Privacy Policy

This Privacy Policy explains how EGF Fastighetsservice AB (trading as Formward) ("Formward", "we", "us", or "our") collects, uses, and protects personal data in connection with the Formward form-backend service at formward.eu (the "Service"). We are committed to processing personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Swedish data-protection law. A defining principle of the Service is that Formward stores and processes your form-submission data in the EU (billing is handled by Stripe, which never receives form data; see section 6). Where you configure a destination outside the EU - a notification or autoresponder mailbox with a non-EU provider, Google Sheets sync, or a webhook URL - data goes there on your instruction, as controller.

1. Who we are and our roles

The Service is operated by EGF Fastighetsservice AB, a company registered in Sweden (org. nr 559501-3573) with its registered office at Kivra: 559501-3573, 106 31 Stockholm, referred to in this Policy as "Formward".

• We are the controller for the account data we collect to operate the Service and our business (see section 2).
• We act as a processor for the personal data contained in form submissions made by your website visitors. For that data, you (the Formward customer) are the controller; we process it on your behalf (see section 12).

Contact for privacy and data protection matters: privacy@formward.eu.
General contact: team@formward.eu.

2. What personal data we collect

2.1 Account data

When you register we collect your email address and store a securely hashed password. We never store your password in plain text. Authentication is handled by better-auth running on our own infrastructure; your credentials are not transmitted to any third-party identity provider.

For each active login we also record a session record containing the browser user-agent of the device that signed in, so that you can recognise your own sessions and spot a login you do not recognise. The session record stores no IP address: the address is used in memory to rate-limit login attempts and is not written to the database. You can view every active session under Account → Active sessions, and revoke any of them. The legal basis is our legitimate interest in account security (Art. 6(1)(f)), and the records are deleted when the session is revoked or expires.

2.2 Form submission contents

The core purpose of the Service is to receive the form submissions your website visitors send through your HTML forms. The contents of those submissions, arbitrary fields you define (e.g., name, message, the email address of your end-user), are stored in our database and displayed in your dashboard. You are the controller of this data; we process it on your behalf as a processor (see section 12).

2.3 IP addresses (pseudonymised)

To enable spam detection and rate limiting we process the IP address of the device that submits a form. We immediately pseudonymise the IP address using a keyed hash (HMAC-SHA-256 with a secret server-side salt) before storage, and store only that derived value. We do not write the raw IP address to disk. Keyed hashing means the stored value cannot be linked back to an IP address without our secret salt, which materially reduces the risk of re-identification compared with an unsalted hash. We do not treat the pseudonymised value as fully anonymous data: it remains personal data and is protected as such.

If a page owner uses a country-based audience rule on a hosted page, we estimate the visitor's country from the IP address using an offline database that runs on our own servers. The IP address is used in memory for that lookup only, is not stored or logged for this purpose, and is not sent to any third party. The estimate is approximate.

2.4 Billing data

Payment card details are handled exclusively by Stripe. We do not receive, process, or store card numbers. We retain the Stripe customer ID, subscription status, and invoice records necessary to manage your account and meet our accounting obligations.

2.5 Technical and usage logs

We keep minimal server-side logs (request timestamps, HTTP method, response codes) for security monitoring and service reliability. Where we record the IP address of an action for an audit trail, for example when an account holder accepts our Data Processing Agreement or when an operator performs an administrative action, we store it in the same pseudonymised (keyed-hash) form described in section 2.3 rather than as a raw IP address. Login session records (section 2.1) store no IP address at all. Web server access logs keep only a truncated address, with the last part removed, for abuse detection. Operating-system security logs on the server (for example a record of a failed connection attempt) can contain the connecting address; they are kept on the server for a short period for intrusion detection and are not linked to accounts or submissions.

2.6 Website and dashboard statistics (cookieless)

We measure page views on our website and in the signed-in dashboard with two tools: our own first-party counter and Plausible Analytics. Nothing is stored on your device for this: no cookie, no localStorage, no device or browser fingerprint. The only thing our code reads from your device is your own consent choice, so that a no is honoured.

Our own counter runs on our own EU infrastructure. For each page view we record the page path, the referring website's hostname (external referrers only), a country derived from your IP using a local offline lookup file, and a daily-rotating keyed hash of your IP address in the pseudonymised form described in section 2.3. The raw IP is never stored, and because the key rotates daily the hash cannot be used to follow a visitor across days. It also counts views of hosted forms, so form owners can see how often their form is opened. Records are deleted after 180 days.

Plausible Analytics is provided by Plausible Insights OÜ (Estonia), with data hosted in the EU (Hetzner, Germany). No Plausible script is loaded: our own code sends each page view through our own domain. Besides page views it sends two events with no further detail: that an account was created and that a form was created, so we can see how many visitors complete onboarding. Plausible receives the page address with identifiers removed and only campaign tags kept (utm parameters, ref and source), the referring website's address (external sites only, host only), your browser's user agent and your IP address. Plausible uses the IP address and user agent to derive country, region, city, browser, operating system and device type, and a visitor hash with a salt it deletes every 24 hours. It does not store the IP address or the user agent. Plausible never receives form-submission content and is not used on hosted forms, customer Pages or embeds, or in our admin area. Plausible stores individual page-view and session records, without the IP address or user agent, for up to 5 years, and shows us only aggregated statistics.

