Privacy Policy

1. Overview

BulkForm Inc. ("BulkForm", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, applications, and services (collectively, the "Service").

By using BulkForm, you agree to the collection and use of information in accordance with this policy.

Key Privacy Principles

You own your data: Your uploaded documents and form data belong to you
No AI training: We never use your data to train public AI models
No selling: We never sell your personal information to third parties
Transparent practices: We clearly explain what we collect and why
Your rights matter: You can access, correct, or delete your data anytime

Jurisdiction: BulkForm Inc. is a Delaware corporation operating from the United States. This policy complies with applicable U.S., Canadian, and international privacy laws including GDPR, CCPA, and PIPEDA.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

Email address (required for account creation and authentication)
Password (encrypted and hashed; we cannot see your plaintext password)
Full name (optional; used for personalization)
Profile information (optional avatar, company name, phone number)
Authentication tokens (if you use Google OAuth or other single sign-on)

2.2 Usage Data

We automatically collect information about how you use the Service:

Log data: IP address, browser type, device information, operating system
Activity logs: Pages visited, features used, time spent, actions taken
Performance data: Error reports, load times, system diagnostics
Cookies & similar technologies: Session tokens, preferences, analytics

2.3 Form Data & Documents

When you use BulkForm to process forms, we collect:

PDF templates: Form files you upload to create mappings
Field mappings: Coordinate data and field names you define
Input data: CSV/Excel files or manual entries containing form information
Generated documents: Completed PDF forms produced by the Service
Presets: Saved form data for recurring use
Batch metadata: Processing history, timestamps, status information

Important:

Your form data and documents are stored securely in private storage. We do not access, read, or use your form content except as necessary to provide the Service (e.g., processing PDFs). We never use your data to train AI models or share it with third parties.

2.4 Payment Information

We use Stripe to process payments. Payment information is collected and stored by Stripe, not by BulkForm:

Payment method details: Card numbers, expiration dates, billing addresses (stored by Stripe)
Transaction history: Purchase dates, amounts, subscription status
Billing information: Name, address, tax identification (if applicable)

BulkForm never stores full credit card numbers. We only receive tokenized payment references from Stripe. Review Stripe's Privacy Policy for details on how they handle payment data.

2.5 Communications

When you contact us or communicate through the Service:

Support messages: Email correspondence, chat transcripts, support tickets
Feedback: Survey responses, feature requests, bug reports
Marketing preferences: Email subscription status, communication preferences

3. How We Use Your Information

We use collected information for the following purposes:

Service Delivery & Operation

• Process your PDF forms and generate completed documents
• Store and manage your templates, mappings, and presets
• Authenticate your account and maintain session security
• Process payments and manage subscriptions
• Provide customer support and respond to inquiries

Product Improvement & Analytics

• Analyze usage patterns to improve features and performance
• Monitor system health and diagnose technical issues
• Develop new features based on user needs
• Test and optimize processing algorithms
• Understand user preferences and behavior (aggregated data only)

Security & Compliance

• Detect and prevent fraud, abuse, or security threats
• Enforce our Terms of Service and Acceptable Use Policy
• Comply with legal obligations and regulatory requirements
• Respond to law enforcement requests when legally required
• Maintain audit logs for compliance purposes

Communications

• Send transactional emails (account confirmations, password resets, receipts)
• Notify you of important service changes or security updates
• Send product updates and feature announcements (if you opt in)
• Respond to your questions and support requests

What We DON'T Do With Your Data

✗ Sell or rent your personal information to third parties
✗ Use your form data to train public AI models
✗ Share your documents or form content with advertisers
✗ Access or read your form data except when necessary for support or security
✗ Send unsolicited marketing emails (you control your email preferences)

4. Data Storage and Retention

4.1 Where We Store Data

Your data is stored in secure, industry-standard infrastructure:

Database: Supabase (PostgreSQL) with encryption at rest
File Storage: Supabase Storage with private buckets and Row Level Security
Backups: Automated daily backups with encryption
Caching: Redis Cloud for temporary session data

Data Location: Our infrastructure is hosted primarily in the United States. By using BulkForm, you consent to the transfer and processing of your data in the U.S. and other jurisdictions where our service providers operate.

4.2 How Long We Keep Data

We retain different types of data for varying periods:

Active Account Data

Retention: Stored as long as your account is active
Includes: Profile, templates, presets, batch history, generated forms

Deleted Account Data

Retention: 30-day grace period, then permanent deletion
Exception: Financial records retained for 7 years (legal requirement)

Usage Logs & Analytics

Retention: 90 days (aggregated data may be retained longer)
Purpose: Security monitoring, debugging, performance optimization

Payment & Billing Records

Retention: 7 years (required by tax and financial regulations)
Includes: Invoices, transaction history, subscription records

Support Communications

Retention: 2 years
Purpose: Customer service continuity, quality assurance

4.3 Data Deletion

You can request data deletion at any time:

Self-service deletion: Delete your account through Settings → Account → Delete Account
Request deletion: Email privacy@bulkform.app
Processing time: 30 days (except financial records required by law)

5. Your Privacy Rights

Depending on your location, you have specific privacy rights under GDPR (EU/UK), CCPA (California), PIPEDA (Canada), and other applicable laws.

Right to Access

Request a copy of the personal data we hold about you. We'll provide this in a portable, machine-readable format.

