Privacy Policy

Sentraform is operated by Haggard Newman LLC, a Michigan limited liability company doing business as Sentraform. In this Policy, "Sentraform", "Haggard Newman", "we", "us", "our", the "Platform" and the "App" (collectively, the "Company") refer to Haggard Newman LLC, which operates the Sentraform services. This Policy explains how the Company handles personal information.

If you are filling out a form

This short summary is for you if a business sent you a form that runs on Sentraform. The full details follow.

• The business that owns the form decides what to ask and why. Sentraform provides the software and handles your answers on that business's instructions.
• Your answers are saved only when you click Submit. If you leave without submitting, your answers aren't saved. On some forms, we note which question or section you reach, under a random ID and without your answers, so the owner can see how far people get.
• Files upload as soon as you add them. They stay private and are scanned for malware. If you don't submit, we delete them after 24 hours, and the form owner never sees them. See Section 4.
• We save your IP address and the time with your response. We use the IP address to prevent abuse. The form owner sees it only if you sign the form, as part of the signature record.
• Some information doesn't belong in a form. Without our written approval, form owners may not use Sentraform to ask for Social Security numbers, full bank or card account numbers, government ID numbers, or health information protected under HIPAA. If a form asks for one, you don't have to give it. Leave the form and tell us with "Report this form", or at safety@sentraform.com.
• We don't sell your answers or use them for advertising. Forms on Sentraform don't load advertising or analytics trackers.
• For questions or requests about your answers, contact the form owner first. If you can't tell who that is, email privacy@sentraform.com and we'll help. See Section 11.

1 Who we are and who this policy covers

The Company, as defined at the top of this Policy, operates the Services. Our privacy contact is privacy@sentraform.com.

This Policy covers personal information handled through the Services. "Services" means our website at https://sentraform.com, our form builder and workspace at sentraform.com/app, hosted and embedded forms, file uploads and signatures, response tools, analytics, email notifications, billing, and support. "Personal information" means information that identifies a person or household or can reasonably be linked to one.

Who it covers. This Policy covers:

• website visitors;
• businesses that use Sentraform ("Customers") and the people they add to their workspace ("Authorized Users");
• people who contact us; and
• people who open or fill in a Customer's form, whether or not they submit it ("Respondents").

When we decide how information is used. We're responsible for our own website, account administration, billing, support, security, and the records we keep to protect the Services. For this, we act as a controller or business, as the law names the role.

When a Customer decides. A Customer chooses its form's questions, purpose and recipients, and how long it keeps responses. We process the resulting "Customer Data" as the Customer's processor, service provider or contractor. Customer Data means:

• form designs;
• submitted answers and uploaded files;
• signature records;
• values from a form's link that the Customer chose to save;
• the IP address and time saved with each response;
• contact lists built from responses;
• the team lists a Customer enters to assign responses; and
• form-progress records.

A Customer may itself be acting for its own client. Its notice should identify the business responsible for your information and explain how to contact it.

What that means for Respondents. The form owner's own privacy notice explains its uses, follow-up and recipients, and how to contact it. Calling ourselves a processor doesn't remove duties the law places directly on us.

Our staff. Our app gives our staff no view of a Customer's forms or responses. A small number of authorized people who run our cloud infrastructure can reach stored data. They do so only to operate, secure or repair the Services, to carry out a Customer's instructions, or where the law requires, and they're bound by confidentiality obligations.

2 Information you provide

Accounts. Your email address and password. We keep only a salted, scrambled form of the password, called a hash. Also your workspace's name and, if you add them, your display name, profile picture, time zone, time format and language. We also keep your role in the workspace, your two-factor sign-in settings, and when you last signed in. When you create an account, we record which version of our Terms of Service you accepted, and when.

Payments. Stripe processes our payments:

• Your card. You enter it in Stripe's secure fields, shown on our billing page or on Stripe's own page. We never see or store your full card number.
• What Stripe collects. When you buy a plan: your card details, your billing name and address, and your tax ID if you add one.
• What we give Stripe. Your email address and your workspace's name. We also label the Stripe records with our own workspace and account IDs.
• What we keep. Your Stripe customer and subscription IDs; your plan, billing period and payment status; and a record of each purchase or plan change you agree to: the words you were shown, the price, the version of our terms, who agreed, and when.
• What we read but don't store. When you open your billing settings, we read your card's brand, last four digits and expiry date, and your invoices, from Stripe to show you.