The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in understanding how our website and dashboard are used. Because nothing is written to your device and the only thing read from it is your consent choice, this measurement requires no consent under the ePrivacy Directive. We honour your choice anyway: if you switch off Analytics in our consent banner, or your browser sends a Global Privacy Control signal, neither our counter nor Plausible records the page view.

2.7 Optional onboarding session replay

When enabled, and only after you personally opt in, we record masked interactions on the signed-in form creation and setup screens to diagnose errors and improve onboarding. Session recording is off by default. Your consent is stored against your own account (not just your browser) together with the date and the version of the wording you agreed to, and nobody else who uses the same browser is recorded. We ask once, with a short, dismissible note in the dashboard; you can also change your choice at any time in Account settings or in cookie settings. Recordings are associated with your account and stored on our own EU infrastructure. They are not anonymous. User-specific text, all form values and sensitive attributes are removed before transfer and checked again before storage; only reviewed static interface labels remain visible. We do not record customer submission pages, public hosted forms, authentication, inbox, billing, account settings, the values you type, or network request and response bodies. To find bugs we keep only technical markers: a short error message (stripped of email addresses, tokens, identifiers and links), the error type, the method, path pattern and status code of a failed request to our own dashboard (no query string, headers or content), and a note when you click the same element repeatedly in quick succession. Staff accounts are never recorded.

Recordings expire after seven days and are then inaccessible; a background sweep removes expired rows at least every fifteen minutes while the worker runs. Authorized administrators can view recordings, and each viewing is audit logged. Withdrawing session-recording consent stops capture immediately and deletes your existing recordings. You can still withdraw, download or delete your recordings if your account is suspended. Account deletion also removes recordings. Infrastructure backups follow the backup retention described in our security documentation; expired data is not restored to active use.

3. Legal bases for processing (GDPR Article 6)

• Performance of a contract (Art. 6(1)(b)): processing your account email, hashed password, and submission data is necessary to provide the Service you have contracted for.
• Legitimate interests (Art. 6(1)(f)): we process pseudonymised IP addresses and technical logs to prevent spam, detect abuse, secure the Service, and improve it. These interests do not override your rights given the privacy-preserving measures we apply (immediate keyed-hash pseudonymisation, no raw-IP storage).
• Legal obligation (Art. 6(1)(c)): we retain certain billing and transaction records as required by tax and accounting law.
• Consent (Art. 6(1)(a)): where we set non-essential cookies, such as marketing cookies, we seek your consent via our cookie consent manager. You may withdraw consent at any time. Our cookieless statistics (section 2.6) rely on legitimate interest instead, and you can switch them off in the same place.

4. How we use personal data

• to provide, operate, and maintain the Service;
• to deliver submission notifications to the form owner and, on Professional and Business forms that use them, AI features such as spam scoring and summarisation;
• to prevent spam, fraud, and abuse, and to secure the Service;
• to process payments and meet our legal and tax obligations;
• to communicate service notices, security alerts, and support responses.

5. Sub-processors

We use the sub-processors listed below. Every sub-processor that receives form-submission content is located within the European Union or European Economic Area. Stripe Payments Europe, Limited (Ireland) processes billing and payment data for paying customers and never receives submission content. Cloudflare, Inc. (USA) is engaged only for the optional Turnstile check, on forms where the form owner enables it, and does not receive submission content either. Plausible Insights OÜ (Estonia) provides our website and dashboard statistics (section 2.6) and never receives submission content.

Optional anti-bot check. If a form owner enables Cloudflare Turnstile on a form, the visitor's browser contacts Cloudflare (USA) directly to solve the challenge, so Cloudflare receives browser challenge data such as the visitor's IP address and browser signals. It does not receive the answers submitted in the form, and our own server does not forward the visitor's IP address to Cloudflare. Any resulting transfer is covered by an appropriate Article 46 safeguard. Forms without Turnstile enabled involve no processing by Cloudflare.

Our sub-processor register is the canonical, current list, including what data each sub-processor receives. We will notify you of material changes in accordance with our Data Processing Agreement.

6. Data residency and international transfers

All submission data and account data are stored on servers operated by Hostup AB in Sweden. Transactional email is processed by Mailjet/Sinch within the EU (France). AI features run only for Professional and Business forms that have them switched on, and are performed by Mistral AI within the EU (France); Free and Personal submissions are never sent to Mistral. Subscription billing is handled by Stripe Payments Europe, Limited (Ireland), which processes the paying customer's own billing and payment data - name, email, billing address, and payment-method details. Stripe may transfer some of that billing data to its affiliates in the United States, including Stripe, Inc., under Standard Contractual Clauses and the EU-US Data Privacy Framework. Stripe never receives form-submission content or submitter personal data. Website and dashboard statistics are processed by Plausible Insights OÜ (Estonia), with data hosted in Germany.

