Your California privacy rights
We do not sell your personal information. We do not share it for cross-context behavioural advertising either.
There is no advertising network, no tracking pixel and no analytics product anywhere in Formspark. There is nothing here to opt out of.
This page sets out what we do collect, why, and the rights the California Consumer Privacy Act gives you over it.
Effective date: 20 August 2026
Who this page is for
It is written for residents of California. Residents of other US states with similar laws get the same treatment, and there is a note on that further down.
It covers the information we hold about you as a Formspark customer. If you filled in a form built on Formspark, the business that owns that form decides the use of your information. Ask them, and we will pass on a request that reaches us first.
What we collect, and why
The categories below are the ones named in the statute. We collect no others.
| Category | What that means here | Why we collect it | Sold or shared | How long we keep it |
|---|---|---|---|---|
| Identifiers | Account, Sign-up and sign-in IP address, Sign-in identity from a social provider, Newsletter subscription, Submitter IP address, Notification recipients, Autoresponder suppression list, Autoresponder complaint records, Email delivery events | Create your account, sign you in, and contact you about the service. Keep the service secure. Let you sign in without a password. Send you product news. Filter spam, keep the service secure, and show the customer where submissions came from. Send form notifications to the addresses a customer chooses. Make sure someone who unsubscribed never receives another autoresponse. Keep the records needed to answer complaints about autoresponder email. Keep email deliverable and stop sending to addresses that reject it | No | Life of the account. The email address is kept after deletion to stop the free allowance being re-granted. 12 months. As for Account. Until you unsubscribe. 12 months. Until the customer removes the address, or until the account that owns it is deleted. Kept indefinitely, so that an unsubscribe cannot be undone by an account being deleted. 12 months. 24 months |
| Commercial information | Billing | Take payment, calculate tax, and issue invoices | No | Held by Paddle under its own terms |
| Determined by the customer | Submission content, Filtered submissions, Export files | Deliver submissions to the customer who owns the form. Hold submissions that were not delivered to the customer's inbox, and keep the records needed to answer complaints about the service. Give the customer their submissions as CSV or JSON | No | Until the customer deletes it. Deleted submissions stay recoverable for 30 days. 12 months. Filtered submissions are visible to the customer for 30 days. 7 days |
| Geolocation data | Approximate location derived from an IP address | Draw the submission map and country breakdown the customer sees | No | 12 months |
| Internet or other electronic network activity | Request metadata, Server logs, Map tile requests, Error reports | Filter spam and help the customer see where a submission came from. Keep the service running and diagnose failures. Load the map behind the submission heatmap in the dashboard. Find and fix failures | No | With the submission it belongs to. 7 days. Held by Mapbox under its own terms. Held by Sentry under its own terms |
Sensitive personal information
We collect none. We do not ask for your race, religion, health, precise location, union membership, sexual orientation, government identifiers or the contents of your private messages.
Our Terms of Service forbid customers from using Formspark to collect health data, criminal records or children's data through their own forms.
Where we get it
- From you, when you register, pay us, or write to us
- From your browser, when you use the service
- From GitHub, Google or Slack, if you choose to sign in with one of them
- From people filling in our customers' forms, on those customers' instructions
What we use it for
- Running the service and delivering submissions
- Taking payment and issuing invoices
- Answering your support requests
- Filtering spam and keeping the service secure
- Finding and fixing failures
- Sending you product news, if you asked for it
Who we disclose it to
We disclose personal information to the vendors that help us run the service. Our contracts limit them to that purpose, which makes them service providers under the CCPA rather than buyers.
The subprocessors page names every one of them. In statutory terms they fall into these groups: cloud hosting and email, payment processing, spam filtering, error monitoring, and the delivery tools a customer connects themselves.
We also disclose it when the law requires us to.
Do we sell or share it
No. We have never sold personal information and we have never shared it for cross-context behavioural advertising. That applies to everyone, including anyone under 16.
Your rights
- Know what we collect, why, and who we disclose it to
- Get a copy of the specific pieces we hold about you
- Have it corrected when it is wrong
- Have it deleted
- Get it in a portable, machine-readable format
- Opt out of sale or sharing, which does not arise here
- Limit the use of sensitive personal information, which does not arise here either
- Be treated no differently for using any of these rights
Our disclosure covers the 12 months before your request. We never charge for a request, and using one of these rights will never cost you a feature, a price or a level of service.
How to make a request
Email support@formspark.io from the address on your account. We reply within 45 days. If a request is complicated we may take the same again, and we will tell you before we do.
We verify a request by checking that it comes from the account it is about, or by emailing the address on file. An authorised agent may act for you if they show us written permission.
You can already delete your account and export your submissions from the dashboard, without asking us.
Global Privacy Control
Global Privacy Control is a browser signal that opts you out of the sale and sharing of your personal information.
We do not read it, because we have nothing for it to switch off. We never sell or share personal information for any visitor, whether or not they send the signal. If that ever changes, we will honour the signal and say so here first.
If you live in another US state
Several states now have privacy laws close to this one. Rather than track which resident gets which right, we give everyone the same set: access, correction, deletion, portability, and no targeted advertising or sale of any kind.
Write to the same address and we will handle your request the same way.
The rest of the picture
Our Privacy Policy has the full detail, including our legal basis for each kind of data and how we protect it.
Questions
Have a question about this page, your data, or your rights? Email us at support@formspark.io and we will answer it.
Formspark is operated by Trampoline Software SRL, Rue de Marsannay-la-Côte 16, 5032 Gembloux, Belgium. Enterprise number BE 0799.398.081.