Privacy policy

1. Who we are and whose policy applies

GoForms is operated by Goforms LLC, at 30 N Gould St Ste R, Sheridan, WY 82801, United States. Contact michael@goforms.io about privacy, support or legal questions.

For business accounts, we determine how information is used to operate GoForms, manage accounts, secure the service and provide support. For a business’s customer forms, leads and appointments, we generally process information on that business’s behalf. That business chooses its questions, recipients, integrations and follow-ups and is responsible for its own privacy notices and permissions. Contact the business first about its customer records; we can help route a request.

This policy covers our website, dashboard, hosted and embedded forms, booking pages, Appointment Hubs, APIs and connected-app features. Providers’ own services and the websites that embed our forms also have their own privacy policies. Connecting an app does not make its provider the operator of GoForms.

2. Information we collect

• Account and business information: name, email, business name, workspace membership, authentication identifiers, settings, subscription status and support correspondence.
• Customer information: names, email addresses, phone numbers, form answers, chatbot messages, notes, service addresses, requested services, appointment dates and timezones, quotes and job status.
• Payments: order totals, deposits, balances, payment status, Stripe customer/payment references and records of payment authorization. Card entry and business payout verification take place with Stripe.
• Connected-service information: authorized account identifiers, email addresses, permission grants and credentials, calendar availability and event references, meeting links, notification destinations and delivery status.
• Technical information: IP address, approximate city/region/country, a browser visitor identifier, request/browser information, timestamps, security and error logs, page views, form and chat clicks and activity, and delivery records. When you provide contact details, the collecting business can see earlier activity from that browser under your name and email. If enabled, browser push subscription endpoints and keys are stored to deliver notifications.

Information comes from you, the business you interact with, its authorized team members, your device and the providers you authorize. Forms may save contact details and answers before final submission when early lead capture is enabled, including when you continue from a contact step and leave before booking. Clearing your browser does not remove information already saved to the business.

3. How we use information

We use information to sign you in, maintain workspaces, save and display leads, configure forms, calculate quotes, check availability, manage bookings and jobs, collect authorized payments, deliver confirmations and reminders, respond to support requests, and detect misuse or errors. Businesses can configure follow-ups for incomplete inquiries or quotes and enable integrations that act on their behalf.

We do not sell personal information or share it for cross-context behavioral advertising. We do not use data obtained through Google, Microsoft, Zoom or Slack connections for advertising, data brokerage, surveillance, creditworthiness decisions, or training general-purpose AI models.

Where a legal basis is required, processing depends on the service requested, consent for optional features, our legitimate interests in operating and securing the service, and legal obligations. Businesses are responsible for their own basis for collecting customer information and sending communications. This policy is not consent to marketing.

Address suggestions use Google Maps. When you type a street address in an enabled field, that search text is sent to Google to provide suggestions. You can also enter an address manually. Google processes this information under its Privacy Policy.

4. Google sign-in, Gmail and Google Calendar

Google sign-in provides an account identifier and email address. If you enable the Gmail and Calendar connection, GoForms uses authorized access to check calendar availability, create, read, update or delete booking events on calendars you own, and send business emails through Gmail. Booking events may contain customer contact details, appointment answers, service locations, prices, and an Appointment Hub or video link.

The standard connection requests email-sending access. If you separately enable email conversations, GoForms requests Gmail read access to match actual replies to messages sent through GoForms. It uses message identifiers and notification history to sync linked conversations; unrelated messages and attachments are not imported into the CRM. OAuth credentials are encrypted in our connection store. We retain the connected email, permission information, calendar/event identifiers and booking information needed to operate these features. Calendar busy intervals are used to calculate availability.

GoForms’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Transfers are limited to providing user-facing features, your directions, security or applicable legal obligations, as permitted by that policy. Human access to Google user data is limited to the circumstances permitted by that policy, such as your affirmative permission for specific support needs or necessary security/legal purposes.

You can disconnect in GoForms Connections and revoke access in Google Account connections. Disconnecting stops GoForms access through the saved connection; it does not automatically delete existing events, sent emails or the business’s independently collected records.

5. Microsoft and Outlook

When connected, Microsoft provides your account identifier and email. GoForms uses profile, offline-access and calendar read/write permissions to maintain the connection, check availability, and create and manage appointments. The calendar connection does not request permission to read or send Microsoft email. GoForms handles booking emails and customer replies through its separate email service. We store encrypted authorization credentials and the account and booking references needed for these features.

Video meetings depend on the selected provider and your account’s capabilities. A Zoom meeting can be used with an Outlook calendar. Disconnect in GoForms Connections or revoke consent through your Microsoft account’s app permissions. Existing events and sent messages remain with Microsoft unless separately removed. See the Microsoft Privacy Statement.

