Privacy Policy

SIA Inksform (InksForm), Nometnu iela 3-14, Riga, LV-1048, Latvia, registration number [Registration number], is the controller of the personal data described here. Contact us about privacy at info@inksform.com.

When you put personal data about other people into InksForm, for example photos, customer lists or contact details in your documents, sheets and sites, you are the controller of that data and we process it for you under our Data Processing Agreement. Forms on sites connected to your own Supabase project save straight to your project; we don't receive those submissions.

The same goes for your leads: the messages visitors send through your sites' forms, whether they asked for your news and offers (and when, the words they saw, and when they confirmed it by email), and the email campaigns you send them. You are the controller of that data and of the consent your forms collect; we store it and send your campaigns for you, from our address in your business's name, under the Data Processing Agreement.

• Account: email address, name, username, profile picture and bio, sign-in records, and, if you sign in with Google, Apple, Microsoft, Facebook or GitHub, what it shares with us: your name, email address and profile picture (Apple may give us a private relay address instead of yours).
• Your work: prompts, uploads, and the images, videos, audio, sites, documents and chats you create, plus the projects, folders and sharing settings around them.
• Voice: recordings you make for dictation or talk mode, sent to ElevenLabs to turn into text.
• Usage and credits: which tools you use, credits spent and bought, and plan status.
• Personalisation: your answers when you set up InksForm (who you make things for, what you want to make first, your business's name, field and country, your experience), and, while "Learn from how I work" is on, small counts of which tools you open and finish, what kind of work you keep, delete or export, whether you pick Light or Pro, and the part of the day you work. Never what you make, type or upload.
• Payments: handled by the seller shown at checkout. We receive plan status and the last digits of the card, never the full card details.
• Connections: keys for services you connect yourself (Claude, GitHub, Vercel, your Supabase), stored encrypted.
• Your leads and campaigns (for you, as your processor): what visitors send through your sites' forms; where a form asks, whether they ticked your news and offers box, when, and the exact words they saw, the confirmation email we send them for you and when they confirmed; for each campaign you send, who it went to and what happened to each email (delivered, opened when the mail app reports it, bounced, complained, unsubscribed); and, for addresses that unsubscribed from your campaigns, a one-way code so they're never emailed by you again, never the address itself.
• Community and messages: posts, comments, likes, reports and messages you send.
• Invitations: when someone invites you to a workspace or shares work with you by email, your email address and the invitation.
• Legal forms and contact: your name, email and what you tell us when you report content, withdraw from a purchase, subscribe to updates or write to us, and which versions of the Terms your account accepted.
• Technical: IP address, device and browser details, and error logs, kept briefly for security.

You need an email address to have an account; without it we can't provide the service. Everything else is optional.

• To provide the service you signed up for: contract (GDPR Art. 6(1)(b)).
• To keep the service secure, prevent abuse and fix problems: legitimate interests (Art. 6(1)(f)).
• To improve the service with aggregated usage statistics: legitimate interests. We don't sell data or build advertising profiles.
• To personalise the service for you (where to start, the order of your tools and Home, Light or Pro) from your setup answers and the personalisation counts: legitimate interests (Art. 6(1)(f)). It only rearranges and suggests within InksForm, tells you why with an Undo, never changes your privacy, sharing, notification, payment or accessibility settings, isn't shared with anyone and doesn't train AI. Turn it off in Settings → AI features, which also deletes the counts.
• To send product news, offers and reminders (your free credits waiting, ideas when you've been away, plans and offers, inviting friends) and, if you switch it on, a weekly summary of what you made: only with your consent (Art. 6(1)(a)), given in Settings → Notifications and withdrawn there or in one click from any of these emails. Should we ever rely on the exception for existing customers (ePrivacy Directive Art. 13(2)) for people who paid us, each email would say so and you could say no in one click; we don't today.
• To send emails about your account: a welcome and a few tips in your first week, and a note when your paid plan's credits run out with the top-ups you can buy: to provide the service (Art. 6(1)(b)) and our legitimate interests (Art. 6(1)(f)). Each kind can be switched off in Settings → Notifications and in one click from the email. They're timed from when you last used InksForm, the kinds of things you made (never the work itself), your plan and your time zone, are capped at two a week and never two in a day, and carry no tracking pixel.
• To send your email campaigns to your leads: on your instructions as your processor (Art. 28). Only leads who ticked your form's news and offers box and then confirmed by clicking the link in the email we send them get them (an address that doesn't confirm within 7 days never gets your campaigns), every email carries a one-click unsubscribe for your business, and we stop sending to addresses that unsubscribe, bounce or complain. We keep the consent records and unsubscribes so you can show who agreed and so nobody who left is emailed again.
• To handle content reports and withdrawals, keep records of them, keep accounting records and answer lawful requests: legal obligation under the Digital Services Act, consumer law and accounting law (Art. 6(1)(c)).

