Privacy

Who is responsible(do not skip)

• TODO-OWNER Name and contact details of the controller. Usually the same operator named in the Imprint.

• TODO-OWNER Contact details of a data protection officer, if one has been appointed.

• TODO-OWNER Say who is responsible for the answers people send through a form built here — the account holder who published the form, the operator of this site, or both, and in which role.

Information about people with an account(do not skip)

• TODO-OWNER What is stored for an account and why. (Supabase Auth stores the login identity and password hash. This app stores the linked e-mail address, optional name, plan, and the times the account was created and last signed in.)

• TODO-OWNER How long an account and its contents are kept after the account stops being used, and how someone deletes theirs.

• TODO-OWNER The legal basis for each purpose.

Information about people who answer a form(do not skip)

• TODO-OWNER What a published form collects. (Whatever its owner asks for — typically answers to the questions, and a name, e-mail address or phone number on a contact question. Uploaded files, where the form asks for one.)

• TODO-OWNER What is recorded alongside the answers. (The time the response started and finished, how far the person got, a score if the owner switched scoring on, and the campaign source in the link they arrived through.)

• TODO-OWNER How long responses are kept, and what the person can do to have theirs removed.

• TODO-OWNER The legal basis, and — where the answers include health, financial or other sensitive information — what additionally applies.

Cookies and local storage(do not skip)

• TODO-OWNER The sign-in cookies. (Supabase Auth sets httpOnly session cookies after a successful sign-in and rotates their refresh token.)

• TODO-OWNER The respondent's own progress. (A published form keeps unfinished answers in the browser's sessionStorage so a reload or the Back button does not lose them. It never leaves the device.)

• TODO-OWNER Whether any cookie or storage on this site needs consent, and if so, how that consent is obtained and withdrawn.

Processors and other recipients(do not skip)

• TODO-OWNER Hosting provider, database provider and file storage provider, with the country each one processes in.

• TODO-OWNER When AI is enabled, OpenRouter and the selected model provider receive the account holder's brief and selected form question content, not respondent answers. Saved AI proposals and usage-attempt timestamps are stored with the account. Define retention and the legal basis before enabling the feature.

• TODO-OWNER When billing is enabled, Stripe receives billing identity and payment details. FunnelForge stores Stripe customer/subscription identifiers and status, not card details. Document recipients, retention, international transfers and the legal basis.

• TODO-OWNER Supabase Auth and the SMTP provider configured there for account confirmation and password-reset messages.

• TODO-OWNER Any analytics tool that is switched on. (Nothing third-party loads here unless an id is configured — see the analytics section of `.env.example`.)

• TODO-OWNER The Meta Pixel: a form owner can add their own pixel id to a published form, which loads Meta's script for everyone who opens that form. Say who is responsible for that, and what a respondent can do about it.

• TODO-OWNER Whether data leaves the country or region, and on what basis.

What people can ask for(do not skip)

TODO-OWNER List the rights of the people whose information this is, and the address they use to exercise them, including how to complain to a supervisory authority.

Security

TODO-OWNER Describe the measures that protect this information, and how a breach would be handled and communicated.

Changes to this policy

TODO-OWNER Say how changes are announced, and record the date this version took effect.

Before launch

TODO-OWNER German and EU market: information has to be given to people at the point their data is collected (Art. 13 GDPR), which is why a published form links to this page. Have your own legal advice confirm the scope and wording, complete every prompt above, and remove this note.