Privacy Notice

This Privacy Notice explains how Evolon Studio Pvt Ltd ("Evolon Studio", "we", "us" or "our") collects, uses, shares and protects personal data in connection with Fomli, our online form-building service, and our websites (together, the "Service"), and the rights you have. Fomli is a product of Evolon Studio. It should be read together with our Terms of Service.

1. Who we are

The Service is provided by Evolon Studio Pvt Ltd, a private limited company incorporated in the Republic of Maldives (company registration number C42552026), whose registered office is at Sinaf, Dhoodigan, Gn. Fuvahmulah, Republic of Maldives.

For the personal data of our customers, their team members and visitors to our websites, we are the controller. You can contact us about privacy at any time at contact@evolon.studio.

2. Our two roles

When we are the controller. We decide how and why personal data about our customers, their team members and our website visitors is used, for example to run accounts, take payments, provide support and keep the Service secure. This notice mainly describes this processing.

When we are a processor. When our customers build forms, the answers that Respondents (the people who fill in those forms) submit are collected on behalf of the customer who owns the form. For that data the customer is the controller and we process it only on their instructions, under the data processing terms in our Terms of Service. If you filled in a form built with Fomli and have a question about your answers, please contact the organisation that published the form; we will help them respond. Section 6 explains how we protect Respondents' data.

3. Personal data we collect

Information you give us

• Account data: your name, email address and password (stored only as a one-way hash), and your preferences.
• Workspace and team data: workspace names, the people you invite, their roles and invitations.
• Security data: two-factor authentication settings (secrets are encrypted), passkey public keys and recovery codes (encrypted).
• Sign in with Google: if you choose it, your Google account identifier, name and email address, and whether Google has verified that email.
• Billing data: your name, email address, country, postal code where required, the plan you buy and transaction and subscription identifiers. Payment card or other payment details are collected and processed by Paddle, our Merchant of Record; we never receive or store full card numbers.
• Communications: messages you send through our contact form or by email, and our replies.
• Customer Data: the forms, designs, files and integration settings you create. Integration secrets (such as webhook signing secrets and custom headers) and the access tokens of connected accounts (Google, Microsoft, Airtable, Notion) are encrypted at rest.

Information we collect automatically

• Log and device data: IP address, browser and device type, pages requested, timestamps and error information, used to operate and secure the Service and to apply rate limits.
• Activity records: a record of changes made within workspaces (for example, who edited a form and when) so that workspace owners can audit activity. These records never contain form answers, passwords, tokens or secrets.
• Cookies and similar technologies: see section 11.

4. How we use personal data and our legal bases

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You can ask us for more information about that assessment. We do not use personal data for automated decision-making that produces legal or similarly significant effects.

5. How we share personal data

We do not sell personal data, and we do not share it with third parties for their own advertising. We share it only with:

• Paddle (Paddle.com Market Limited and its affiliates), our reseller and Merchant of Record, which processes payments, invoicing, tax, refunds and fraud checks. Paddle acts as an independent controller for that processing; see Paddle's privacy notice.
• Service providers (sub-processors) that host and operate the Service on our behalf, such as cloud hosting, storage, database, email delivery, website analytics (Google Analytics, on marketing pages only) and team messaging (contact page messages are forwarded to our support chat) providers, under contracts that require them to protect the data and use it only on our instructions. A current list is available on request at contact@evolon.studio.
• Google, when you choose to sign in with Google or connect Google Sheets.
• Microsoft, Airtable and Notion, when you choose to connect an account to send responses to Microsoft Excel, Airtable or Notion. We receive only what is needed to connect (an access token and the account's email address or workspace name) and use it only to create the table and add the responses you send there.
• Destinations you configure, such as webhooks, APIs, spreadsheets and databases, to which the Service delivers form responses at your instruction.
• Professional advisers, such as lawyers, accountants and auditors, under a duty of confidentiality.
• Public authorities, courts and regulators, where we are required to by law or need to in order to protect rights, property or safety.
• A successor or buyer, if we are involved in a merger, acquisition, financing or sale of all or part of our business, subject to this Privacy Notice.

6. Respondents' data

For form responses we act as a processor for our customers, and we have built the Service to collect as little as possible:

• Respondents' IP addresses are not stored. We keep only a keyed hash of the address, used to limit abuse, and reduce the user agent to a device class (desktop, mobile or tablet).
• Answers marked sensitive are encrypted before they are stored, are excluded from analytics, and are never saved on the Respondent's device.
• In-progress answers may be saved only in the Respondent's own browser so that they can continue later; they are not sent to us until the form is submitted.
• Pass-through mode lets a customer have answers deleted from our storage as soon as they have been delivered to the customer's integrations.
• Our staff do not read form responses except where a customer asks us to help with a support request or where the law requires it.