When you create something, your prompt and the files you choose are sent to the AI provider that makes the result (see the list below). They process it to return your result: Anthropic's Claude writes text, code, the assistant's answers and research reports, and Google's Gemini and Veo make pictures and video and read audio and video. Neither uses it to train its models under its paid API terms. We don't train models on your content.

How we mark AI results is explained in AI at InksForm.

With the service providers that run InksForm for us (below); with the people you choose to share work with; publicly, when you publish or post; with services you connect yourself (Claude by Anthropic, GitHub, Vercel, your own Supabase project), when you ask us to send your work there; with Stripe, which sells our plans and credits to you as our reseller (the merchant of record, shown as Link) and processes your payments (your card details go straight to Stripe, never to us; it is listed below, and as the seller, for fraud prevention and for its own legal duties it acts as an independent controller under its privacy policy); and with authorities when the law requires it.

• Supabase

  Database, sign-in and file storage

  Data

  Account details, everything you create or upload, usage and credits

  Where

  EU (Ireland)

  Safeguards

  Data stays in the EU; Standard Contractual Clauses for support access

• Vercel

  Hosting the app and running its server functions

  Data

  Requests, IP addresses, technical logs

  Where

  EU functions (Ireland), global edge network

  Safeguards

  EU–US Data Privacy Framework and Standard Contractual Clauses

• Anthropic (Claude API)

  Writing, code, assistant and research with Claude

  Data

  Prompts, the pictures and documents you choose to use, conversations with the assistant, generated text and code

  Where

  United States

  Safeguards

  Standard Contractual Clauses (Anthropic's Data Processing Addendum). API data is not used to train Anthropic's models and is deleted within 30 days (up to 2 years if flagged as misuse)

• Google (Gemini API, Veo)

  Generating and editing images and video, and reading audio and video you add

  Data

  Prompts, the files you choose to use, generated results

  Where

  United States and other Google locations

  Safeguards

  EU–US Data Privacy Framework and Standard Contractual Clauses. Paid API data is not used to train Google's models

• ElevenLabs

  Voice, music, sound effects and transcription, live captions and call transcripts

  Data

  Text to speak, audio you record or upload; in calls, the voice of whoever is speaking while captions or notes are on

  Where

  United States and EU

  Safeguards

  Standard Contractual Clauses

• Stripe

  Sells our plans and credit packs as our reseller (merchant of record, through Link): checkout, subscriptions, VAT, receipts and invoices, refunds, chargebacks and fraud checks

  Data

  Name, email, billing address, payment method (card details go straight to Stripe, never to us), what you bought and when

  Where

  EU (Ireland) and United States

  Safeguards

  EU–US Data Privacy Framework and Standard Contractual Clauses (Stripe's Data Processing Agreement)

• LiveKitPlanned, not yet in use

  Carrying the audio, video and shared screens of calls through its media servers, once our call server is switched on (until then calls go straight between devices)

  Data

  Call audio and video while in transit (not recorded or stored), participant names and technical connection data

  Where

  EU and global edge network (LiveKit Cloud)

  Safeguards

  Standard Contractual Clauses

• Cloudflare

  Helping devices find each other for calls (STUN, in use now); later, once switched on, hosting published websites, spam protection on forms, and a bot check when you sign in or create an account (Turnstile)

  Data

  IP addresses and connection details for calls; later, published site files, visitor requests, form submissions, and the browser signals the bot check reads

  Where

  EU and global edge network

  Safeguards

  EU–US Data Privacy Framework and Standard Contractual Clauses

• SEO Mommy

  Search checks, keyword research, articles and outreach drafts for your websites, when you use SEO

  Data

  Your website's address and public pages, the business details and brief you give for it, and the articles and drafts made for it

  Where

  Lovable Cloud (its region is being confirmed)

  Safeguards

  Being confirmed with Lovable

• Resend

  Sending sign-in, notification and receipt emails, and the campaigns businesses send to their leads

  Data

  Email address, email content, delivery events

  Where

  United States

  Safeguards

  Standard Contractual Clauses

• SentryPlanned, not yet in use

  Error reports so we can fix problems

  Data

  Technical error details with personal data removed where possible

  Where

  EU (Germany)

  Safeguards

  Data stays in the EU

While you work, your browser loads some fonts from Google Fonts and, in website previews, page scripts from jsDelivr; they receive your IP address to deliver those files.

