Privacy Policy

Last updated 20 July 2026

deoochform (“we”) runs the form builder at forms.deooch.com and the MCP server at forms.deooch.com/api/mcp. This policy covers both.

What we collect

  • Account data — your email address, name, workspace role, and plan. You give us this when you sign up.
  • Content you create — form titles, descriptions, fields, and version history.
  • Form responses — whatever respondents type into your public forms. We are a processor for this data; you are the controller and decide what to ask for.
  • Usage analytics — aggregate, cookieless page metrics from Vercel Analytics. No cross-site tracking, no advertising identifiers.

We do not sell personal data, and we do not use your forms or responses to train AI models.

MCP and AI assistants

When you connect an AI assistant (Claude, ChatGPT, or any MCP client), it authenticates over OAuth and acts on your behalf using a scoped access token. It can read and write only the forms and submissions your own account can already reach. You can revoke the connection at any time from your client’s connector settings, which immediately invalidates the token.

Data the assistant retrieves is handled under that assistant vendor’s own privacy policy once it leaves our server. We never send your data to a model provider ourselves.

Who we share it with

Only the subprocessors we need to run the service: Supabase (database and authentication), Vercel (hosting and analytics), and Resend (notification emails). We also disclose data when the law requires it.

How long we keep it

Forms and submissions live until you delete them. Deleted forms are soft-deleted first and purged within 30 days. Closing your account removes your account data and all associated forms and submissions within 30 days, except where we must retain records to meet a legal obligation.

Security

Traffic is encrypted with TLS and data is encrypted at rest. Access is scoped per workspace and enforced at the database layer, so members of one workspace cannot read another’s data. No system is perfectly secure, but we treat a breach affecting your data as something you hear about from us promptly.

Your rights

You can access, correct, export, or delete your data at any time — most of it directly from the dashboard, and the rest by emailing us. If you are in the EEA or UK, the GDPR rights of access, rectification, erasure, restriction, portability, and objection apply. If you are in California, the CCPA rights of know, delete, correct, and opt out of sale apply — and we do not sell data, so there is nothing to opt out of.

Children

deoochform is not directed at children under 13, and we do not knowingly collect their data.

Changes

If we change this policy materially, we will update the date above and email account holders before it takes effect.

Contact

Privacy questions, data requests, or anything else: help@deooch.com. We reply within one business day.