfilling a request.
You may also lodge a complaint with a data protection authority, including Dátueftirlitið in the Faroe Islands or Datatilsynet in Denmark.
Children
Usable Forms is not intended for children under 16. Form owners must not knowingly collect children's data unless they have the required notices, consent, and legal basis. If you believe a child has provided personal data through a form, contact the form owner and privacy@usable.dev.
What Not To Submit
Do not submit passwords, one-time codes, recovery codes, API keys, private keys, payment card numbers, or information the form does not ask for. Use the report link on a public form if it looks suspicious.
Security Incidents And Changes
If a personal data breach occurs, we will assess the risk, contain and remediate the issue, and notify supervisory authorities or affected individuals where required. We may update this notice when the service, legal obligations, subprocessors, or data practices change.