Request Forms privacy policy

Request Forms stores the account you create (email, optional name, optional avatar) and the forms you save. Published forms collect answers that you choose to request. File uploads go to the configured object store when S3-compatible storage is set. Payment fields use Stripe when server keys are present. We do not sell form answers as a data product.

Session cookies authenticate the website and the hosted MCP server. Paid API keys are organization secrets. You can revoke a key on the organization page. Public form pages are reachable without an account. Do not put secrets in a published form. Webhook URLs you configure receive submit payloads that you chose to send.

Public marketing pages, docs, templates, and compare tables are meant to be crawled. robots.txt allows search and AI crawlers. /llms.txt lists the pages we want agents to read. Markdown is available on those pages when the client sends Accept: text/markdown. Private workspace routes under /app require sign-in and are not a public corpus.

To ask a question about stored account data, or to request deletion of an account you own, email [email protected] from that account address. Password login must work, or you must complete the reset flow first. This page describes the product as it works on requestforms.io. It is not legal advice for your respondents.