TruFormsPrivacy policy
Last updated 2026-07-12.
1. Who we are
TruForms is operated by TruenoTech, India. We are the controller of data about TruForms account holders and the processor of data about the people who submit their forms — see our DPA for the processor side.
2. Data we collect about you (the account holder)
When you sign up: your name, email, hashed password (Argon2id with a server pepper), and any workspace details you enter. When you use the service: form configurations, integration settings, billing records (managed by Razorpay), and audit logs. When you contact support: the messages you send us.
3. Data we collect about your form submitters
Whatever fields you collect in your forms — we don't inspect or repurpose that content. We also record the submitter's IP address, user-agent, timestamp, and spam score, used solely for delivering the submission to you, scoring spam, and enforcing rate limits.
4. How we use it
To provide the service (deliver submissions, fan out to integrations, render dashboards), bill you, prevent abuse, debug incidents, and contact you about your account. We do not sell personal data and we do not use submission contents to train any model.
5. Sharing
Sub-processors: Razorpay (billing), Microsoft Graph (email delivery), Cloudflare R2 (object storage for uploads), and our hosting provider. Each handles a narrow slice of data under written agreement. We share with law enforcement only when compelled by valid legal process, and we will notify you unless legally prohibited.
6. International transfers
Default region is Mumbai (ap-south-1). EU-region hosting is available on Business plans. When data crosses borders, we rely on Standard Contractual Clauses (SCCs) and equivalent safeguards.
7. Security
See the Security page for details — encryption at rest (AES-256-GCM) and in transit (TLS 1.2+), Argon2id password hashing, opaque session tokens, HMAC-signed webhooks. Report vulnerabilities to [email protected].
8. Retention
Submissions and their uploaded files are retained per your plan's retention window (Free: 30 days, Pro: 365 days, Business: 365 days), plus a short operational grace period, and are then permanently deleted by an automated process. If your plan changes to one with a shorter window — including after a cancellation or a failed payment — submissions older than the new window are deleted after the grace period. Billing records are retained for the period required by applicable tax law.
8a. Account deletion
When you delete your account, you are signed out of all sessions and your workspaces — including forms, submissions, uploaded files, linked emails, and integrations — are queued for permanent deletion, which normally completes within 48 hours (paid accounts: after the end of the already-billed period, during which you retain access). Your account record itself is removed once that purge completes. Downgrading a paid plan deletes only the data exceeding the new plan’s limits, and only after you explicitly confirm what will be removed.
9. Your rights
You can access, correct, export, and delete your account data at any time from the dashboard. EEA/UK and Indian DPDP rights (access, rectification, erasure, portability, objection, withdrawing consent) are honoured — email [email protected] and we will respond within 30 days. You can lodge a complaint with the data protection authority in your country.
10. Children
TruForms is not directed at children under 16. We do not knowingly accept accounts from them; if you believe a child has signed up, email [email protected] and we will delete the account.
11. Changes and contact
Material changes will be announced at least 14 days in advance to the workspace owner. Questions about this policy or to exercise your rights: [email protected].