Legal

Privacy policy

Version 2026.10 · Effective [to be confirmed]

This policy explains how we collect, use, share and protect personal data when you use SOYL Forms — our website, the SOYL Forms Android app and the forms our customers publish with it — and the rights you have. It is written to meet the Information Technology Act, 2000 and the SPDI Rules, 2011, and the Digital Personal Data Protection Act, 2023 ("DPDP Act") and DPDP Rules, 2025.

1. Who we are

SOYL Forms is operated by [to be confirmed] ("we", "us"), a business based in India.

Legal name: [to be confirmed] ([to be confirmed])
CIN / LLPIN: [to be confirmed]
Registered office: [to be confirmed]
Support: [to be confirmed] · Privacy: [to be confirmed]

2. Our role: fiduciary and processor

Your account (creators). When you sign up to build forms, we are the Data Fiduciary for your account data: we decide why and how it is processed, as described in this policy.
Form responses (respondents). When you answer a form, the person or organisation that published it (the "publisher") is the Data Fiduciary for your answers. We are their Data Processor: we store and process the answers only to provide SOYL Forms to them, under our Data Processing Addendum. The publisher's own privacy notice governs how they use your answers.

3. What we collect, why, and for how long

Data	Purpose	Legal basis	Retention
Account: name, email, sign-in identifiers, workspace and role	Create and secure your account, provide the service, send service emails	Your consent when you sign up (DPDP s.6)	While your account exists; erased after you delete it
Your content: forms, brand kits, logos, documents, AI prompts	Build, publish and brand your forms; AI drafting on request	Consent; data you provide for that purpose (DPDP s.7(a))	Until you delete it or your account
Billing: plan, invoices, Razorpay order, payment and subscription IDs (no card or UPI details)	Take payments, manage subscriptions, meet tax and accounting duties	Consent for the purchase; legal obligation for records	Up to 8 years after the transaction, as company and tax law require
Consent records: policy version accepted, 18+ confirmation, marketing choice, time, hashed IP and browser	Prove what you agreed to and when	Legal obligation and our legitimate need to demonstrate consent	While your account exists
Marketing choice and product-update emails	Send optional product updates	Your separate, optional consent — withdraw any time	Until you withdraw or delete your account
Security and system logs: IP address, browser, request details, errors	Keep the service secure, investigate incidents, meet CERT-In Directions	Legal obligation (CERT-In Directions, 2022)	180 days
Requests and reports you send us: email, message, hashed IP	Handle grievances, data-rights requests and abuse reports	Legal obligation (grievance redressal)	3 years after the request is resolved
Form responses, files, signatures and saved progress (respondents)	Provide the service to the form's publisher	Processed on the publisher's instructions (they are the Data Fiduciary)	Until the publisher deletes them; unsubmitted saved progress after 30 days
Questions typed into a form's assistant (Form Guide), if a respondent uses it	Answer the respondent's questions about the form; show the publisher what people asked	Processed on the publisher's instructions (they are the Data Fiduciary)	Until the publisher deletes them or the form
Bot-check and rate-limit signals on forms (IP address, browser signals)	Stop spam and abuse of forms	Processed for the publisher; our legal duty to keep systems secure	Rate-limit keys are hashed and kept 1 day; Turnstile per Cloudflare

We do not sell personal data, and we do not use form responses for advertising or profiling.

4. If you answer a form

Every published form shows who collects the responses and, when they provide one, a link to their privacy notice. Your answers, uploaded files and the submission time are stored for the publisher and shown to members of their workspace. If you choose to save your progress, we keep those unsubmitted answers for up to 30 days. To stop spam, a form may run a Cloudflare Turnstile check that uses your IP address and browser signals. If the publisher turned them on, a confirmation email may be sent to you, and your responses may be sent to tools the publisher connected (for example Google Sheets, Slack or a webhook).

