Privacy Policy

Effective November 10, 2026

This Privacy Policy explains how Universal Forge 2025, Inc., doing business as All Purpose Forms ("All Purpose Forms," "we," "us," or "our"), collects, uses and protects personal information when you visit allpurposeforms.com, create an account, or use our form-building and website service (the "Service").

1. Two kinds of information

Your account information. When you or your team sign up and use the Service, we're responsible for that information as described in this policy.

Information collected by your forms. When people fill in a form or website built by one of our customers, that customer decides what's collected and why. We store and process those submissions (including any files attached to them) on the customer's behalf and only to provide the Service to them. If you filled in someone's form, contact that business about your information — we'll help them respond.

2. What we collect

• Account details: your name, email address, company name, and your password (stored only in scrambled, one-way form).
• Sign in with Google: if you choose it, Google shares your name, email address and a Google account ID with us. We use them only to create your login and sign you in. We never receive your Google password, and we don't post anything to your Google account.
• Google contacts (only if you connect them): when you choose “Connect Google contacts” while inviting people to a meeting, we get read-only access to your Google contacts and “Other contacts”. We search them only for the names and email addresses that match what you type in the Invite box, show the matches only to you, and don’t copy or store your contacts. We keep only an encrypted access token so the suggestions keep working. We never create, change or delete your contacts. You can disconnect at any time from the same screen, which also removes our access at Google.
• Google Drive (only if you connect it): we save a PDF of each completed submission into the Drive folder you pick. We can see and change only that folder and the files we create there, not your other files.
• Live meetings and presentations: when you or your guests join a live video meeting, the audio, video, chat and screen sharing pass through our video provider. If the host turns on recording, the meeting is recorded. If AI notes are on (everyone in the room sees a notice), the meeting is transcribed and summarized, and the transcript and summary are kept with the meeting in the host’s account and emailed to the host and, if the host chooses, to the people invited. We also keep who joined and for how long.
• Phishing Checker: the links you paste into our free link check (and, if you paste a whole email, the text, which we only scan for links and don’t keep). Results for each link are kept for up to 6 hours so repeat checks are fast.
• Two-step login: the setting you choose and the information needed to check your codes.
• Billing: your plan and billing history. Card details are entered on Stripe’s secure page and held by Stripe — we never see or store full card numbers.
• Content you create: your forms, website pages, images you upload, settings and integrations.
• Technical information: IP address, browser type, pages visited and dates/times, used for security, spam protection and keeping the Service running. When someone opens a form, we also record the web page it’s embedded on and the page that linked to it (if their browser shares it), so the form’s owner can see where submissions come from. We also keep an activity log of logins and important changes in each account (who, what, when and IP address) for a year, which account owners and admins can see.
• Messages: anything you send us through our contact form or by email.

3. How we use it

• To provide, maintain and secure the Service and your account.
• To process payments and manage subscriptions.
• To send service emails, such as submission notifications, login codes, invitations, password resets and billing notices.
• To prevent spam, fraud and abuse.
• To answer your questions and provide support. When you ask for help, our support staff may open your account to look at or fix a form or page. Each visit is logged and shown on your Team page, and billing, payments and login settings stay locked during it.
• To improve the Service, using information about how features are used.

We don’t sell personal information, and we don’t use form submissions, meeting recordings or transcripts, or any information from Google for advertising.

Information from Google

All Purpose Forms’ use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google information only to provide the features you turned on, we don’t sell it, use it for advertising, or use it to train AI models, and people at All Purpose Forms don’t read it unless you ask us to for support, it’s needed for security or to follow the law, or it has been made anonymous.

4. Who we share it with

Only with service providers that help us run the Service, under agreements to protect it, and only as needed:

• Stripe (payments), SendGrid (email delivery), Cloudflare (website security and performance) and our hosting provider.
• Google, when you choose Sign in with Google, connect Google contacts, Google Drive, a Google Docs or Google Sheets integration, or a Google Calendar for appointment booking (bookings are added to your calendar, and its busy times are read so they aren’t offered).
• Cloudflare, which runs our live video meetings and, when they’re switched on, their recordings and AI notes (transcripts are made with Cloudflare’s AI service and kept at Cloudflare for up to 7 days before we collect them).
• For the Phishing Checker: the web address being checked, sent to URLhaus (a public malware list run by abuse.ch), Google Web Risk and a public domain-registration lookup (RDAP), and the site the link points to is asked where it leads. Nothing about you is sent with them.
• Anthropic (our AI provider): the description you type into the AI form builder (and the text of a public web page, if you ask it to build from your website), the answers of a submission our spam filter finds borderline, so the AI can help decide whether it’s spam (account owners can turn this check off), and the answers of submissions you ask AI to summarize (files and signatures aren’t sent), and the words and photos of pages, forms and domain names when they are published, for our content safety check. They aren’t used to train AI models. Nothing from your Google account is sent to Anthropic.
• proxycheck.io: the IP address of people who sign up, publish, or send a form, to check whether it comes from a VPN, proxy, Tor or data centre. Only the IP address is sent; results are kept for 7 days.
• Places you send your own submissions, such as webhooks or other integrations you set up, and other services you choose to connect, such as Dropbox, Microsoft OneDrive, Mailchimp, Square, Shippo or Printful. Those services handle the information under their own privacy policies.

We may also disclose information if required by law, to protect the rights and safety of our users or the public, or as part of a merger or sale of our business (in which case this policy continues to apply).

5. Cookies

We use a small number of necessary cookies: one keeps you logged in, and one remembers a device you chose to trust for two-step login. Spam protection on forms may set its own security cookie. We don’t use advertising cookies.

Businesses that use All Purpose Forms can add their own Google Analytics, Google Tag Manager or Meta Pixel to their forms and websites. When they do, those services may set their own cookies on that business’s forms and pages, under the business’s own privacy policy. By default visitors are asked first, and nothing loads unless they accept. Only the form’s name is shared with those services, never the answers typed into a form.

6. How long we keep it

We keep account information while your account is open. Deleted submissions stay in Recently deleted for 30 days and are then removed for good, together with any files attached to them; unfinished submissions are cleared automatically. When an account is closed we delete or anonymize its information within a reasonable time, except where we must keep records (for example, billing records for tax purposes).

7. Security

All traffic uses secure HTTPS, passwords are stored only in scrambled form, and you can protect your login with two-step login. No system is perfectly secure, but we work to protect your information and will notify you as required by law if a breach affects it.

8. Your choices and rights

You can see and update your account details in the app, disconnect Google sign-in from Login & security and Google contacts from the Invite box when scheduling a meeting (you can also remove our access at any time from your Google account’s security settings), and ask us for a copy of your information or to delete it. Depending on where you live, you may have other rights under privacy laws. Contact us at the address below and we’ll respond within the time the law requires.

9. Children

The Service is for businesses and isn’t directed to children under 16. We don’t knowingly collect their information.

10. Changes

If we make important changes we’ll update the date above and, where appropriate, let account owners know by email.

11. Contact us

Questions or requests about privacy can be sent to [email protected].