Privacy Policy

Introduction

Claform ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our survey creation and management platform.

We comply with applicable data protection laws including the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and other regional privacy regulations.

Information We Collect

Information You Provide

• Account Information: Email address, name, password (encrypted), company name, job title
• Profile Information: Phone number, profile picture, communication preferences
• Survey Content: Questions, responses, and data you create or collect through surveys
• Payment Information: Billing details processed securely through our payment providers
• Communications: Support requests, feedback, and correspondence with us

Information Collected Automatically

• Usage Data: Pages visited, features used, time spent on platform
• Device Information: Device type category (mobile/tablet/desktop), browser language, timezone
• Log Data: IP address (anonymized), access times, error logs

How We Use Your Information

Data Sharing and Disclosure

We do not sell your personal information. We may share your data with:

• Service Providers: Cloud hosting, payment processing, email delivery (under strict data processing agreements)
• Legal Requirements: When required by law, court order, or government request
• Business Transfers: In connection with a merger, acquisition, or sale of assets (with notice to you)
• With Your Consent: For any other purpose with your explicit permission

Google User Data (Google API Services)

If you connect your Google account to Claform (for example, the Google Sheets or Google Drive integrations), we access Google user data only as needed to provide the feature you configure:

• What we access: OAuth tokens you authorize, plus the specific spreadsheets or folders involved in the integration — the Google Sheets connector writes survey responses to spreadsheets you designate, and the Google Drive connector uploads the export files you choose. We do not read unrelated files or content.
• How we use it: Solely to provide the integration you configured, such as appending survey response rows to your designated spreadsheet. Google user data is never used for advertising and is never sold.
• Storage and protection: OAuth tokens are encrypted at rest (AES-256-GCM) and used only server-side to perform the syncs you set up. Disconnecting the integration deletes the stored tokens.
• Sharing: We do not transfer Google user data to third parties, except as necessary to provide the integration itself, to comply with applicable law, or as part of a merger or acquisition with prior notice to you.
• AI/ML (Limited Use): Google user data is never used to develop, improve, or train generalized artificial-intelligence or machine-learning models, and is never transferred to third-party AI tools.
• Revoking access: You can disconnect at any time from your Claform integration settings, or revoke Claform's access in your Google Account security settings at myaccount.google.com/permissions.

Claform's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Data Retention

• Account Data: Retained while your account is active, deleted within 30 days of account deletion
• Survey Data: Retained according to your subscription plan, exportable on request
• Audit Logs: Retained for 90 days for security purposes
• Backups: Removed from backups within 90 days of deletion

Your Privacy Rights

To exercise your rights, please contact us at [email protected] or use the data request form in your account settings. We will respond within 30 days (GDPR) or 45 days (CCPA).

International Data Transfers

Your data may be processed in countries outside your own. We ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data processing agreements with all service providers
• Encryption of data in transit and at rest

Security Measures

We implement appropriate technical and organizational measures to protect your data:

• Encryption (TLS 1.3 in transit, AES-256 at rest)
• Regular security audits and penetration testing
• Access controls and authentication
• Employee security training
• Incident response procedures

Cookies and Tracking

We use cookies and similar technologies to provide and improve our services. You can manage your cookie preferences at any time.

Children's Privacy

Our service is not intended for children under 16 years of age. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a notice on our platform. The "Last Updated" date at the top indicates when the policy was last revised.