6. Zoom video appointments

If you connect Zoom, we use your Zoom user identifier and email to identify the host and create, reschedule or delete meetings for bookings. We store encrypted OAuth credentials, meeting identifiers and guest join links. We do not request recordings, transcripts, attendance reports, or store privileged host start URLs.

Guest links are included in enabled calendar invitations, emails, reminders, business alerts and the Appointment Hub. People who receive these links may be able to join under the host’s Zoom settings. Protect private booking links.

Disconnecting Zoom in GoForms revokes access and removes saved Zoom authorization and associated Zoom identifiers and meeting links from our booking records. Verified Zoom deauthorization notifications also trigger this cleanup. Disconnecting does not delete meetings already in Zoom or messages already delivered; manage those in the relevant provider. Independently collected business and booking records are retained as described below. See our Zoom removal guide and Zoom Privacy Statement.

When a business enables Twilio SMS, Twilio processes phone numbers, message content and delivery information to send and receive texts. GoForms stores encrypted message content and credentials, delivery records, and consent and opt-out records. Text STOP to the business’s sending number to stop SMS; this does not disable necessary booking emails. We do not sell SMS consent data or share it with third parties for their marketing. Businesses can disconnect Twilio in Connections; previously sent messages and records retained by Twilio are governed by Twilio’s retention practices.

7. Slack, Discord, webhooks and notifications

Enabled alerts may contain a lead’s name, email, phone, form answers, appointment date and timezone, job details, prices, video links, status and private Appointment Hub links. Businesses control which supported notification channels they enable and should restrict access to recipients who need this information.

Our GoForms-managed Slack workflow matches a member’s email to a business and stores Slack user, workspace, channel and message/thread identifiers for delivery. Its private business channel includes the business owner, the GoForms bot and GoForms support; those channel members can see alerts. We use membership/profile information to provision that channel, not to import unrelated Slack conversation history.

Where configured, Discord webhooks and other business-specified HTTPS endpoints receive the submission or event payload needed for that integration. The destination and its users control the copy they receive. Stop future sharing by disabling the relevant integration or subscription; request removal of existing copies from the business or destination administrator. Browser push can be disabled in device/browser settings. Slack and Discord also publish their own Slack privacy policy and Discord privacy policy.

8. AI assistance and the ChatGPT connection

The GoForms homepage AI assistant sends your chat messages and recent conversation history to OpenAI to answer product and setup questions. We save the conversation and any contact details you choose to share in our admin prospect inbox so the GoForms team can review inquiries. A first-party chat cookie keeps your conversation available in the same browser for up to 30 days. Homepage chat records are marked to expire after 90 days; physical deletion can occur later through storage cleanup. The assistant does not answer telephone calls or have access to your business account.

GoForms uses OpenAI for enabled AI features, including form creation, automation drafts, enabled per-lead follow-up personalization and interpreting customer chatbot answers. Requests can include the business description, form questions/options, relevant saved request answers, quote scope and amount, earlier business follow-up text, prompts and messages supplied for that feature. When a business enables personalized follow-ups, its reviewed drafts guide the generated wording; the approved draft is used if generation is unavailable. If you request an AI reply draft or enable automatic replies for a lead, the relevant real email conversation, form request and quote information are sent to OpenAI to prepare the response. Requests requiring owner judgment are referred back to the business. Automatic replies can be disabled or taken over by the owner. Generated drafts and extracted answers may be stored as part of the business’s settings or customer record. Our AI API requests disable response storage using the provider’s API setting; this does not mean the provider retains no security or abuse-monitoring logs.

The separate ChatGPT connection allows the permissions the owner approves: reading business records, creating or changing leads and bookings, editing forms/settings, and receiving subscribed alerts. GoForms receives the tool requests and returns the relevant business data to ChatGPT. Authorized changes can take effect directly and may send notifications or publish edits. Disconnect in Connections to revoke the GoForms grant and stop authorized access and alert delivery. This does not uninstall the app from ChatGPT or delete existing chats there.

Do not enter passwords, authentication codes, raw card information, government identifiers or protected health information into GoForms chatbots or ChatGPT tools. Use provider-hosted sign-in and payment screens. Review AI drafts before enabling them. OpenAI’s privacy policy, account settings and API data controls govern its separate processing; ChatGPT and API data settings differ.

9. Stripe and payments

GoForms software subscriptions are separate from payments customers make to businesses for services. Where enabled, Stripe Connect lets a business collect service deposits and remaining balances through its connected Stripe account. We share customer contact information, order details and payment instructions with Stripe and receive payment/account references, amounts, statuses and authorization records to reconcile the job.

