This is an English translation provided for convenience. The Spanish version is the binding one; if they differ, the Spanish text prevails.
Data and privacyPrivacy policy
Last updated: October 22, 2026 (version 2026-10-22.2).
This policy explains what personal data we process when you use FormsBot (the site, the web tool and the desktop program), for what purpose, on what legal basis, who we share it with, how long we keep it and how to exercise your rights. It is written to comply with the EU General Data Protection Regulation (GDPR) and Peru's Personal Data Protection Law No. 29733.
1. Data controller
FormsBot, a service operated by its developer from Peru. Contact for any data matter: edroservices@gmail.com or the site's Support button.
2. What data we process, why and on what legal basis
| Data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|
| Email and name of your Google account | Create your account, sign you in, show your balance and notify you about your submissions and purchases | Performance of contract (6.1.b) |
| Form link, questions, settings and generated responses | Run the test submission you request and show you the result; export it if you are a paying customer | Performance of contract (6.1.b) |
| Record of what you accepted (Terms, Privacy, use per form), with date, IP and browser | To prove your consent and that you declared being the owner of, or having permission for, each form | Legal obligation (6.1.c) and legitimate interest (6.1.f) |
| IP, approximate country, browser and actions in the system (security logs) | Security, fraud and abuse prevention (for example, not giving free responses several times) and fixing failures | Legitimate interest (6.1.f) |
| Country saved in your account | Service statistics | Consent (6.1.a), only if you tick it |
| Email for news and offers | Send you the FormsBot newsletter | Consent (6.1.a), only if you tick it |
| Text of open questions and fictitious AI-generated answers, without the form link or your data | Reuse them on similar questions to answer faster and use less AI | Legitimate interest (6.1.f). Do not include personal data in your question titles |
| Purchase data (order, amount, status, refunds) | Charge, deliver credits or licenses, handle refunds and meet accounting obligations | Contract (6.1.b) and legal obligation (6.1.c) |
| Measurement cookies | Measure visits (the site shows no ads) | Consent (6.1.a), via the cookie banner |
We do not ask for sensitive data. We do not sell or rent your data. We make no automated decisions that produce legal effects on you; the automatic review of forms only decides whether a submission is processed according to the usage rules, and you can ask for a person to review it by writing to support.
3. The forms you test
When submitting, you declare that the form is yours or that you have its owner's permission. We store the link, the date, your IP and your browser as proof of that declaration. The responses we generate are fictitious: names and emails are made up, and respondent emails use reserved domains (example.com, example.org, example.net) that belong to no one, so no real person is written to by mistake.
4. Who we share data with (processors)
- Vercel (site hosting, USA).
- Supabase (database).
- Google: sign-in, Google Forms (destination of submissions), Gmail (service emails and newsletter), Google Analytics (only with your cookie consent).
- Izipay (card payments, Peru). We never see or store your card details.
- Mercado Pago (card, Yape, PagoEfectivo and balance payments). On the purchase page it loads its security script, which identifies the device to prevent fraud (needed to process the payment).
- Groq and NVIDIA (AI, only if you choose AI answers): they receive your form questions and your instructions, not your email or name.
Some of these providers are outside the European Economic Area and Peru. Those transfers are made with the safeguards of Chapter V of the GDPR (adequacy decisions such as the EU-US Data Privacy Framework or European Commission standard contractual clauses, depending on the provider).
5. How long we keep data
- Account: as long as you have it. If you delete it, it is anonymized immediately.
- Generated responses of each submission: 90 days; then they are deleted and only the summary (how many arrived) remains.
- Security logs with IP: 180 days.
- Consent records: while the account exists and up to 5 years after, to be able to prove them.
- Paid orders: the period required by tax rules, without your personal data if you delete the account.
- Newsletter: until you unsubscribe.
6. Your rights
You can exercise at any time, free of charge, your rights of access, rectification, erasure (to be forgotten), restriction, objection, portability and to withdraw your consent (without affecting what was done before). From My account → Privacy and data you can do it yourself:
- Download my data: a file with everything we store about you.
- Delete my account: anonymizes your account and your forms instantly.
- Turn the newsletter and saved country on or off.
- Unsubscribe from the newsletter with one click from any email.
For anything else, write to edroservices@gmail.com; we reply within 30 days at most. If you believe we are not handling your data properly, you can complain to the data protection authority of your country (in the EU, that of your Member State; in Peru, the National Authority for Personal Data Protection).
7. Cookies
If you reject or don't choose, no Google Analytics script is downloaded. The site shows no ads. We use necessary cookies (session, Google sign-in security, payment) that don't require consent. Measurement (Google Analytics) cookies are only activated if you press Accept on the banner; if you press Reject the site works the same. To change your choice, clear the site data in your browser and the banner will appear again.
8. Minors
The service is not aimed at people under 16 and we do not knowingly collect their data.
9. Security
Encrypted connection (HTTPS), database with row-level restricted access, a single active session per account, security logs and payment verification with cryptographic signatures. If a breach affecting you occurred, we would notify you and the authority within the legal deadlines.
10. Changes to this policy
If we change it significantly, we will ask you to accept it again when you sign in. Each version carries its date at the top and we store which version you accepted.