Privacy Policy
Last updated: September 28, 2026
Introduction
AwesomeFor.ms (“we”, “us”, “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your personal data when you use our service at awesomefor.ms.
This policy applies to all visitors and users of AwesomeFor.ms.
It does not cover the data our users collect through their forms: for that data, the author of the form is the controller and AwesomeFor.ms acts as a processor, under the Data Processing Agreement appended to the Terms of Service. If you have responded to a form, contact its author to exercise your rights.
Data controller
The data controller is Antonin CLAUZIER, operating under the trade name clauzier.dev.
Email: contact[at]awesomefor.ms
In accordance with Article 37 of the GDPR, AwesomeFor.ms is not required to appoint a Data Protection Officer (DPO). For any questions about the protection of your data, you can contact us at the email address above.
Data collected
Account data
- Email address (required, for signing in and for service emails)
- Name (required, asked when you first sign in)
- Passkeys: identifier and public key of each registered passkey; the private key never leaves your device
- Magic links: short-lived, single-use sign-in token sent by email, and the sign-in method used last
- Language and theme preferences
- Date and version of the terms you accepted
- Your choice regarding email tracking (date of your consent, if any)
Form data
- The forms you create (structure, fields, settings)
- Responses submitted to your forms
Payment data
- The last four digits of your credit card (for display purposes only)
- Your card expiration date
- A secure card token (stored by Stancer, our payment provider)
We erase this data from our systems when the subscription ends or when the account is deleted. We never store your full card number: you enter it directly on Stancer’s payment page, and Stancer processes your payment data as a separate controller (see the “Sub-processors” section).
Usage data
- Usage counters for your quotas (responses, AI generations, emails, storage)
- Activity log of your workspace (for example, forms created, edited, published or deleted), which you can view in your workspace
Technical data
- IP address (for rate limiting and security)
- Browser type and version (via server logs)
AI form generation
When you ask the AI to create a form, the description you enter is sent to Mistral AI (France, European Union), with your account language and today’s date, to produce the form. We do not keep this description: only its length and technical metrics (duration, model used, volume processed) are logged. The generated form is saved in your account like any other form. Mistral AI processes this data as a processor and may keep it for a limited period to detect abuse. Avoid including personal data in your description.
Google Sheets integration
If you enable the Google Sheets integration on a form, each new response is sent to the spreadsheet you choose, using the service account credentials you provide (stored encrypted). Responses are then transferred to Google LLC (United States), at your initiative and on your behalf. This transfer is covered by the EU–US Data Privacy Framework, to which Google LLC has signed up, and by the European Commission’s standard contractual clauses. You can disable the integration at any time; responses already sent stay in your spreadsheet.
Form reports
Anyone can report a form they believe to be unlawful or fraudulent. We then record the reason and description of the report, the IP address and browser (user agent) of the person reporting it, and a copy of the reported form, to review the report and prevent abuse. This data is deleted automatically 12 months after the report.
Analytics
We measure the site's audience with Rybbit, a cookie-free audience measurement tool self-hosted by AwesomeFor.ms on OVHcloud, in France. It processes pseudonymised data: an identifier computed by hashing your IP address and your browser (user agent), the pages visited (address, parameters and title), the referring site, the outbound links clicked, your browser's language and screen size, the browser, operating system and device type, the approximate location derived from the IP address (country, region, city), as well as page load times and the technical errors encountered. This data is not shared with any third party and is not used to track you across sites.
The script also creates a random identifier in your browser’s local storage (rybbit-visitor-id). We erase it as soon as the script has loaded: no persistent identifier is therefore kept in your browser, and this identifier is not sent to us.
This data is kept for 13 months, then deleted automatically.
This audience measurement is based on our legitimate interest in knowing how the site is visited in order to improve it (Article 6.1.f GDPR). As it is limited to traffic statistics, it falls under the consent exemption for audience measurement (Article 82 of the French Data Protection Act and CNIL guidelines): no consent banner is therefore displayed.
You can object to this audience measurement at any time by ticking the box below. Your choice is saved in this browser’s local storage (disable-rybbit) and the measurement script is then no longer loaded, from the next page onwards. You can also block the script served by r.clauzier.dev in your browser, for example with a content blocker.
