Privacy Policy

Last updated: February 6, 2026

At Octo, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our form building and data collection platform.

1. Information We Collect

1.1 Information You Provide

We collect information you provide directly to us, including:

• Account Information: Name, email address, password, and organization details when you register
• Form Content: Forms, questions, and configurations you create
• Payment Information: Billing address and payment method details (processed securely by our payment providers)
• Communications: Messages, support requests, and feedback you send to us

1.2 Information Collected Automatically

When you use our Service, we automatically collect certain information, including:

• Usage Data: Pages visited, features used, forms created, and actions taken
• Device Information: Browser type, operating system, and device identifiers
• Log Data: IP address, access times, and referring URLs
• Cookies and Similar Technologies: Session cookies, preferences, and analytics data

1.3 Form Response Data

When respondents submit forms created through our platform, we collect and store the response data on behalf of the form creator. The form creator is the data controller for this information, and we act as the data processor.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process transactions and send related information
• Send technical notices, updates, and support messages
• Respond to your comments, questions, and requests
• Monitor and analyze trends, usage, and activities in connection with the Service
• Detect, investigate, and prevent fraudulent transactions and other illegal activities
• Personalize and improve your experience
• Send promotional communications (with your consent where required)

3. Data Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

• Service Providers: With third-party vendors who perform services on our behalf (hosting, analytics, payment processing)
• Legal Requirements: When required by law or to protect our rights, privacy, safety, or property
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Your Consent: When you have given us explicit permission

4. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you the Service. We will also retain and use your information as necessary to comply with legal obligations, resolve disputes, and enforce our agreements.

Form response data is retained according to the form creator's settings and our data retention policies. Users can delete their forms and associated response data at any time.

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit and at rest
• Regular security assessments and audits
• Access controls and authentication requirements
• Secure infrastructure hosted by reputable cloud providers

However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

6. Your Rights

Depending on your location, you may have certain rights regarding your personal information:

6.1 General Rights

• Access: Request access to your personal information
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your personal information
• Export: Request a copy of your data in a portable format
• Objection: Object to certain processing of your information

6.2 GDPR Rights (European Users)

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR), including the right to lodge a complaint with your local supervisory authority. For users in the Netherlands, the supervisory authority is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority).

6.3 CCPA Rights (California Residents)

California residents have the right to know what personal information is collected, request deletion, and opt-out of the sale of personal information (though we do not sell personal information).

To exercise any of these rights, please contact us using the information provided below.

7. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to:

• Maintain your session and preferences
• Understand how you use our Service
• Improve our Service and user experience
• Provide analytics and measure performance

You can control cookies through your browser settings. Note that disabling cookies may affect the functionality of the Service.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place to protect your information in accordance with applicable data protection laws, including standard contractual clauses approved by relevant authorities.

9. Children's Privacy

The Service is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If you believe we have collected information from a child under 16, please contact us immediately.

10. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party services you access.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last updated" date. Your continued use of the Service after such changes constitutes your acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

• Email: privacy@formly.dev

13. Data Protection Officer

For GDPR-related inquiries, you may also contact our Data Protection Officer at dpo@formly.dev.