Privacy Policy

Who we are

Furrow Forms ("Furrow," "we") is a form backend service owned and operated by Burrow Analytics, LLC, at furrowforms.com, with the application at app.furrowforms.com and the API at api.furrowforms.com. Questions about this policy: contact us.

Two roles, two kinds of data

For account holders (people who sign up), we are the data controller: we store your name, email address, and workspace configuration. For form submissions sent to our customers' forms, we act as a processor on the customer's behalf: the customer who owns the form is responsible for the data their forms collect, and submissions are delivered and stored according to their configuration.

What we collect

• Account data: name, email, team/workspace names, and settings you configure.
• Form submissions: the fields a visitor submits to a customer's form, plus the page URL, origin, UTM parameters, and spam status.
• Visitor IP addresses are never stored raw — we keep only HMAC hashes, used for rate limiting and abuse prevention.
• Website analytics via Plausible, a cookie-free, privacy-friendly analytics service. We do not use advertising trackers.

How data is protected

• Turnstile secrets and webhook secrets are encrypted at rest (AES-256-GCM).
• API tokens are stored as hashes; the secret is shown exactly once at creation.
• API responses never include stored secrets.
• Data in transit is protected with HTTPS.

Retention

Form submissions are retained for 30 days on the Free plan and 2 years on Pro, then deleted. Contact us to request earlier permanent deletion.

Service providers

We rely on a small set of subprocessors to run the service: application, API, and marketing-site hosting (Render), transactional email (Postmark), bot protection (Cloudflare Turnstile), and analytics (Plausible). Each receives only the data required for its function. We do not sell personal data.

Your rights

You can request access to, correction of, or deletion of your personal data at any time via /contact. If you submitted data through a customer's form, contact that customer first — they control that data — and we will assist them in honoring your request.

Changes

We'll post any changes to this policy on this page and update the date above.