Payment card numbers, security codes and payout identity/bank details are entered in Stripe-hosted flows rather than ordinary GoForms form fields. For an authorized balance-on-completion feature, we retain a payment-method reference and the authorization record; the booking/payment screen explains the deposit and later charge. The business is responsible for service pricing, customer payment authorization and resolving service disputes. Stripe handles its own fraud, compliance and payment processing under the Stripe Privacy Policy.

10. Recipients and processing locations

Information is available to the business collecting it and its authorized staff or assigned service providers. We use Amazon Web Services for application hosting, data storage, scheduled processing and email delivery, and the enabled calendar, meeting, payment, notification and AI services described above. For approximate IP location, we use location information supplied by our hosting provider or send the IP address to ipwhois.io; this lookup does not include contact details or form answers. Account and security information may be accessed by GoForms personnel when needed to provide support, operate the service or investigate abuse.

We may disclose information when required by law, to protect rights and security, or as part of a business transfer subject to applicable privacy protections. Provider restrictions, including Google Limited Use, continue to apply. Our primary application infrastructure is in the United States; providers and authorized recipients may process information in other locations. Offering the app to U.S. businesses does not eliminate privacy rights that may apply to their customers elsewhere.

11. Cookies, browser storage and security

We use authentication cookies and browser storage for sessions, preferences, form progress and booking handoffs. Embedded forms communicate with GoForms to provide the same functions on another website. That host website may use separate tracking technologies under its own policy. We do not use connected-account data for advertising tracking.

We use Google Analytics on GoForms’ public marketing and signup pages to measure visits and signup activity. This may use analytics cookies and report device/browser information and approximate location to Google. We do not send customer form answers, names, email addresses, payment details, or private portal links to Google Analytics, and we do not use it to track signed-in dashboard activity. We honor supported browser Do Not Track and Global Privacy Control signals.

We use HTTPS, access controls, workspace-scoped authorization and encryption for stored integration credentials. Security is not a guarantee against every incident. Never share your account credentials or private appointment/payment links. Report security concerns to michael@goforms.io.

12. Retention, disconnection and deletion

Account, form, lead, appointment, job and payment records remain while needed to provide the service to the business, handle support or disputes, and meet legal or financial obligations. There is no single automatic deletion period for all business records. Retention depends on the record, the business’s instructions and applicable obligations; unfinished inquiries can remain as leads until removed.

Some technical records have shorter configured expiry periods: ChatGPT authorization codes expire after two minutes, access tokens after one hour, and connection grants after 30 days unless renewed; alert subscriptions last up to seven days unless renewed. ChatGPT delivery deduplication records are marked to expire after 30 days and action audit records and dashboard notifications after 90 days. Expiration of access is separate from physical deletion, which may occur later through storage cleanup.

Disconnecting an integration stops future authorized access but does not, by itself, erase all business records, backups or copies already sent to recipients. Zoom-specific cleanup is described above. Request access, correction or deletion through the methods below. We review the request, verify authority, coordinate with the collecting business and relevant providers, and explain any records that must be retained. Provider-specific deletion duties continue to apply.

13. Your rights and choices

Depending on where you live and the law that applies, you may have rights to access or obtain a copy of your information, correct it, request deletion, withdraw consent, restrict or object to certain processing, opt out of sale/sharing or targeted advertising, and appeal a denied request. We do not sell personal information or share it for cross-context behavioral advertising. We will not discriminate against you for exercising applicable rights.

Email michael@goforms.io or write to the address below. Include the relevant business and email used for the booking, but do not send passwords, payment details or identity documents unless a secure verification process is arranged. An authorized agent may contact us; we may verify their authority. We respond within applicable legal deadlines and explain any permitted exception. To appeal, reply to our decision with “Privacy appeal.” You may also contact your relevant privacy regulator.

Business account holders can request account deletion. This is a manually reviewed request, not immediate deletion, appointment cancellation or subscription cancellation. Manage subscriptions and appointments separately while the request is reviewed. For marketing or business follow-ups, use any unsubscribe option provided or contact the sending business. Essential security and transaction messages may still be necessary while you use the service.

14. Children and sensitive information

GoForms is intended for business use and is not directed to children under 13. The Slack integration is not intended for users under 16. If you believe a child’s information was collected improperly, contact us for review and removal. Businesses should not use ordinary forms or AI features to collect sensitive information unnecessary for an inquiry or appointment.

15. Contact and changes

We update the date above when this policy changes. Material changes will be communicated as required, and new permissions or consent will be requested where needed before using information for a materially different purpose.