Rybbit is only loaded on the pages of the website and of your account. It is loaded neither on published forms, including when they are embedded in another website, nor on the magic link sign-in page.
Support chat
The support chat runs on Chatwoot, self-hosted by AwesomeFor.ms (support.awesomefor.ms). It only loads when you click the chat button, shown on the pages of the website and of your workspace but not on published forms: before that click, no cookie is set and no data is sent to it. Once loaded, it sets the cookies described below and uses your browser’s local storage to keep your conversation.
If you are signed in when you open the chat, your name, email address, plan, subscription status and usage metrics (number of forms, and this month’s responses, AI generations and emails, storage used, number of webhooks) are sent to the chat, so that we can help you without asking for this information again. This data and your messages stay on our infrastructure and are not shared with any third party.
Your contact and conversations in the chat are deleted automatically when your account is deleted. Otherwise, they are deleted 3 years after your last exchange with support, or sooner on request by email.
Email tracking
If you agree, the service emails we send you (billing, notifications) contain an invisible pixel and tracked links. We then record the sending, subject, opening and clicks of each email, without keeping its content, to measure the deliverability and engagement of our service emails and to diagnose delivery problems.
This tracking is based on your consent (Article 6.1.a GDPR and Article 82 of the French Data Protection Act). It is off by default: you can turn it on when you first sign in or in your settings, and withdraw your consent at any time from your settings. Withdrawing it stops the tracking and erases the tracking data already collected.
This data is kept for 60 days, then deleted automatically. Emails sent to anyone who has not given their consent are not tracked, nor are sign-in links, emails sent to the people who respond to your forms and emails about the deletion of your account.
Moderation
To handle reports of illegal content and enforce our terms, we process data about reports and moderation decisions.
- Purposes — handling form reports (acknowledgement of receipt, review, informing their author of the decision taken), taking and stating the reasons for moderation measures, such as unpublishing a form or warning or suspending an account, preventing a suspended user from signing up again, and handling complaints against these decisions.
- Legal bases — legal obligation (article 6.1.c GDPR) under Regulation (EU) 2022/2065 on digital services, in particular its articles 16, 17 and 20; legitimate interest (article 6.1.f) in enforcing our terms and keeping the Service secure.
- Data processed — for reports: name and email address of their author (optional for child sexual abuse material), reason, explanation, exact location of the reported content, good-faith declaration, IP address and browser, copy of the reported form; for warnings and decisions: reason and article of the terms applied, statement of facts, whether it is for serious misconduct, date, author of the decision and any internal note; in the event of a suspension, a fingerprint (salted hash) of the account’s email address, computed after normalising the address.
- Recipients — the AwesomeFor.ms team. The identity of the author of a report is not disclosed to the reported user, unless required by law.
- Retention period — reports are kept for 12 months after their receipt; moderation decisions and their reasons, as well as the fingerprint of a suspended account’s email address, for 12 months after the decision. The suspended account is then permanently deleted, following the same procedure as an account deletion, and the details of the decision are erased.
- Data freeze — when the suspension is issued for phishing, malware, illegal content, attempted access to other users' data or a compromised account, the account data is frozen until it is deleted, 12 months after the decision: it can no longer be exported or deleted from your workspace. You can still exercise your rights by email, within the limits set by the GDPR, in particular where this data is needed to establish, exercise or defend legal claims.
Use of data
- To provide and maintain the Service
- To authenticate you securely (magic links and passkeys)
- To send you service emails (sign-in links, confirmations, quota notifications, payment reminders, changes to our terms)
- To measure the deliverability and engagement of our service emails, if you consent to it
- To answer your support requests
- To generate forms with AI when you ask for it
- To review form reports and prevent abuse
- To measure the site's audience (traffic statistics)
- To improve the Service based on aggregated and anonymized usage data
We do not sell, rent, or share your personal data with third parties for commercial purposes.
Legal basis for processing
In accordance with the GDPR (Article 6), we process your personal data on the following legal bases:
- Performance of contract (Article 6.1.b) — to provide the Service, manage your account, process form responses, generate forms with AI at your request, and manage your subscription and payments.
- Legitimate interest (Article 6.1.f) — to keep the Service secure, prevent abuse, review reports, answer your support requests, measure the site's audience and improve the Service.
