Privacy Policy

BuildFormStudio, a sole proprietorship based in the United States, handles personal data in two distinct roles. Which one applies changes who is responsible for what:

• As a controller — for data about you, our customer: your account, billing, support, and how you use the platform. This policy governs that data.
• As a processor — for the content and members of the forums you run: posts, member profiles, and the email addresses and IP addresses inside your forum’s database. There, you are the controller and we act on your instructions to host it. Your handling of that data is governed by your own privacy notice and our Terms, plus a Data Processing Addendum, available to business and EU/UK customers on request.

• Account information — the email address you sign up with, your display name, and your password, which is stored only as a salted hash by our authentication provider. We never see your password.
• Billing information — handled by our payment processor, Stripe. We receive limited details such as your plan, subscription status, and the last four digits of your card. We never receive or store full card numbers.
• Forum metadata — the names, addresses, region, plan, and operational state of the forums on your account, plus the resource usage we measure to show you your allotment.
• Technical data — IP address, request and security logs, and basic device and browser information, used to operate, secure, and debug the service.
• Support communications — the contents of tickets and emails you send us, and your notification preferences.
• Waitlist — if you join our waitlist, the email address you submit.

Forum content — everything inside the forums you run — is processed on your behalf as described in §1. We don’t mine it, profile your members, or use it for our own purposes.

We use your information to provide and maintain the service (provisioning, backups, certificates, updates), to authenticate you, to process payments, to prevent abuse and keep the platform secure, to answer support requests, and to send service email — confirmations, ticket replies, billing notices, security notices, and alerts about your forum. Some of that email is optional, and every optional message carries an unsubscribe link; you can also set your preferences in your dashboard. Notices you can’t opt out of are the ones you genuinely need, like a failed payment or a security issue.

We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not use it — or your forum’s content — to train machine-learning models.

Where EU or UK law applies, we rely on these legal bases:

• Contract — to deliver the service you signed up for and to bill for it.
• Legitimate interests — to secure the platform, prevent abuse, and improve reliability.
• Legal obligation — to meet tax, accounting, and lawful-request requirements.
• Consent — for anything optional, such as the waitlist or non-essential email, which you can withdraw at any time.

We rely on a small set of vendors to run BuildFormStudio, and share data with them only as far as providing the service requires. Each is bound by its own data-protection commitments. This is the complete list:

• Supabase — Authentication, and the control-plane database holding accounts, forum records, billing state, and support tickets.
• Vercel — Hosting for this website and the customer dashboard.
• Cloudflare — DNS, TLS, and the edge network that fronts every forum and absorbs attacks — plus encrypted off-site backup storage.
• Stripe — Payment processing, subscriptions, and invoicing for paid plans.
• Resend — Transactional and service email delivery.
• InterServer — The dedicated servers your forum runs on, located in the United States.

We keep this list current on this page. Customers under a Data Processing Addendum get advance notice of material changes to it.

We use strictly necessary cookies to keep you signed in and to operate the dashboard. We run no analytics, no advertising trackers, and no third-party tracking scripts on this website — there is no consent banner because there is nothing to consent to. Your browser settings let you control cookies, though blocking the essential ones will break sign-in.

Forums we host are separate: whether your forum sets cookies or loads third-party scripts is your decision as its operator, and your own privacy notice needs to cover it.

We keep account and forum data while your account is active. When you delete a forum, it enters a 7-day grace window during which you can restore it yourself; after that it is removed from active systems. Deleting your account removes your account data from active systems. A trial forum that isn’t upgraded is paused, and removed after a grace period and notice.

Encrypted backup copies persist on a rotating schedule after deletion and are overwritten as the rotation advances — the longest-lived tier means a copy may exist for up to six months before it ages out. Backups are encrypted, restored only to recover a customer’s own service, and never mined.

We may keep limited records longer where the law requires it — invoices and tax records in particular — or where we need them to resolve a dispute or enforce our terms.

Forums run in isolated, hardened containers with user-namespace remapping between tenants, each with its own database and its own database user. Traffic is encrypted in transit with TLS, our servers accept web traffic only from Cloudflare’s network, backups are encrypted before they leave the server, and access to production systems is restricted. We scan for malware and monitor what runs inside containers at the kernel level.

Our Security page describes all of this in detail. No system is perfectly secure, but we take reasonable measures to protect your data, and we will notify you and the relevant authorities of a personal-data breach as and when the law requires.

You can update your profile and delete your account from your dashboard, and export your forum data at any time over SFTP and the database tools. To exercise any other right, email support@buildformstudio.com. We’ll verify your identity through your account email before acting on a request, and we aim to respond within 30 days — and within any shorter period the law sets. We won’t discriminate against you for exercising a right.

• United States, including California (CCPA/CPRA) — the right to know what we collect and why, to access it, to correct it, to delete it, and to opt out of the “sale” or “sharing” of personal information. We do not sell or share personal information, so there is nothing to opt out of; because of that, we also have nothing to apply a Global Privacy Control signal to. You may use an authorized agent to make a request on your behalf.
• EU, UK and EEA (GDPR) — the rights of access, rectification, erasure, restriction of processing, data portability, and objection, plus the right to withdraw consent and the right to lodge a complaint with your local supervisory authority.

For data held inside a forum you don’t operate, see §10 — the forum’s operator is the controller and your request goes to them.

We operate from the United States, and your data — including data belonging to EU and UK users — may be processed there and by the providers listed in §4. Where a transfer out of the EU, UK, or EEA requires it, we rely on appropriate safeguards such as the Standard Contractual Clauses and our providers’ equivalent mechanisms.

If you are a member of a forum hosted on BuildFormStudio, the operator of that forum — not BuildFormStudio — is the controller of your data. Send privacy requests to them; we assist them as their processor. We can’t act on your data in someone else’s forum without their instruction, which is the same protection that stops anyone else reaching into yours.

BuildFormStudio’s own service is not directed to children under 16, and we don’t knowingly collect their personal data. If you run a forum, you are responsible for any age requirements and parental-consent rules that apply to your members — COPPA in the United States, or the GDPR age of consent in Europe.

We’ll update this policy as the service evolves and revise the date at the top. For changes that materially affect your rights, we’ll give notice by email or in the dashboard before they take effect.

Questions, or want to exercise a right? Email support@buildformstudio.com, or open a ticket from your dashboard. The operator responsible for this policy is BuildFormStudio, a sole proprietorship based in the United States.