7. Google user data

When you sign in with Google, we request only your basic profile and email address (the openid, email and profile scopes) and use them only to create and secure your account. When you connect Google Sheets, we request the drive.file scope, which allows Fomli to create spreadsheets and add rows only to spreadsheets that Fomli creates for you; we cannot see your other files. Google access tokens are encrypted at rest, and you can disconnect at any time in the Service or in your Google account settings.

Fomli's use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models, do not sell it, and do not use it for advertising.

8. International transfers

We are based in the Republic of Maldives, and our service providers may process personal data in other countries. Where personal data originating in the European Economic Area, the United Kingdom or Switzerland is transferred to a country that has not been recognised as providing an adequate level of protection, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with additional measures where needed. You can ask us for a copy of the relevant safeguards.

9. How long we keep personal data

• Account data is kept while your account is open. When you close your account, your name, email address and sign-in details are anonymised immediately, and the workspaces you own alone are deleted.
• Form responses are kept until the customer deletes them or closes the workspace, on plans that include response storage. On plans without it, and on forms where the customer turns storage off, answers are deleted from our servers once they have been delivered to the customer's integrations. Deleted responses stay in the workspace trash for 30 days and are then permanently erased.
• Uploaded files follow the response or design they belong to; deleted files are permanently erased after 30 days.
• Billing records are kept for as long as tax and accounting laws require.
• Support communications are kept for as long as needed to deal with the enquiry and for a reasonable period afterwards to handle follow-up questions.
• Logs and activity records are kept only as long as needed for security, troubleshooting and accountability, and are deleted with the workspace they belong to.

Residual copies may remain in encrypted backups for a limited period until they are overwritten in the ordinary course.

10. How we protect personal data

We use appropriate technical and organisational measures, including encryption in transit (HTTPS), encryption at rest of sensitive answers, integration secrets and access tokens, hashed passwords, two-factor authentication and passkeys, role-based access within workspaces, administrative access restricted to authorised staff with two-factor authentication, signed webhooks, protection against requests to internal networks, and audit logging. No method of transmission or storage is completely secure, but we work to protect your data and to respond promptly to any incident. If we become aware of a personal data breach that is likely to result in a risk to you, we will notify you and the relevant authorities as the law requires.

11. Cookies and similar technologies

We use cookies that are strictly necessary to provide the Service or that remember choices you make. On our marketing pages (the home, pricing, templates, contact and legal pages) we also use Google Analytics cookies, only if you accept them in the cookie banner; you can change your choice at any time from "Cookie settings" at the bottom of those pages, and declining removes them. We do not use advertising cookies, and we do not use analytics inside the app or on public forms.

Public forms built with Fomli do not set cookies; any in-progress answers are kept in the Respondent's browser storage. Paddle sets its own cookies during checkout to process payments and prevent fraud; see Paddle's privacy notice.

12. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate or incomplete data;
• erase your data;
• restrict or object to our processing, including processing based on legitimate interests and any direct marketing;
• data portability, to receive data you provided in a structured, machine-readable format;
• withdraw consent at any time, where we rely on consent, without affecting processing before withdrawal; and
• complain to a data protection supervisory authority, in particular in the country where you live or work or where an alleged infringement took place.

You can update your name, export responses and close your account directly in the Service. To exercise any other right, email contact@evolon.studio. We will respond within one month, which may be extended by up to two further months for complex requests, in which case we will tell you. We may need to verify your identity before acting on a request. Requests about form responses should be sent to the organisation that published the form.

13. Children

The Service is intended for people aged 18 and over and is not directed at children. We do not knowingly collect personal data from children through our own website. Customers must not use the Service to collect children's personal data unless they comply with all applicable laws, including obtaining any required parental consent.

14. Changes to this notice

We may update this Privacy Notice from time to time. If we make material changes, we will notify account owners by email or in the Service before they take effect. The effective date at the top of this page shows when it was last changed.

15. Contact us

Evolon Studio Pvt Ltd (Evolon Studio)
Sinaf, Dhoodigan, Gn. Fuvahmulah
Republic of Maldives
Company registration number: C42552026
Phone: +960 9677417
Email: contact@evolon.studio
Website: evolon.studio