CustomGFormCustomGForm

Privacy Policy

Looking for our commercial terms? Read our Terms of Service.

1. Overview and Data Controller

At CustomGForm (https://customgform.com), we respect your privacy and are committed to handling data transparently and in compliance with the General Data Protection Regulation (GDPR) and applicable EU laws.

CustomGForm is operated by Ihor Zymnitskyi (Jednoosobowa Działalność Gospodarcza (JDG) registered in Poland, NIP: 5833499693, REGON: 527544670), who acts as the Data Controller for personal data collected in connection with account administration and website usage.

Our order and billing processes are conducted by our online reseller and Merchant of Record, Paddle.com, who handles payment transactions, invoicing, and tax collection.

2. Form Respondent Data & Processing Architecture

When respondents submit answers through a form customized with CustomGForm, data is processed through our reliable dual-delivery pipeline:

A. Response Ingestion & Google Forms Sync

When a visitor fills out a form, their answers are submitted securely to CustomGForm's servers, saved in our database to provide reliable persistence, and automatically forwarded to Google Forms (docs.google.com/forms). This architecture prevents response loss in cases where a submission is rejected, delayed, or interrupted by Google Forms.

For all respondent answers collected through customized forms, the Form Owner acts as the Data Controller. CustomGForm acts strictly as a Data Processor, storing and relaying submission records solely to deliver the service, display responses in the customer's dashboard results, trigger configured integrations (such as webhooks, Slack, Notion, or Telegram), and maintain synchronization with Google Forms. CustomGForm does not sell, rent, or use respondent submissions for advertising or profiling.

B. Optional Addons & Cloud Storage

When a form owner enables optional addons, processing occurs strictly to deliver the selected functionality:

  • File Upload Addon: Files and attachments uploaded through forms are stored securely on Cloudflare R2 object storage, encrypted in transit (TLS) and at rest, and delivered via secure CDN URLs.
  • E-Signature Capture: Touch or mouse signature drawings are rendered as images, stored securely on Cloudflare R2, and linked with the form owner's response records.
  • Location Detection: Geolocation lookups derive approximate region and timezone information from the respondent's IP address on-the-fly without saving the IP address or collecting GPS coordinates. The derived value is editable by the respondent before submitting.
  • Form Analytics: Aggregated view and completion metrics use ephemeral session identifiers and one-way IP hashing. We do not use third-party tracking cookies or cross-site fingerprinting.

3. Information We Collect from Account Holders

When you register for or manage an account on CustomGForm, we collect:

  • Account details: Email address and profile information provided via magic link sign-in or Google OAuth.
  • Form configurations: Form IDs, styling preferences, theme settings, and addon parameters needed to display your forms.
  • Subscription records: Billing identifiers and plan status provided by Paddle.com. We do not store credit card numbers or bank details.
  • Technical logs: IP addresses and browser information recorded in standard server logs for security monitoring and troubleshooting.

4. Google API User Data & Limited Use

CustomGForm connects with Google APIs to import, configure, and synchronize your Google Forms.

CustomGForm's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

  • We do not sell Google user data to third parties, advertisers, or data brokers.
  • We do not use Google user data to train generalized artificial intelligence (AI) or machine learning models.
  • Google OAuth tokens are stored encrypted and used solely to perform actions you have explicitly authorized.

5. Legal Bases for Processing

We process personal data in accordance with GDPR Article 6 under the following bases:

  • Contract performance (Art. 6(1)(b)): Delivering requested form customization, response ingestion, and dashboard services.
  • Legitimate interests (Art. 6(1)(f)): Maintaining platform security, preventing abuse, and measuring aggregated service health.
  • Legal compliance (Art. 6(1)(c)): Meeting tax, accounting, and regulatory obligations under EU law.
  • Consent (Art. 6(1)(a)): Where you or your respondents have opted into specific optional features.

6. Sub-Processors & International Data Transfers

We engage vetted third-party infrastructure and service providers to operate CustomGForm:

  • DigitalOcean, LLC (USA): Virtual private servers (VPS) and database hosting located in New York (NYC), USA.
  • Cloudflare, Inc. (USA / Global): Global CDN, network security, and Cloudflare R2 cloud object storage for uploaded files and signature images.
  • Paddle.com (UK / USA / EU): Merchant of Record, payment gateway, billing management, and tax compliance.
  • Google LLC / Google Cloud (USA / Global): Google Forms API integration and OAuth authentication.
  • Amazon Web Services (AWS): Amazon Bedrock AI processing (where AI form styling features are invoked).

Where personal data originating in the European Economic Area (EEA) is transferred to service providers in the United States, transfers are safeguarded under the EU-U.S. Data Privacy Framework (DPF) and/or Standard Contractual Clauses (SCCs) approved by the European Commission.

7. Cookies

We use essential cookies strictly necessary to maintain authenticated sessions for logged-in users. We do not use tracking or advertising cookies on public forms viewed by respondents.

8. Your Rights Under the GDPR

Under European data protection law, you have the right to access, rectify, or request deletion of your personal data, as well as the right to data portability and to restrict or object to certain processing.

You also have the right to lodge a complaint with the Polish data protection authority, Urząd Ochrony Danych Osobowych (UODO) (uodo.gov.pl).

To exercise your rights, please contact us at [email protected].

9. Data Processing Addendum (DPA)

Business customers requiring a signed Data Processing Addendum (DPA) incorporating standard contractual clauses can request one by emailing [email protected].

10. Contact

For any questions or privacy inquiries, please contact us at [email protected].