1. Who is responsible for your data

For your account and for how you use the Service, Genius Addons LLC is the controller (in California terms, the business) of your personal information.

For responses submitted through a form, the person or organization that built the form is the controller and Beeform is their processor (service provider). We handle those responses on their instructions. If you are a respondent and have questions or requests about your answers, please contact the form owner. We will help them respond.

2. Information we collect

Account and profile information. When you register or sign in we receive your name, email address, profile picture, and an identifier from your sign-in provider (such as Google). If you contact us we receive what you send us. If you accept a workspace invitation we record your email address and the workspace you joined and your role.

Content you create. Forms, questions, designs, themes, logos, uploaded images and files, labels, workspace names, notification settings, and the version history of your forms.

Responses. Answers, files and other data that respondents submit through forms, along with the time of submission and the form it was submitted to. This can include any kind of personal information the form owner chooses to ask for.

Google account data. If you connect a Google account, we receive the access you grant on Google's consent screen. This may include your Google account email and identifiers and, to the extent you approve, information about your Google Forms and their responses so that the add-on and dashboard can work. We store the refresh token that lets us keep the connection working, encrypted.

Billing information. Paid plans are processed by Stripe. We receive your plan, billing interval, subscription status, billing email and country or postal code, and the Stripe customer and subscription identifiers. We do not receive or store your full card number.

Usage, device and log data. IP address, browser and device type, operating system, pages and features used, referring pages, language, date and time, and errors. Our servers and hosting providers keep logs for security and troubleshooting.

Analytics data. If you accept analytics cookies, Google Analytics collects information about how you use our website, as described in our Cookie Policy. For response analytics inside the dashboard we count visits to a form using a salted, one-way hash, so we can count unique visitors without storing a plain identifier.

Cookies and similar technologies. See our Cookie Policy.

Information from others. A workspace owner may give us your email address in order to invite you. Google or another sign-in provider sends us the profile information you authorized.

3. How we use information

We use personal information to:

• provide, operate, secure and maintain the Service, including signing you in, publishing forms, storing and showing responses, and running workspaces;
• connect to Google and deliver the features you ask for through that connection;
• process payments, manage subscriptions, calculate taxes, and prevent fraud;
• send service messages such as confirmations, invitations, security alerts, billing notices, and, if you turn them on, email alerts and daily summaries about your forms;
• provide support and respond to your requests;
• understand how the Service is used, fix bugs, and improve and develop features;
• send you product updates and other messages. You can opt out at any time using the link in the email or by contacting us, except for service messages;
• detect, investigate and prevent abuse, phishing, spam and security incidents, and enforce our Terms;
• comply with legal obligations and defend our legal rights.

We do not use Responses or other Your Content to train advertising models, and we do not use Google user data for advertising.

4. Legal bases (EEA, UK and Switzerland)

If the GDPR or similar laws apply, we process personal data on these bases:

• Contract: to provide the Service you asked for, including accounts, forms, workspaces and billing;
• Legitimate interests: to secure and improve the Service, prevent fraud and abuse, measure service performance, and communicate with customers, balanced against your rights;
• Consent: for analytics cookies and similar technologies, for marketing emails where consent is required, and for connecting your Google account. You can withdraw consent at any time without affecting prior processing;
• Legal obligation: for tax, accounting and other legal duties.

5. Google user data and Limited Use

Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We only use Google user data to provide and improve the user-facing features you request, such as showing, themed rendering of, and submitting answers to your Google Forms.
• We do not sell Google user data, and we do not transfer it to others except as needed to provide the features you use, to comply with law, or as part of a merger or acquisition with notice to you.
• We do not use Google user data to serve advertising, including retargeting or interest-based advertising, and we do not use it to determine credit-worthiness or for lending.
• No person at BeeForm reads your Google data unless you ask for support and give permission, it is needed to investigate abuse or a security issue, or the law requires it.
• Refresh tokens and other credentials are stored encrypted. You can disconnect a Google account in your account settings, which deletes our stored token, and you can revoke access at myaccount.google.com/permissions.

6. How we share information

We do not sell your personal information and we do not share it for cross-context behavioral advertising. We share it only as follows:

• Service providers who process data for us under contract, such as cloud hosting, storage, database and content delivery, email delivery and authentication, listed below;
• With your instructions. For example, responses go to the owner of the form, and workspace owners and administrators can see members' names, emails and activity in that workspace;
• Payment processing by Stripe;
• Google, when you connect a Google account or use Google sign-in, Google Forms or Google Analytics;
• Legal and safety reasons: to comply with law, legal process or lawful requests, to enforce our Terms, and to protect the rights, property or safety of us, our users or the public;
• Business transfers: in connection with a merger, financing, acquisition or sale of assets, subject to this Policy;
• With your consent, or aggregated or de-identified information that cannot reasonably identify you.

We may add or change providers, and will update this list when we do.

7. International transfers

We are based in the United States and our providers may process data in the United States and other countries. Where we transfer personal data from the EEA, UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK addendum, or an applicable adequacy decision such as the EU-US Data Privacy Framework for certified providers.

8. Retention

We keep personal information only as long as needed for the purposes in this Policy:

• Account data and Your Content: while your account is open. After you delete your account or a workspace, we delete or anonymize it within a reasonable period, normally within 30 days, apart from backups that are overwritten on schedule. Workspace deletion has a short grace period before it is permanent;
• Uploaded files: for the retention period you set, up to the maximum your plan allows, and then they are deleted;
• Responses: until the form owner deletes them or the account is closed;
• Billing records: as long as needed for tax, accounting and legal requirements, usually several years;
• Logs and security records: for a limited period, typically up to 12 months;
• Analytics data: up to 14 months in Google Analytics;
• Records of support requests, consents and legal compliance: as long as necessary for those purposes.

9. Security

We use reasonable technical and organizational measures to protect personal information, including encryption in transit, encryption at rest for stored data and for connection tokens, access controls, signed and expiring links, and logging. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we learn of a breach that affects your personal information, we will notify you and regulators as the law requires.

10. Your choices and rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to our processing of your personal information, to receive a portable copy, to withdraw consent, and to not be discriminated against for exercising your rights. You can update much of your information in your account settings, and you can disconnect Google, export responses and delete your account there.

To make a request, email support@beeform.co. We may need to verify your identity, and will respond within the time the law requires (generally 30 to 45 days). You may use an authorized agent where the law allows. If we cannot honor a request, we will tell you why. If your request concerns responses you submitted to someone else's form, we will refer you to the form owner.

European and UK residents: you also have the right to lodge a complaint with your local data protection authority. California residents: you have the rights to know, delete, correct and limit use of sensitive information, and to opt out of sale or sharing. We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics about you. Residents of other US states with privacy laws have similar rights and may appeal a refusal by replying to our decision.

Marketing emails: unsubscribe using the link in any message. Cookies: use the cookie banner or your browser settings, as described in the Cookie Policy.

11. Children

The Service is not directed to children under 16 and we do not knowingly collect personal information from them, and in particular not from children under 13. If you believe a child has given us personal information, contact us and we will delete it. Form owners are responsible for not using forms to collect children's data unlawfully.

12. Links to other sites

The Service may link to websites and services we do not control, and forms may embed content from others. This Policy does not apply to them. Please read their privacy policies.

13. Changes to this Policy

We may update this Policy from time to time. We will post the new version with a new "Last updated" date and, for material changes, give you notice such as by email or in the Service before they take effect where practical.

14. Contact us

Genius Addons LLC, doing business as Beeform, Florida, United States. You can reach us at support@beeform.co. For privacy requests, put "Privacy request" in the subject line.