Privacy Policy

Overview

GRTforms, operated by GrtLabs Inc., is committed to protecting your privacy. This policy explains how we collect, use, and safeguard your information when you use our form builder service.

Information We Collect

Account Information: When you create an account, we collect your name, email address, and password (stored securely using industry-standard hashing).

Form Data: We store the forms you create and the submissions you receive. This data belongs to you and is only used to provide our service.

Usage Data: We may collect basic analytics about how you use GRTforms to improve our service.

Submitter IP addresses: When someone submits a form, we store their IP address, user agent, and referrer with that submission. IPs also appear in the form or account block list, abuse records and alerts, activity logs, webhook payloads sent to the URL the form owner configured, and e-signature audit records. Form owners may block IPv4/IPv6 addresses or CIDR ranges (including IPv6 /64) on a form or across their account. Blocked visitors receive a generic message that the form is not accepting their submission — we do not tell them they were blocked by IP.

We do not store IP addresses from login, signup, or magic-link sign-in. Those IPs are used in memory for rate limiting and, when Turnstile is configured, sent to Cloudflare with the verification token as remoteip.

Cookies and analytics

Public forms set a first-party grtforms_vid cookie: a random visitor ID that lasts one year. We store only hashed visit counts (unique views and starts per form per day), not the raw cookie value. Marketing and sign-in pages reuse the same visitor cookie to count unique product visitors per day.

Marketing and sign-in pages also set a first-party grtforms_ft cookie for 90 days (HttpOnly, SameSite=Lax). It stores the first UTM parameters and referrer host we saw — not your email, name, or IP — so we can attribute signups by channel. When the first landing is a Powered by GRTforms badge or a thank-you "Create a form like this with AI" link, the cookie may also store that form's public slug.

Form owners can also load third-party trackers they configure — Meta Pixel, Google Tag Manager, GA4, and HubSpot — on their public forms. Those vendors receive data under the owner's accounts, not ours.

Google address autocomplete: When a form owner turns on Google address autocomplete on an Address field, and a Google key is configured, the respondent's browser sends what they type into the street line directly to Google Places, along with a random session token and any country or region setting on the field. If they pick a suggestion, the browser also sends that place's ID to Google to fill the other address lines. Because the request comes from the respondent's browser, Google also receives their IP address and standard browser information, under Google's terms. GRTforms stores only the address that is submitted and the place ID (plus latitude and longitude if the owner turned that on). We do not store the suggestions. Respondents can always type an address without picking a suggestion. If no Google key is configured, Google is unavailable, or the monthly suggestion cap is reached, the field works as a plain address form and nothing is sent to Google.

Email

We may send account mail, sign-in links, submission notifications, and abuse alerts through email providers including Amazon SES, Mailgun, and Postmark. In-app notifications still work without those messages.

How We Use Your Information

We use your information to:

• Provide and maintain the GRTforms service
• Send you important updates about your account
• Respond to your support requests
• Improve our service based on usage patterns

Data Security

All data is transmitted over HTTPS encryption. We use secure, industry-standard practices to protect your information. Passwords are hashed and never stored in plain text.

Your Rights

You can access, export, or delete your data at any time through your dashboard. To delete your account entirely, please contact our support team.

Contact Us

If you have questions about this privacy policy, please contact us at [email protected].