This policy explains how KyraForm ("we", "us") handles personal data when you visit our website, create an account, or build and share forms with our service. It is written to meet India's Digital Personal Data Protection Act, 2023 and to give everyone the same clear rights wherever they live.
1. Two kinds of data, two roles
- Your account data. When you sign up and use KyraForm, we decide how that data is used. We are its data fiduciary (controller).
- Responses to your forms. When people fill in a form you created, you decide what to collect and why. You are the data fiduciary for those responses and we process them only on your instructions, as your data processor. If you filled in someone else's form, please contact the organisation that sent it to you about your data.
2. What we collect
| Data | Examples | Why |
|---|---|---|
| Account | Name, email address, username, password (stored only as a secure hash by our sign-in provider), optional phone, address and profile details | To create and secure your account and contact you about it |
| Organisation | Organisation name, members, roles, teams, invitations | To run your workspace and control who can do what |
| Content | Forms, settings, templates, uploaded files, and responses submitted to your forms | To provide the service you asked for |
| Billing | Plan, billing contact, invoices. Card and bank details are handled by our payment processor and never reach our servers | To charge for paid plans and meet tax obligations |
| Technical | IP address, browser and device type, pages requested, error logs | To keep the service secure, prevent abuse and fix problems |
| Support | Messages you send us | To answer you |
We do not sell personal data, use it for advertising, or build marketing profiles from form responses.
3. AI features
When you use the AI form builder, the text you type and the structure of the form being edited (not its responses) are sent to Amazon Bedrock to generate the result. Amazon does not use this content to train its models, and we do not use it to train any model either. Conversation memory for follow-up edits is kept for about two hours and then deleted.
4. Who processes data for us
We use a small number of providers, each bound by contract to protect the data and use it only to serve us:
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, file storage, sign-in (Amazon Cognito), AI (Amazon Bedrock), email delivery | Asia Pacific (Sydney, Australia); AI requests may be served from other Asia Pacific regions |
| Neon | Managed database | Hosted on AWS, Asia Pacific (Sydney) |
| Cloudflare | Turnstile bot protection on public forms; cookieless visitor counts on this website and the sign-up pages | Global network |
| Paddle (payment processor and Merchant of Record) | Charging for paid plans | United Kingdom |
Google (Sheets), Slack, Zapier, Make and payment gateways you connect to your forms receive data only because you turned that integration on, and their own terms apply to it.
5. Where data is stored and transferred
Our servers are in Australia. By using KyraForm you understand that personal data will be transferred to and stored there, under the safeguards described in this policy. We do not transfer data to any country the Government of India has restricted.
6. How long we keep it
- Account and organisation data: while your account is active, and deleted within 30 days of closing it.
- Forms and responses: until you delete them or close your account. Deleted items are removed from backups within 30 days.
- Technical logs: 14 days. Billing records: as long as tax law requires (currently up to 8 years in India).
7. How we protect it
- Encryption in transit (HTTPS) and at rest for databases and file storage.
- Payment and integration credentials are stored encrypted and never shown again after you save them.
- Role-based access inside each organisation, and anonymous surveys that hide respondents even from form owners.
- Access to production systems is limited to the people who need it.
If a breach affects your personal data, we will notify you and the Data Protection Board of India as the law requires.
8. Cookies
We use only cookies and browser storage that the service needs to work, such as keeping you signed in. We do not use advertising or tracking cookies. See our cookie policy.
9. Your rights
You can ask us to:
- tell you what personal data we hold about you and how we use it;
- correct, complete or update it;
- erase it, unless we must keep it by law;
- withdraw consent you gave, without affecting what was done before;
- nominate someone to exercise these rights for you if you die or become unable to.
Most account details can be changed from your profile. For anything else write to hello@kyraform.com. We reply within 30 days.
10. Grievances
If you have a concern about how we handle your data, contact our grievance officer at hello@kyraform.com with "Privacy grievance" in the subject. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.
11. Children
KyraForm accounts are for people aged 18 or over. If you build forms for children, you are responsible for obtaining verifiable parental consent as the law requires.
12. Changes
We will post any change here and update the date above. If a change is significant, we will also email account owners before it takes effect.
13. Contact
KyraForm · India · hello@kyraform.com