Right to Correction

Update or correct inaccurate personal information. You can edit most data directly in your account settings.

Right to Deletion ("Right to be Forgotten")

Request deletion of your personal data. Exceptions apply for legal obligations (e.g., financial records) and security purposes.

Right to Data Portability

Export your data in a structured format (JSON, CSV) to transfer to another service.

Right to Restrict Processing

Limit how we use your data in certain circumstances (e.g., while verifying accuracy).

Right to Object

Object to certain types of processing (e.g., direct marketing, profiling) on grounds relating to your particular situation.

Right to Opt-Out of Marketing

Unsubscribe from promotional emails at any time. Click "unsubscribe" in any marketing email or update preferences in your account settings.

How to Exercise Your Rights

To exercise any of these rights, contact us:

• Email: privacy@bulkform.app
• Subject line: "Privacy Rights Request"
• Include: Your name, email address, and specific request
• Response time: We'll respond within 30 days (or as required by applicable law)

We may request additional information to verify your identity before processing your request.

6. Data Security

We implement industry-standard security measures to protect your data:

Encryption

• All data transmitted over HTTPS/TLS 1.3
• Data encrypted at rest in our databases and storage systems
• Passwords hashed using bcrypt with salt
• Sensitive data additionally encrypted with Fernet encryption

Access Controls

• Row Level Security (RLS) policies enforce data isolation
• Private storage buckets with signed, expiring URLs
• JWT-based authentication with refresh tokens
• Role-based access control for team features

Monitoring & Logging

• 24/7 system monitoring for suspicious activity
• Comprehensive security logging and audit trails
• Automated alerts for security events
• Regular security assessments and penetration testing

Backups & Recovery

• Automated daily backups with encryption
• Redundant storage across multiple availability zones
• Disaster recovery procedures tested regularly
• Point-in-time recovery capabilities

Employee Access

• Strict need-to-know access policies for employees
• All staff trained on data security and privacy
• Confidentiality agreements signed by all personnel
• Access logs reviewed regularly

Data Breach Notification

In the unlikely event of a data breach that affects your personal information, we will notify you within 72 hours (or as required by applicable law) and provide details about the breach, its impact, and steps we're taking to address it.

While we implement robust security measures, no system is 100% secure. You also play a role in protecting your account by using strong passwords, enabling two-factor authentication when available, and keeping your login credentials confidential.

7. Third-Party Services and Data Sharing

We use trusted third-party services to operate BulkForm. We only share data necessary for these services to function, and we require them to protect your data:

Stripe (Payment Processing)

Purpose: Process payments, manage subscriptions
Data Shared: Email, name, billing address, payment method
Privacy Policy: stripe.com/privacy

Supabase (Database & Storage)

Purpose: Host database and file storage
Data Shared: All account and form data
Privacy Policy: supabase.com/privacy

Redis Cloud (Caching)

Purpose: Cache data for performance, manage job queues
Data Shared: Temporary session data, processing metadata
Privacy Policy: redis.com/legal/privacy-policy

Google OAuth (Optional Authentication)

Purpose: Single sign-on authentication
Data Shared: Email, name, profile picture (only if you choose Google login)
Privacy Policy: policies.google.com/privacy

When We May Disclose Data

We may disclose your information only in these limited circumstances:

With your consent: When you explicitly authorize sharing
Legal obligations: To comply with court orders, subpoenas, or regulatory requirements
Business transfers: In the event of a merger, acquisition, or sale of assets (users will be notified)
Fraud prevention: To investigate or prevent illegal activities, security threats, or policy violations
Service providers: With vendors who help operate BulkForm (under strict data protection agreements)

8. International Users and Data Transfers

BulkForm Inc. is based in the United States. If you access our Service from outside the U.S., your data will be transferred to, stored, and processed in the United States and other countries where our service providers operate.

We comply with applicable data protection laws including:

GDPR (General Data Protection Regulation) for EU/UK users
CCPA (California Consumer Privacy Act) for California residents
PIPEDA (Personal Information Protection and Electronic Documents Act) for Canadian users

By using BulkForm, you consent to the transfer of your data to the United States and other jurisdictions that may have different data protection laws than your country of residence.

9. Children's Privacy

BulkForm is not intended for use by individuals under the age of 18 (or the age of majority in your jurisdiction). We do not knowingly collect personal information from children.

If we discover that we have collected information from a child without parental consent, we will delete that information immediately. If you believe we have collected information from a child, please contact us at privacy@bulkform.app.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

When we make material changes, we will:

Update the "Last Updated" date at the top of this policy
Notify you via email (to the address associated with your account)
Display a prominent notice on our website

Your continued use of BulkForm after policy changes indicates acceptance of the updated terms. If you do not agree with the changes, you should discontinue use and delete your account.

Current Version: Effective November 28, 2025

11. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

BulkForm Inc.

Privacy Officer: privacy@bulkform.app

General Support: support@bulkform.app

Data Protection Officer (GDPR): dpo@bulkform.app

Security Issues: security@bulkform.app

Mailing Address:
BulkForm Inc.
Delaware, United States

We will respond to all inquiries within 30 days (or as required by applicable law).

EU Representative (GDPR)

For GDPR-related inquiries, EU users may contact our EU representative at eu-rep@bulkform.app.