Privacy Policy

Fillo is operated by Jafu ApS in Denmark. This policy explains how Fillo handles personal data when you build forms, render them inside your product, and collect responses. You can contact us at hello@fillo.so.

Two roles

For your account (you, the person who signs up and builds forms) we are the data controller. For the responses your forms collect from your end users, we act as a data processor on your behalf — you are the controller of that data. Our processor commitments are set out in the Data Processing Agreement.

What we collect about account holders

• Account details: your name, email address, and a hashed password (passwords are never stored in plain text).
• Workspace data: organisation name, members, and the forms you create.
• If you sign in with Google: your Google account identifier, email, basic profile details such as your name, and the sign-in tokens the authentication provider needs (scopes openid, email, and profile).
• Operational logs needed to run and secure the service (e.g. request timestamps, IP address, error logs).
• If your workspace subscribes to a paid plan: the plan, volume, billing period, currency, subscription status and renewal date, and the Stripe customer and subscription identifiers. We never receive or store your card number.

Payments

Paid subscriptions are sold through Stripe’s Managed Payments service, with Sold through Link, LLC as the merchant of record. You enter your payment details and billing address on Stripe’s checkout page, so they go directly to Stripe, not to Fillo. To start a checkout, we send Stripe the subscribing member’s email address, the workspace name, and an internal workspace identifier. Stripe and Link process your payment details under their own terms and privacy policies, including the Stripe Privacy Policy. Stripe receives no form responses or respondent data.

Connected MCP clients

When you connect an MCP client, such as ChatGPT or Codex, and approve access, Fillo can return your stable account identifier, name, email address, and the connected workspace and project names to that client. These details help the client label your connection and recognize the same account after you reconnect. Other tools return data from the connected project according to the permissions you approved. You can revoke the connection in Settings → Connections. The client provider handles data it receives under its own privacy terms.

Field suggestions

When AI field suggestions are enabled, writing a new question can send that question’s text to Google’s Gemini API to suggest an answer type, such as email or a numeric scale. Finishing a new question can also send its text and selected field type to suggest an example placeholder, help text, explicit choices, or scale end labels. This applies to guest drafts and signed-in editors. We do not attach respondent answers, other saved form contents, or account and workspace details. The editor retains its local suggestion if the service is unavailable, and explicit type choices are preserved. Fillo’s suggestion endpoint does not log question text. Google’s processing is described on the sub-processors page.

Slack connection data

When a workspace manager connects Slack, Fillo stores the Slack workspace identifier and name, the bot user identifier, an encrypted bot access token, and a cache of channel identifiers and names used by the channel picker. Private channels enter that cache only after the Fillo bot has joined them. Fillo does not request or read Slack message history.

For each form using Slack, Fillo stores the selected workspace and channel identifiers and whether the channel was private. When a response is accepted or updated, Fillo sends Slack the form name, event time, a link to the response, an optional verified respondent name or email, and up to three answer fields explicitly selected by a form manager. Uploaded file contents and every unselected answer stay out of Slack.

What we process on your behalf

• Form responses: the answers your end users submit, plus metadata such as the source route, timestamps, and review status.
• Email addresses your forms collect, if any.
• Uploaded files: files are stored in your connected storage (Google Drive, Box, or an S3-compatible bucket). Uploads go browser-direct; for Drive and Box, authenticated downloads may stream through Fillo so workspace members can access them. We store file metadata and a reference to where the file lives, not a long-term copy of the file contents.
• Saved progress (optional, per form): when you turn on Save and resume, we store your end users’ in-progress answers before they submit, so they can pick up where they left off. A draft is readable with a one-time token held in the respondent’s browser — and, if you additionally turn on the in-progress content view for a form, by members of your workspace, so you can help someone finish. If you turn on resume emails, we use an address the respondent entered (or their verified account email) to send them a single link back to their draft. Drafts are deleted when the response is submitted, when the respondent starts over, or automatically 7 days after the last change.
• Respondent identity (optional, per project): if your app passes account context with identify(), we store the identifier you send (your own user id) and any email, name, or attributes you include, and attach it to the responses that person submits in that project. You decide whether to send it, and you can require it to be cryptographically signed by your server before we record it.
• Verified respondent email (optional, per form): if you limit a form to one response per verified email, we email a one-time code to the address a respondent enters, keep only a keyed hash of that code, and store the confirmed address as that person's identity in the project. A cookie on the respondent's device keeps them confirmed for up to 30 days.

Product and documentation usage

Fillo records coarse server-side product and documentation events to understand reliability and improve the service. Documentation search text stays in your browser. A search event can include the page path, a coarse query-length range, a coarse word-count range, the result count, and whether it returned zero results. We do not send or store the search text, a hash of it, or another query fingerprint. Other documentation events can include an up or down feedback vote, a guide topic filter, and actions such as copying a page or opening its machine-readable version.

