PWA and optional notifications
When you voluntarily enable notifications, your browser creates a Web Push subscription. ZoraForms processes its endpoint, technical keys, your device label, account/session association, enrollment dates and delivery-attempt status. The endpoint and keys are encrypted in the database; identifiers and a hash support secure operation and revocation. Notifications do not contain customer details, form content, UTM or form names. Clicking opens a dashboard requiring authorization.
Enabling is a separate user choice and browser permission, independent of account creation and accepting the terms. Notifications provide the service function you request (GDPR Article6(1)(b)); security and minimal operational evidence serve legitimate interests in service protection and claims (Article6(1)(f)). They are not marketing. Disable the device in the dashboard or revoke system permission. Signing out, session expiration/deletion or account erasure revokes the associated ZoraForms subscription; messages already handed over may still arrive.
The browser determines the delivery provider: Google (FCM), Apple (APNs/Web Push), Mozilla or Microsoft (WNS). The provider receives subscription technical data, delivery metadata and an encrypted message; the device system displays the generic content. These services can process data outside the EEA under their own terms, and Warsaw/EU core hosting does not extend to their infrastructure. Before launch the operator assesses provider roles and necessary transfer mechanisms. Subscriptions remain until revocation or the associated session ends; processed delivery events use short outbox retention (30 days by default). The service worker does not persist private pages, submissions or tokens offline.
Controller and contact
The controller for data connected with ZoraForms is Codedream Norbert Jańczak, NIP 6211841998, REGON 521405535, Pukackiego 55A, 63-700 Krotoszyn, Poland. The controller’s current contact address is listed in the Operator and contact section above.
Scope and roles
This notice covers accounts, use of the application and data provided to the operator. ZoraForms lets customers collect data from their own respondents. The customer decides the purposes and means in that case, and ZoraForms acts as processor under a data processing agreement. This notice does not make customer-collected data lawful or replace the customer’s own transparency duties.
Data we process
We process data needed to provide the service and billing, including:
- account data: name, email address, an Argon2id password hash and encrypted TOTP data; one-time recovery codes are hashed;
- form configurations, submissions and UTM metadata stored in private PostgreSQL/JSONB;
- session data: an HttpOnly session for up to 7 days, essential locale/theme storage and a daily HMAC abuse pseudonym; full IP addresses are not retained;
- payment and billing data supplied by payment providers; card numbers and passwords should not be placed in form content;
- correspondence and data needed for configured mail or integrations.
Purposes and legal bases
We use data to create and secure accounts, run forms, handle submissions and integrations, bill, provide support, prevent abuse and meet legal obligations. The legal basis is contract performance, legitimate interest in security and service operation, a legal obligation or consent where required. Policy acknowledgement confirms that the notice was read; it is not blanket marketing consent.
Where data is stored
Core application infrastructure, the submissions database and backups are hosted in the EU, in Warsaw (Atman/OVH). EU hosting does not mean every optional service operates only in the EEA: CAPTCHA/Turnstile, Stripe, SMTP, webhooks, integrations and AI features may involve transfers outside the EEA. Customers should check each provider’s configuration and terms before enabling it; required transfer mechanisms are used where applicable.
Retention periods
Submission retention is assigned at acceptance according to account entitlements. Changing plans does not retrospectively change the deletion date. A claim alone does not automatically suspend submission expiry.
- Free and Start: 90 days; Growth: 180 days; Pro: 365 days, unless the administrator assigns another retention entitlement. Submissions can be deleted earlier;
- audit log: 365 days by default; processed outbox events: 30 days by default; expired, cancelled or failed checkouts: 90 days. Unprocessed events may remain for investigation;
- accounting and legal records are kept for periods required by law or needed to defend claims.
Deletion and backups
After removal from the active database, an earlier version may remain in backups for at most 30 days. Backups are for disaster recovery, not routine use. Previously completed deletion requests are replayed before reopening access after restore. The operator must maintain infrastructure backup retention accordingly.
Your rights
You may request access, rectification, erasure, restriction or portability, object to processing and withdraw consent where consent is the basis. Rights may be limited by law. You may complain to the President of the UODO. Rights under GDPR Article 82 remain available.
Security
We use risk-appropriate safeguards, including encryption of CAPTCHA, SMTP and TOTP secrets, secure sessions, access controls and pseudonymisation of the abuse identifier. CAPTCHA tokens are not stored in the database or logs, and personal data is minimised. Absolute security is not promised.
Providers and communications
The operator may use Atman/OVH and customer-configured SMTP, Turnstile/Google, Stripe, webhook and AI providers. Their roles depend on the service and configuration; some may be independent controllers. Email is sent only according to configuration; ordinary conversation replies are received only when operator IMAP is configured. MCP cannot read submissions without separate permission; transfer to an AI client depends on the customer-approved token scope.