End-to-end encrypted forms. Some publishers use vault forms (marked "End-to-end encrypted" on the form). On a vault form, your answers, hidden fields and uploaded files are encrypted in your browser before they are sent, with a key that only the publisher's workspace holds. We store the encrypted data but cannot read it, and we cannot decrypt it for anyone. We still process information about the response that is not encrypted: which form it belongs to, when it was sent, how long it took, the link source, the number and size of uploaded files, roughly how long the answers are (the size of the encrypted data follows it), and the network signals used for bot checks and rate limits. Anything placed in the form's web address (for example a prefilled answer) reaches our servers like any other web request. Vault forms don't save unsubmitted progress, and there is no confirmation email. Encryption keeps the content confidential; it does not prove who sent a response or that a stored response wasn't added or swapped by someone with access to our systems. This protection depends on the software we serve to your browser, as with every browser-based encryption product.

To access, correct or delete your answers, contact the publisher — they control them. If you can't reach the publisher, or a form looks like a scam, use our grievance page or report the form and we will help or pass your request on.

5. AI features

When a creator uses AI drafting or brand extraction, the description, notes, documents or website they provide are sent to Microsoft Azure AI to generate a result. Answers submitted by respondents are never sent to any AI provider. We do not use customer data to train AI models, and under our provider's terms prompts and outputs are not used to train its models. If you connect your own AI assistant with an API key, it can read your forms and summary statistics of your responses on your instruction; that assistant's provider is your choice.

Fill with AI. Unless the publisher turned it off, a form offers to let you ask your own AI assistant (for example ChatGPT, Claude or Gemini) to draft your answers. If you use it, the form's questions go to the assistant you pick, from your browser, under that provider's terms and your account with it. The assistant returns a link with the drafted answers in the part of the address after "#", which browsers never send to us or to anyone else. The form fills the answers on your device for you to check, and nothing is sent to the publisher until you press Submit. We do not send your answers to any AI provider, and we record only that a response was filled with an assistant.

Form Guide. A publisher may add an assistant to their form that answers questions about it (for example, what a question means or which document to use). If you use it, the messages you type into it are sent to Microsoft Azure AI, together with the form's questions and the explanations the publisher wrote, to write a reply. Your messages are also stored for the publisher, without your name, contact details or a link to your response, so they can see what people found unclear; they are kept until the publisher deletes them or the form. Answers you type into the form's fields are still never sent to the assistant or to any AI provider. Please don't type personal details into the assistant. The assistant can't see, fill in or submit your answers.

We share personal data only with service providers (sub-processors) that help us run SOYL Forms, under contracts that protect it. In summary: Microsoft Azure (Container Apps, Database for PostgreSQL, Key Vault, Log Analytics); Microsoft Entra External ID; Azure Communication Services (Email); Cloudflare R2; Cloudflare Turnstile; Razorpay; Microsoft Azure AI Foundry; Google Fonts. See the full list with purposes and locations on our sub-processors page. We may also disclose data when the law requires it — for example to a court, CERT-In or a law-enforcement agency with lawful authority — or to protect people's safety. If we are involved in a merger or sale, data may transfer to the new owner under this policy.

7. Where data is stored and cross-border transfers

Our application and primary database run in Microsoft Azure's Central India region, and our email service stores data in India. Sign-in data is held in Microsoft Entra External ID's Asia-Pacific identity geography. Some providers, such as Cloudflare and Google Fonts, operate global networks and may process data outside India. We transfer data abroad only as section 16 of the DPDP Act allows and will stop transfers to any country the Government of India restricts.

8. How we protect data

Encryption in transit (TLS/HTTPS with HSTS) and encryption at rest by our cloud providers.
A database reachable only on a private network, with a restricted application role and row-level tenant isolation.
Secrets kept in Azure Key Vault and accessed through managed identities; least-privilege access for staff and systems.
Passwords handled by Microsoft Entra; session tokens and API keys stored only as hashes.
Rate limits, bot checks, audit logs of operator actions, and security logging retained for 180 days.
Optional end-to-end encrypted vault forms (Security Plus add-on): answers and files are encrypted in the respondent's browser and can only be decrypted with the workspace's vault passphrase or recovery key, which we never receive. We cannot recover vault data if both are lost. Changing the passphrase does not take access away from someone who already knew it.