When you choose to sign in with Google, Apple, Microsoft, Facebook or GitHub, that company confirms who you are and learns that you use InksForm; it acts as an independent controller under its own privacy policy. We ask only for your name, email address and profile picture, and never post, read your contacts or reach anything else in that account.

The current list and its changes are on the Sub-processors page, where you can subscribe to updates.

Your account and your work are stored in the EU (Ireland). Some providers process data in the United States, under the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses, as shown for each in the table above. You can get a copy of the safeguards we rely on by writing to info@inksform.com.

• Your account and work: while your account is open. Deleted items stay in Recently deleted for 30 days, then are removed for good.
• Database backups: up to 35 days after deletion.
• Personalisation counts: they fade within weeks, and are deleted when you remove an item, reset them or turn learning off in Settings → AI features, or delete your account.
• Technical and security logs: up to 90 days.
• At our AI providers: Google keeps prompts and results for a limited time only to detect abuse, uploaded files for up to 48 hours, and generated videos for about 2 days so you can extend them. Anthropic deletes prompts and results within 30 days, and keeps ones its safety systems flag as misuse for up to 2 years.
• Content reports and our decisions: 3 years after they're closed.
• Withdrawal requests and accounting records: for the periods Latvian accounting and tax law require (generally 5 years).
• Records of which terms you accepted: while your account is open.
• Update subscriptions: until you unsubscribe.
• Your leads: for the period you choose for each site (24 months unless you change it), and consent records with them. Campaigns and who each went to: until you delete the campaign or the lead. Email delivery records: 180 days. Unsubscribes from your campaigns (as a one-way code): for as long as your account exists, so they keep being honoured.
• If you started a free trial: a one-way code made from your card (never the card itself), so each card gets one free trial. While your account exists, and after you delete it until a year after that trial began.
• After you delete your account, we remove your data within 30 days, except what the law requires us to keep and the trial code above.

You can access, correct, download or delete your data, restrict some uses, and withdraw consent at any time without affecting what happened before. Most of this is in Account (Download my data, Delete account). For anything else, write to info@inksform.com; we answer within one month (at most two more for complex requests, and we'd tell you why).

Your right to object: where we rely on legitimate interests (security, abuse prevention, usage statistics), you can object at any time for reasons relating to your situation, and we stop unless we have compelling legitimate grounds or need the data for legal claims.

Automated decisions: we don't make decisions with legal or similarly significant effects on you based only on automated processing. Community posts go through an automated safety check before they appear, and a post reported by three people is hidden until a person reviews it; you can ask for a person to review any such decision at info@inksform.com.

You can also complain to the Data State Inspectorate of Latvia (Datu valsts inspekcija) or the data protection authority where you live.

In InksForm, open Settings → Data & privacy → Delete account. It deletes your account and everything in it, including what Google, Apple, Microsoft, Facebook or GitHub shared when you signed in with them; we remove the rest within 30 days, as described above.

To also stop that company from letting you sign in to InksForm, remove InksForm in its settings: Facebook (Settings & privacy → Settings → Apps and websites), Google (myaccount.google.com → Security → Your connections to third-party apps), Apple (Apple Account → Sign in with Apple), Microsoft (account.microsoft.com → Privacy → Apps and services) or GitHub (Settings → Applications → Authorized OAuth Apps).

If you can't sign in any more, write to info@inksform.com from your account's email address and we delete it for you.

We use only what is strictly necessary to sign you in and remember your settings. No advertising or tracking cookies. Details are in the Cookie policy.

Data is encrypted in transit and at rest. Keys you connect are sealed with AES-256-GCM and only unsealed on the server when needed. Access is limited by strict database rules, and the database is backed up daily.

If a breach affects your data, we tell you and the authority as the law requires.

InksForm is not meant for people under 18, and we don't knowingly collect their data.

We tell you about material changes in the app and by email before they take effect. Every version and what changed is listed in this page's history.