By default, we do not transfer form-submission data - the personal data of the people who fill in your forms - outside the European Union or European Economic Area (EU/EEA). This is a deliberate architectural choice: every sub-processor that touches form-submission data was selected on the basis of EU/EEA residency, which removes the need for transfer mechanisms such as Standard Contractual Clauses for that data. There are two possible US transfers, both separate from form-submission content: the optional Cloudflare Turnstile anti-bot check (off unless a form owner enables it), where the visitor's browser sends challenge data to Cloudflare (USA) under an appropriate Article 46 safeguard; and billing data that Stripe Payments Europe, Limited may share with its US affiliates under Standard Contractual Clauses and the EU-US Data Privacy Framework.

7. Cookies

We use a minimal set of cookies. Essential cookies keep you logged in and store your consent choices; the optional marketing category is only activated with your consent via our consent manager. We set no analytics cookies: our cookieless statistics (section 2.6) run unless you switch off Analytics in the consent manager. See our Cookie Policy for full details and to manage your preferences.

8. Your rights under GDPR

As a data subject you have the following rights, subject to applicable conditions:

• Access (Art. 15): request a copy of the personal data we hold about you.
• Rectification (Art. 16): ask us to correct inaccurate or incomplete data.
• Erasure (Art. 17): request deletion where there is no overriding lawful basis for continued processing.
• Restriction (Art. 18): ask us to restrict processing in certain circumstances.
• Portability (Art. 20): request your data in a structured, machine-readable format.
• Objection (Art. 21): object to processing based on legitimate interests; we will stop unless we can demonstrate compelling legitimate grounds.
• Withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior lawful processing.

To exercise these rights, contact privacy@formward.eu or use your account settings. We will respond within the statutory period (generally one month). You also have the right to lodge a complaint with a supervisory authority. In Sweden, this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), or the supervisory authority in your country of residence.

Where the personal data relates to a submission you made through a form operated by a Formward customer, that customer is the controller; please direct your request to them. We will assist the customer in responding as their processor.

9. Retention

• Form submissions: retained according to the plan and the retention window configured by the customer, unless deleted earlier.
• Account data: retained while your account is active; after account deletion we remove your email and associated data within a reasonable period, except where retention is required by law.
• Pseudonymised IP addresses (submissions): retained for the same period as the submission they are associated with. Pseudonymised IPs captured for audit trails (DPA acceptance, operator actions) are retained for as long as we keep the associated audit record.
• Hosted page statistics and saved responses: daily page-view counts (with referring hostnames only) are kept for 13 months; funnel attempts (no personal data) for 90 days; a “save and continue later” link and its encrypted answers expire after 7 days and are then deleted.
• Website and dashboard statistics (section 2.6): our own counter's records are deleted after 180 days; Plausible keeps its page-view and session records (without IP address or user agent) for up to 5 years.
• Billing records: retained for the period required by applicable tax and accounting legislation.
• Backups: data may persist in encrypted backups for a limited period after deletion before being overwritten on the normal backup-rotation cycle.

10. Security

We apply technical and organisational measures proportionate to the risk:

• passwords are salted and hashed (better-auth) before storage;
• submitter IP addresses are pseudonymised with a keyed hash (HMAC-SHA-256 with a secret salt) immediately on receipt; the raw value is never written to disk. Login session records store no IP address (section 2.1);
• data is encrypted in transit (TLS 1.2+). At rest, backups are encrypted (age, public-key), integration OAuth tokens with AES-256-GCM, and two-factor secrets by the auth layer; the live database volume relies on the hosting provider's physical and access controls rather than disk-level encryption;
• access to production systems follows the principle of least privilege and is limited to authorised personnel;
• all infrastructure is located within the EU (Sweden).

See our Security page for more detail. No system is completely secure; if you believe you have found a vulnerability, contact security@formward.eu.

11. Children

The Service is not directed at children. Consistent with GDPR Article 8, we do not knowingly collect personal data from children under 16 without the consent of a parent or legal guardian. If you believe a child has provided us with personal data without appropriate consent, contact us and we will delete it promptly.

12. Your responsibilities as a customer (controller)

When you use Formward to collect submissions, you are an independent controller of your end-users' personal data. You are responsible for:

• having a valid lawful basis for collecting and processing the data your forms gather;
• publishing your own privacy notice to your end-users describing how you use their data and that Formward processes it on your behalf;
• responding to data-subject requests relating to submissions you collect (we will assist as your processor);
• not using the Service to collect special-category data without appropriate safeguards.

A Data Processing Agreement (DPA) governing our processing on your behalf is available, and can also be requested from privacy@formward.eu.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes we will update the "Last updated" date and, where appropriate, notify registered users by email. Continued use of the Service after the effective date constitutes acceptance of the revised policy.

14. Contact

For any questions about this policy or our data practices, contact us at:

EGF Fastighetsservice AB (operating as Formward)
Kivra: 559501-3573, 106 31 Stockholm
Privacy contact: privacy@formward.eu
General: team@formward.eu