More detail is on our security page. No system is perfectly secure; we work continuously to protect your data.

9. If there is a data breach

If a personal data breach affects you, we will tell you without undue delay — what happened, the likely consequences, what we are doing and what you can do. We report cyber security incidents to CERT-In within 6 hours, and, once the DPDP Rules' breach provisions apply (from 13 May 2027), we will notify the Data Protection Board of India within 72 hours. For breaches affecting form responses, we notify the publisher within 24 hours of confirming the breach so they can inform respondents.

10. Retention and deletion

We keep personal data only as long as needed for the purposes above (see the table in section 3). You can delete forms, responses and brand kits at any time, and delete your whole account from Account settings in the app or on the website (see how to delete your account). When you delete your account we disable it immediately and permanently remove your data shortly afterwards, usually within a day, except records the law requires us to keep, such as invoices. Deleted responses are erased, not hidden. Deleted data disappears from our encrypted database backups when they expire, within 14 days. Unsubmitted saved progress is deleted after 30 days.

11. Your rights

You have the right to:

Access a summary of your personal data and the processing we do, and the identities of those we shared it with. Account holders can download their data from Account settings.
Correct, complete or update inaccurate or incomplete data, and erase data we no longer need.
Withdraw consent at any time, as easily as you gave it — for example by turning off product emails or deleting your account. Withdrawal doesn't affect processing already done.
Nominate a person to exercise your rights if you die or become incapable (Account settings → Your data and rights).
Grievance redressal from our Grievance Officer (section 15), and then to complain to the Data Protection Board of India.

Send requests through our grievance and data-rights form or email [to be confirmed]. We may need to verify your identity first. We respond within 15 days. If you answered a form, contact its publisher first (section 4).

12. Children

You must be 18 or older to create a SOYL Forms account, and we do not knowingly collect children's data for our own purposes. A publisher who uses SOYL Forms to collect data from anyone under 18 must first obtain verifiable consent from the child's parent or lawful guardian, as the DPDP Act requires, and must not use the data for tracking, behavioural monitoring or targeted advertising. If you believe a child's data was collected without that consent, please report the form.

13. Cookies and analytics

We use only essential cookies and browser storage: to keep you signed in, to complete sign-in securely, to remember access to a password-protected form, and to remember display, language and progress preferences on your device. We do not use analytics or advertising cookies. Published forms do not load advertising or third-party tracking scripts. Forms that use a Google font load it from Google Fonts, which receives your IP address.

14. Language

This policy is available in English. A Hindi version is available on request — write to [to be confirmed]. You may also ask for this notice in any other language listed in the Eighth Schedule to the Constitution, as the DPDP Act provides.

15. Grievance Officer and contact

Grievance Officer: [to be confirmed], [to be confirmed]
Email: [to be confirmed]
Phone: [to be confirmed] (Monday to Friday, 10:00–18:00 IST, except public holidays)
Post: [to be confirmed], [to be confirmed]

We acknowledge every grievance within 24 hours and resolve it within 15 days of receipt. You can also submit a grievance, a data-rights request or an abuse report through our online form, which gives you a reference number.

16. Changes to this policy

We will update this page when the policy changes, change its version and effective date, and notify account holders of significant changes by email or in the app; where the law requires, we will ask for your consent again. See also our Terms of service.

Version history

Version 2026.10 (effective [to be confirmed]): added who we are, our roles, a data inventory with legal bases and retention, respondent notice, rights including nomination, children, breach notification, grievance timelines, language availability and the sub-processor list.
November 2026: described Form Guide, the assistant a publisher can add to a form (sections 3 and 5).
30 October 2026: described Fill with AI, where you can ask your own AI assistant to draft your answers (section 5).
13 October 2026: moved hosting, sign-in and email to Microsoft Azure; added bot checks and saved-progress retention.
29 September 2026: first published version.