- Legal obligation (Article 6.1.c) — retention of billing data in accordance with the French Commercial Code; handling of reports and statement of reasons for moderation decisions under Regulation (EU) 2022/2065 on digital services.
- Consent (Article 6.1.a) — for open and click tracking of our service emails, if you turn it on.
Sub-processors
We use the following sub-processors for the operation of the Service:
- OVHcloud SAS (France) — hosting of the Service and data in France (EU).
- Mistral AI (France) — AI form generation, from the description you enter.
- Forward Email (United States) — sending transactional emails (notifications, sign-in links, reminders).
Stancer (France), a payment service provider, processes payment data (card number, transaction data) as a separate controller, not as a processor: it processes it to execute payments and to meet its own legal obligations, in particular fraud and money-laundering prevention. Its own privacy policy applies to this processing.
When you enable the Google Sheets integration or webhooks, responses are sent to the recipients you have chosen (Google LLC, United States, for Google Sheets). These recipients act on your behalf and are not our processors.
Some data is transferred outside the European Union (Forward Email, United States). These transfers are governed by the European Commission's Standard Contractual Clauses (SCCs), in accordance with Article 46 of the GDPR.
Hosting and security
Your data is hosted by OVHcloud SAS in France (EU).
Error monitoring is handled by a self-hosted GlitchTip instance — no data leaves our infrastructure for this purpose.
The support chat (Chatwoot) is also self-hosted: the data sent to it stays on our infrastructure.
Data retention
Your account data is retained as long as your account is active. Form data and responses are retained until you delete them.
When your subscription ends, your account moves to the free plan. Forms beyond its limits remain available read-only for 30 days, then are permanently deleted with their responses and files. You are notified by email at least 7 days before.
You can delete your account at any time from your settings, after confirming your email address. Your subscription is then stopped and your forms no longer accept responses. Your account, your forms, their responses and files are permanently erased 30 days after your request; until then, you can cancel it by signing in and clicking “Cancel the deletion”. Only the following are then kept: your billing records, for the legal retention period (10 years); reports about your forms, for 12 months after they are received; technical logs, for 12 months; backups, for 7 days. Your support chat contact and conversations are deleted along with your account.
Specific retention periods
- Billing data: 10 years (legal obligation, French Commercial Code art. L123-22)
- Technical logs (IP addresses): 12 months
- Activity log: 90 days, then deleted automatically
- Sign-in links (single-use tokens): automatically deleted within 48 hours after they expire
- Accounts never activated (email address not confirmed, never signed in, no form and no subscription): automatically deleted 30 days after they were created
- Service email tracking: 60 days, then deleted automatically
- Form reports: 12 months, then deleted automatically
- Fingerprint of a suspended account’s email address: 12 months after the decision
- Descriptions entered for AI generation: not kept by AwesomeFor.ms
- Support chat (contact and conversations): deleted when your account is deleted, and at the latest 3 years after the last exchange
- Audience measurement (Rybbit): 13 months, then deleted automatically
- Backups: 7 days after deletion of source data
Your rights (GDPR)
In accordance with the General Data Protection Regulation (GDPR), you have the following rights:
- Right to access your personal data
- Right to rectify inaccurate data
- Right to erasure of your data
- Right to data portability in a structured format
- Right to object to or restrict the processing of your data, including audience measurement
- Right to set instructions regarding your data after your death (Article 85 of the French Data Protection Act)
- Right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés — www.cnil.fr), the French data protection authority, under Article 77 of the GDPR
- Right to withdraw your consent at any time, where processing is based on consent (Article 7.3 of the GDPR), without affecting the lawfulness of processing carried out before the withdrawal
No decision based solely on automated processing is taken about you (Article 22 of the GDPR).
To exercise any of these rights, contact us at the address below. We commit to responding to your request within one month, in accordance with Article 12.3 of the GDPR.
Data breach
In the event of a personal data breach, we undertake to notify the CNIL within 72 hours in accordance with Article 33 of the GDPR, and to inform the data subjects when the breach is likely to result in a high risk to their rights and freedoms (Article 34 of the GDPR).
Contact
For any questions regarding the protection of your data:
Email: contact[at]awesomefor.ms