Privacy Policy

Last updated: February 2026

fld.rs ("we", "us", "our") operates the fld.rs form management platform. This Privacy Policy describes how we collect, use, and protect information when you use our service.

1. Information We Collect

Account Information: When an administrator account is created, we collect your name, email address, and a password (stored as a bcrypt hash).

Form Submissions: When users fill out forms created on our platform, we collect the data they submit. This may include text, email addresses, dates, file uploads, and other information as defined by the form creator.

Session Data: We use session cookies to authenticate administrators. These are essential HTTP-only cookies required for the service to function.

Server Logs: We collect standard server request logs (IP address, request path, timestamps) for security and operational purposes.

2. How We Use Information

  • To provide and maintain the form management service
  • To authenticate administrators and manage sessions
  • To send email notifications when form submissions are received (as configured by administrators)
  • To process AI-powered features (form generation, translation, data search) when initiated by administrators
  • To monitor service health and prevent abuse

3. Data Storage and Security

All data is stored in a PostgreSQL database. Form submissions are stored as structured data associated with the organization (tenant) that created the form. File uploads are stored on the server filesystem.

We implement industry-standard security measures including:

  • Password hashing with bcrypt (12 salt rounds)
  • HTTP-only, Secure, SameSite=Strict session cookies
  • Rate limiting on login and submission endpoints
  • Input validation on all API endpoints
  • Multi-tenant data isolation

4. Data Sharing

We do not sell or share personal data with third parties, except:

  • Email delivery: We use a third-party email service provider (e.g., Resend, Amazon SES) to deliver notification emails configured by form administrators.
  • AI providers: When administrators use AI features, form data may be sent to the configured AI provider (e.g., Anthropic, OpenAI, Google) for processing. Administrators choose and configure their own AI provider credentials.

5. Cookies

We use only essential session cookies for administrator authentication. We do not use tracking cookies, analytics cookies, or advertising cookies.

6. Data Retention

Form submissions are retained for as long as the form and its associated organization exist on the platform. Administrators can export and delete their data. When an organization is deleted, all associated forms, submissions, and admin accounts are permanently removed.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data
  • Export your data in a machine-readable format

To exercise these rights, contact us through the application form on our website.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify affected users of material changes.

9. Contact

For privacy-related inquiries, contact us through the application form at fld.rs/apply.