Privacy Policy

Effective October 9, 2026

This Privacy Policy explains how Universal Forge 2025, Inc., doing business as All Purpose Forms ("All Purpose Forms," "we," "us," or "our"), collects, uses and protects personal information when you visit allpurposeforms.com, create an account, or use our form-building and website service (the "Service").

1. Two kinds of information

Your account information. When you or your team sign up and use the Service, we're responsible for that information as described in this policy.

Information collected by your forms. When people fill in a form or website built by one of our customers, that customer decides what's collected and why. We store and process those submissions (including any files attached to them) on the customer's behalf and only to provide the Service to them. If you filled in someone's form, contact that business about your information — we'll help them respond.

2. What we collect

• Account details: your name, email address, company name, and your password (stored only in scrambled, one-way form).
• Sign in with Google: if you choose it, Google shares your name, email address and a Google account ID with us. We use them only to create your login and sign you in. We don't receive your Google password, contacts, files or any other Google data, and we don't post anything to your Google account.
• Two-step login: the setting you choose and the information needed to check your codes.
• Billing: your plan and billing history. Card details are entered on Stripe’s secure page and held by Stripe — we never see or store full card numbers.
• Content you create: your forms, website pages, images you upload, settings and integrations.
• Technical information: IP address, browser type, pages visited and dates/times, used for security, spam protection and keeping the Service running. When someone opens a form, we also record the web page it’s embedded on and the page that linked to it (if their browser shares it), so the form’s owner can see where submissions come from. We also keep an activity log of logins and important changes in each account (who, what, when and IP address) for a year, which account owners and admins can see.
• Messages: anything you send us through our contact form or by email.

3. How we use it

• To provide, maintain and secure the Service and your account.
• To process payments and manage subscriptions.
• To send service emails, such as submission notifications, login codes, invitations, password resets and billing notices.
• To prevent spam, fraud and abuse.
• To answer your questions and provide support. When you ask for help, our support staff may open your account to look at or fix a form or page. Each visit is logged and shown on your Team page, and billing, payments and login settings stay locked during it.
• To improve the Service, using information about how features are used.

We don’t sell personal information, and we don’t use form submissions or Google sign-in information for advertising.

4. Who we share it with

Only with service providers that help us run the Service, under agreements to protect it, and only as needed:

• Stripe (payments), SendGrid (email delivery), Cloudflare (website security and performance) and our hosting provider.
• Google, when you choose Sign in with Google, connect a Google Docs or Google Sheets integration, or connect a Google Calendar for appointment booking (bookings are added to your calendar, and its busy times are read so they aren’t offered).
• Anthropic (our AI provider): the description you type into the AI form builder (and the text of a public web page, if you ask it to build from your website), the answers of a submission our spam filter finds borderline, so the AI can help decide whether it’s spam (account owners can turn this check off), and the answers of submissions you ask AI to summarize (files and signatures aren’t sent), and the words and photos of pages, forms and domain names when they are published, for our content safety check. They aren’t used to train AI models.
• proxycheck.io: the IP address of people who sign up, publish, or send a form, to check whether it comes from a VPN, proxy, Tor or data centre. Only the IP address is sent; results are kept for 7 days.
• Places you send your own submissions, such as webhooks or other integrations you set up.

We may also disclose information if required by law, to protect the rights and safety of our users or the public, or as part of a merger or sale of our business (in which case this policy continues to apply).

5. Cookies

We use a small number of necessary cookies: one keeps you logged in, and one remembers a device you chose to trust for two-step login. Spam protection on forms may set its own security cookie. We don’t use advertising cookies.

Businesses that use All Purpose Forms can add their own Google Analytics, Google Tag Manager or Meta Pixel to their forms and websites. When they do, those services may set their own cookies on that business’s forms and pages, under the business’s own privacy policy. By default visitors are asked first, and nothing loads unless they accept. Only the form’s name is shared with those services, never the answers typed into a form.

6. How long we keep it

We keep account information while your account is open. Deleted submissions stay in Recently deleted for 30 days and are then removed for good, together with any files attached to them; unfinished submissions are cleared automatically. When an account is closed we delete or anonymize its information within a reasonable time, except where we must keep records (for example, billing records for tax purposes).

7. Security

All traffic uses secure HTTPS, passwords are stored only in scrambled form, and you can protect your login with two-step login. No system is perfectly secure, but we work to protect your information and will notify you as required by law if a breach affects it.

8. Your choices and rights

You can see and update your account details in the app, disconnect Google from Login & security, and ask us for a copy of your information or to delete it. Depending on where you live, you may have other rights under privacy laws. Contact us at the address below and we’ll respond within the time the law requires.

9. Children

The Service is for businesses and isn’t directed to children under 16. We don’t knowingly collect their information.

10. Changes

If we make important changes we’ll update the date above and, where appropriate, let account owners know by email.

11. Contact us

Questions or requests about privacy can be sent to [email protected].