These events do not include form answers and use a shared service identifier instead of an analytics cookie or visitor profile. They are not used for advertising, individual visitor tracking, or cross-site tracking. They are not guaranteed to be anonymous: ordinary request handling, security, and rate-limiting infrastructure may still process an IP address and other request metadata.

Why we process data, and our legal bases

• To provide the service you signed up for (performance of a contract).
• To bill paid subscriptions and keep accounting and tax records (performance of a contract; legal obligation).
• To keep the service secure and prevent abuse — rate limiting, spam protection, logs (legitimate interests).
• To understand coarse product and documentation usage and improve reliability, navigation, and support content (legitimate interests).
• Optional features you switch on, such as email notifications and AI form drafting (consent / contract).

Who we share data with

We do not sell personal data, use it for cross-context advertising, or send form answers to analytics tools. We share data only with the providers that help us run Fillo: EU hosting, transactional email, question-type suggestions, payment processing for paid subscriptions, and diagnostics and coarse product or documentation usage measurement for reliability and improvement. The full list, with legal entities, purpose, location, and safeguards, is on our Sub-processors page.

If you enable customer-connected destinations — such as webhooks, Google Sheets, Notion, Slack, or Zapier — we send the relevant response data to those destinations on your instructions. Those accounts and endpoints are controlled by you, not by Fillo.

Where data is stored, and international transfers

Fillo runs on servers in the European Union, and the responses your forms collect are stored there too. Uploaded files go to the storage you connect, such as Google Drive, Box, or an S3-compatible bucket; Fillo keeps the response itself, the file’s metadata, and a reference to where the file lives. Limited data may leave the EEA only when a feature needs it — for example, sending an email through Resend, suggesting a question type with Google Gemini, or paying for a subscription through Stripe — and those transfers use Standard Contractual Clauses and the providers’ data-processing terms.

How long we keep it

• Account and workspace data: for as long as your account is active. Account and workspace deletion has a 21-day grace period before permanent deletion.
• Slack connection token and channel cache: until a workspace manager disconnects Slack or the workspace is deleted. A form's selected Slack channel remains until the destination or form is removed; delivery telemetry is covered by the logging period below.
• Responses: until you delete them or close the workspace. You can export and delete responses at any time.
• Billing records for paid subscriptions: as long as bookkeeping and tax law requires, even after the subscription or account ends.
• Saved-progress drafts: deleted when the response is submitted, when the respondent starts over, or automatically 7 days after the last change — whichever comes first.
• Email confirmation codes: deleted once they expire, 10 minutes after they are sent. Confirmed devices: signed out after 30 days, when the respondent signs out from the form, or when you erase the person.
• Respondent identity and profiles: kept while the person has responses in the project; you can erase a person from that project (their profile, drafts, and identity, and optionally their responses and files) at any time.
• Logs, delivery telemetry, and coarse product or documentation usage events: kept only as long as needed for security, debugging, reliability, and service improvement; structured telemetry rows are generally kept up to 90 days.

How we protect it

• Encryption in transit (TLS) on every request, and encryption at rest for the database.
• App-used provider credentials, such as S3 keys and connected Drive, Box, and Notion tokens, are encrypted at rest with AES-256-GCM.
• Every form, response, file reference, storage connection, and integration is scoped to a workspace and checked server-side.
• Public submission endpoints validate the form schema, cap request size, rate-limit abuse, and use honeypot protection.
• Uploaded file references must belong to the expected form before they can be attached to a response.
• Webhooks are signed, and customer-connected destinations are used only on your instructions.
• When you delete a response or erase a respondent, Fillo removes linked records and attempts to remove managed file references; if connected storage is unreachable, the delete fails closed so it can be retried instead of silently orphaning data.

Your rights

Under the GDPR you can request access, correction, deletion, a portable copy, or restriction of your personal data, and you can object to certain processing. Email hello@fillo.so and we’ll respond within the legal time limits. You can also complain to your local supervisory authority; for Jafu ApS this is the Danish Data Protection Agency (Datatilsynet). For responses your forms collected, contact the business that ran the form — they are the controller of that data.

US privacy

We do not sell personal data or share it for cross-context behavioural advertising. If a US state privacy law gives you rights such as access, deletion, correction, or appeal, you can use the same contact email above.

Cookies and browser storage

We use only the essential cookies needed to keep you signed in and protect sessions. A form that asks respondents to confirm their email sets one such cookie on the respondent’s device to keep them confirmed for that project. We do not use advertising or analytics cookies. Documentation usage events are sent to a same-origin server endpoint without a browser analytics identifier. Fillo embeds may also use browser localStorage for product state, such as remembering that a browser already submitted a form, caching code-form sync status, or storing a saved-progress draft reference. Draft answers themselves are stored on Fillo only when the form owner enables Save and resume.

Contact

Jafu ApS. Privacy questions: hello@fillo.so.

Changes

If we change this policy we’ll update the date above and, for material changes, let account holders know before the change takes effect.