1. Scope and roles
This policy applies to FormDex websites, accounts, dashboards, APIs, notifications, billing, and support interactions. MeshDex is responsible for account, billing, security, and service-usage data. For personal data submitted through a customer’s form, the customer determines the collection purpose and FormDex processes that data to provide the service.
2. Data we process
- Account and profile data, including name, email address, authentication records, plan, and preferences.
- Billing data such as business/contact details, billing address, tax information, invoice and payment status. Payment-card credentials are handled by the payment provider and are not stored by FormDex.
- Form configuration, accepted submission fields, optional attachments, notification recipients, webhook settings, and delivery history.
- Security and operational data such as timestamps, IP address, user agent, origin, rate-limit events, audit records, and diagnostic errors.
- Messages and information you provide when requesting support, billing help, or exercising a data right.
3. Why we process data
We process data to create and secure accounts; accept, validate, store, display, export, and deliver submissions; provide email and webhook delivery; administer credits, plans, invoices, taxes, and payments; prevent abuse; diagnose incidents; communicate service and billing information; comply with law; and establish or defend legal claims.
Depending on the context and your location, processing may be necessary to provide the service, based on consent, required by law, or supported by another recognised legal basis. Where processing relies on consent, it may be withdrawn without affecting earlier lawful processing.
5. International processing
FormDex serves customers internationally, and data may be processed in countries other than where it was collected. Where required, we use appropriate contractual, organisational, and security safeguards for cross-border processing and comply with applicable transfer requirements.
6. Retention and deletion
We retain information only for as long as reasonably necessary for the service, security, accounting, dispute resolution, and legal obligations. Account, billing, invoice, audit, and fraud-prevention records may be retained after closure where law or legitimate recordkeeping requires it.
Submission records remain while the related form and account remain active unless deleted earlier. Attachment expiry is fixed when uploaded: Starter 30 days, Growth 180 days, and Scale 365 days. Deleting a form removes its submissions and schedules associated files for deletion. Backup copies may remain for a limited recovery cycle before being overwritten.
7. Security
We use access controls, authentication, encrypted transport, private file access, validation, rate controls, operational monitoring, and restricted administrative access. No system is risk-free; customers must protect their account credentials and form keys, use accurate allowed origins, enable appropriate anti-abuse controls, and promptly report suspected compromise.
8. Your rights and choices
Subject to applicable law, an individual may request access to information about processing, correction or completion of personal data, erasure, withdrawal of consent, grievance redressal, and nomination of another person to exercise rights in permitted circumstances. We may need to verify identity and may retain data that law requires us to keep.
If your data was submitted through a customer’s form, contact that form owner first because they control the purpose and content. We will reasonably assist the customer with verified requests.
9. Children
FormDex accounts are intended for adults and business use. We do not knowingly offer accounts to persons under 18. Customers must not intentionally collect children’s personal data through FormDex without satisfying applicable parental-consent and child-protection requirements.
10. Grievance and contact
Email the Grievance Desk at [email protected]. Include your account email, the form or submission context where relevant, the right or concern involved, and enough information to verify and investigate the request. Do not send passwords, API keys, payment-card details, or unnecessary submission content.
11. Changes to this policy
We may update this notice when the service or law changes. Material changes will be communicated through the service or registered email where appropriate. The updated date identifies the version currently in effect.