Privacy Policy

Last updated: 2026-09-07

1. Who we are

FormsByState ("we", "us") operates formsbystate.com, a self-help document service. Contact: hello@formsbystate.com. We are not a law firm and no attorney-client relationship is created by using the site.

2. What we collect and why

Document content. The forms you fill in are processed inside your browser. Drafts are stored in your browser's local storage on your device. We do not receive the content of your documents unless you sign in and choose "Save draft", in which case the draft is stored in your account database (hosted by Supabase in the United States) so you can reopen it on another device.

Account data. If you create an account, we store your email address and sign-in metadata. We use passwordless email links; we never store a password.

Payments. Payments are processed by Stripe. We receive the transaction ID, the product purchased, the amount, and the email you gave Stripe. We never see or store your card number. Stripe's privacy policy applies to the checkout page.

Analytics. We use Vercel Web Analytics, a cookie-free service that records page views and events (such as "downloaded PDF") using an anonymous, non-persistent hash. It does not track you across sites and does not collect IP addresses in identifiable form.

Server logs. Our hosting provider (Vercel) keeps standard request logs (IP address, user agent, URL, timestamp) for security and debugging for a limited period.

3. Legal bases (GDPR/UK GDPR, where applicable)

Performance of a contract (delivering documents and purchases), legitimate interests (security, fraud prevention, improving the service), and consent (optional account storage). We do not sell personal information and do not share it for cross-context behavioral advertising (CCPA/CPRA).

4. Sharing

We share data only with processors needed to run the service: Vercel (hosting, analytics), Stripe (payments), Supabase (accounts and saved drafts), and our email provider for transactional emails. Each is bound by a data processing agreement. We disclose data when required by law.

5. Retention

Browser drafts stay until you clear them. Account drafts stay until you delete them or your account. Purchase records are kept for 7 years for tax and accounting. Analytics are aggregated and not linked to you.

6. Your rights

You may access, correct, export or delete your data, object to processing, or withdraw consent at any time by emailing hello@formsbystate.com. California residents may exercise CCPA/CPRA rights (know, delete, correct, opt-out) the same way; we do not discriminate for exercising them. EU/UK residents may complain to their supervisory authority.

7. Security

All traffic is encrypted (HTTPS/HSTS). Documents are generated client-side, which minimizes data we hold. Account databases use row-level security so only you can read your drafts.

8. Children

The service is intended for adults. We do not knowingly collect data from children under 16.

9. International transfers

Our processors are located in the United States. Where required, transfers rely on Standard Contractual Clauses or an adequacy mechanism.

10. Changes

We will post changes here with a new date. Material changes will be announced on the site.