Start free

Privacy Policy

Last updated: 23 September 2026

This Privacy Policy describes how PulseFormCreator (“we”, “us”) collects, uses, and shares information when you use the PulseFormCreator service (the “Service”), available at www.pulseformcreator.com. PulseFormCreator is operated from Australia and intends to align with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs). It is not legal advice.

1. What we collect

We collect three categories of information:

  • Account data. Your email address (required), and any name or organization you choose to provide.
  • Survey content. The questions, titles, descriptions, theme settings, and metadata of surveys you create.
  • Response data. Answers submitted to your surveys by your respondents, along with the submission timestamp, a one-way hashed IP address (used only for abuse and duplicate detection), and a coarse user-agent string. We do not store raw IP addresses for response data. When a survey's owner uses People, replies or AI triage, we also keep the contact record built from the answers (email, name, company, phone and the answers the owner chooses to keep), the email conversation with the respondent, and the AI's labels for each response.

2. Why we collect it

  • To operate the Service (authenticate you, store surveys, deliver responses).
  • To prevent abuse (rate-limiting, spam protection).
  • To send service emails (sign-in codes, billing notices).
  • To improve the product, in aggregate and de-identified form.

We do not sell personal information. We do not use survey content or response data to train any AI model (yours or anyone else’s).

3. Who we share it with

We share data only with the third-party processors that make the Service work:

  • Supabase: database and authentication.
  • Vercel: application hosting and edge delivery.
  • SendGrid: the email we send (sign-in codes, receipts, notifications, emails to respondents and People) and the replies we receive for survey owners.
  • OpenAI (United States): the prompt you give the AI builder; and, only where a survey's owner turns them on or asks for them, responses for AI triage (with a spam check on its written answers) and AI draft replies, triage summaries for the digest email, one question's written answers when the owner asks for AI themes in Results, and a voter's chosen option for Ask why on polls. Answers to contact, name, address and website questions, files, signatures and hidden fields are never sent for triage or drafts, and email addresses, phone numbers and links typed into other answers are masked before triage, drafts and AI themes. OpenAI does not train on this data and may keep it for up to 30 days for abuse monitoring. The AI Data Policy has the details.
  • Cloudflare: storage for files respondents upload, and the anti-bot check on surveys whose owner turns it on.
  • Stripe: payment processing for paid plans.

Each processor has its own privacy policy. We choose processors with privacy postures consistent with the APPs and the GDPR. When a survey's owner connects another service (for example Slack, Google Sheets or Notion), responses are sent there at the owner's instruction.

4. Cookies and tracking

We use first-party, essential cookies for authentication and CSRF protection. We do not use third-party advertising cookies or cross-site trackers. Our site analytics are our own: no third-party analytics provider receives any data about your visit.

We also set one first-party cookie (pw_ft) that remembers how you first found PulseFormCreator: the referring website’s name and any campaign tags in the link, plus the page you landed on and the date. It holds nothing that identifies you, it is never shared, and it is kept for 90 days. We use it to tell which channels bring people here. We do not set it if your browser sends Do Not Track or Global Privacy Control, or if you are visiting from the EU, the EEA or the UK. Clearing your cookies removes it.

On our own website and app (never on the forms our customers share) we set a second first-party cookie, pw_vid, holding a random ID. It lets us count visits, see which pages and features are used, measure page speed, and compare two versions of a page to find out which one works better. When you sign in, it is linked to your account so we can see which visits led to an account. It is kept for 12 months, is never shared or sold, and clearing your cookies removes it. We do not set it if your browser sends Do Not Track or Global Privacy Control (we record nothing about your visit at all), or if you are visiting from the EU, the EEA or the UK. For those visits we count page views without any cookie, using a code derived from a secret that changes every day and is then deleted, so one day’s visits can never be linked to the next. We never store your IP address in our analytics, and analytics records are deleted after 13 months.

5. Retention

We aim to complete deletion within 7 days and always within 30 days, subject to legal record-keeping obligations. The table below gives the specifics by data type.

  • Account data is retained while your account is active.
  • Survey content is retained while the survey exists in your account.
  • Response data is retained while the parent survey exists. Deleting a survey deletes its responses. Deleting a response, by any route, also deletes its AI labels and its entries in People; a person whose only responses are deleted is removed from People, unless the survey's owner added them by hand. On Business, a survey's retention rule also removes people it brought in whose latest response is older than the rule.
Data type Retention Notes
Active form and survey data Until owner deletes Includes question text, responses, exports.
Deleted form and survey data Removed within 7 days, fully purged within 30 Including from backups where technically feasible.
Account data Removed within 7 days of request, fully purged within 30 Subject to legal record-keeping obligations.
Backups Rotated on a 30-day cycle Deleted data may persist in backups until the cycle completes.
Server logs 30 days Aggregated metrics may be retained longer.
Data sent to AI features Kept by OpenAI for up to 30 days; not used for training Abuse monitoring under OpenAI’s API terms (see AI Data Policy). The AI’s labels are kept with the response and deleted with it.

6. Your rights

You can request a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Sign in to your account and use the data-export and delete-account controls in your dashboard. We aim to respond to manual requests within 30 days.

7. Survey respondents

If you respond to a survey built on PulseFormCreator, the survey’s creator is the controller of your answers. We process those answers on their behalf, and the creator decides which features run on them, including the AI features in our AI Data Policy. To exercise rights over response data, contact the survey creator first. If you cannot reach them, contact us and we will assist.

8. International transfers

Some of our processors may store or process data outside Australia (notably in the United States and the European Union). Where this happens, we rely on contractual safeguards and the processor’s own data-transfer commitments.

9. Children

PulseFormCreator is not directed at children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

10. Changes to this policy

We will post material changes to this policy on this page and update the “Last updated” date. Continued use of the Service after a change means you accept the new policy.

11. Contact

Questions, requests, or complaints: use the data controls in your PulseFormCreator dashboard once signed in, or submit a privacy request via our public privacy / data request form. No sign-in is required.