Stripe also uses payment data for its own purposes, such as preventing fraud (see stripe.com/privacy). Payments run in Haggard Newman LLC's Stripe account, so invoices, receipts and card statements show our company name.

Support and correspondence. Messages you send us, by email or through "Send feedback" or "Get help" in the app, with your email address, your workspace, and the page you sent them from. To report a form for abuse, use "Report this form" at the bottom of the form, or email safety@sentraform.com. We keep the reason and the details you give, and your email address if you include it. Please don't send us financial or identity documents by email.

Customer forms and responses. Form questions and designs, and what Respondents submit: answers, files a form asks for, and signatures (Section 4). Also the email address a form collects to send a confirmation, or to allow one response per person. What is collected depends on the form. Answers are saved only when the Respondent clicks Submit.

Information Customers may not collect. Customers may not use Sentraform to collect any of the following, by a question or by a file upload, unless we've approved it in writing:

• Social Security numbers;
• full bank account numbers or full payment card numbers;
• driver's license, passport or other government ID numbers, including a photo of an ID card; or
• health information protected under HIPAA. We don't sign business associate agreements.

If a form asks you for one of these, you don't have to give it. Leave the form and tell us with "Report this form" at the bottom of the form, or at safety@sentraform.com.

Connected services. Sentraform doesn't connect forms to other apps or services. A Customer may download its responses and use them in its own tools. If we add connections, we'll update this Policy first.

3 Information recorded automatically

Technical information. When you use the Services, our hosting providers receive:

• your IP address;
• your browser and device type;
• the page or link you opened, and the page that sent you there; and
• the time.

We use this to deliver pages, keep the Services secure, limit abuse, and fix errors. We don't work out your location from your IP address.

With each response. We save the IP address a response came from, and the time it arrived. We use the IP address to prevent abuse and, if you sign, in the signature record (Section 4). The form owner sees the time with every response, and the IP address only in a signature record.

Activity log. When someone signs in to a workspace or changes it, we record what was done, when, and from which IP address and browser. People in that workspace who can view its activity log see these entries. We no longer record Respondents' IP addresses or browsers in this log.

Form progress. On forms that show one question or one section at a time, your browser tells us each screen you reach. It does this under a random ID, which your browser keeps until you close the tab. We record:

• which screens that ID reached;
• when it started and when it last moved on; and
• whether it was submitted.

We don't record your answers this way, and we don't link this record to your response. The form owner sees totals, such as how many people reached each question.

Errors. If a page hits an error, it sends us the error message, your browser type, and the page's address up to any "?". We use this to fix the error.

Values in a form's link. On some plans, a Customer can set up its form to save named values from the form's link, such as ad click IDs (for example, gclid) and UTM tags. They're saved with your response when you submit, never before. You don't see them on the form; the Customer sees them with your response. When a form is embedded on a website, that site can pass values from its own link, such as UTM tags, into the form's link. We don't send these values to Google or any other advertising service. A click ID, IP address or similar identifier can be linked to a person even without a name.

4 Files and signatures

Files. A form can ask you to upload files. Each file uploads as soon as you add it, so it's ready when you submit.

• Where files are kept. In private Google Cloud Storage in the United States (the us-central1 region), encrypted with our own key.
• Malware scanning. We scan every file with our own malware scanner, which runs on Google Cloud. No other company scans your files. A file stays closed until the scan finds it clean, and we delete any file that fails.
• Who can open files. Only the form owner's signed-in team members who can see responses, through private links that expire after 5 minutes. Files are never public and are never served from sentraform.com. Once you've uploaded a file, you can't download it, even your own.
• Files you don't submit. If you remove a file, we delete it. If you never submit the form, we delete your files after 24 hours. Either way, the form owner never sees them.

Whenever we delete a file, our storage provider keeps a recovery copy for 7 more days, then it's gone. Some file types are always blocked, such as web pages, SVG images, scripts and programs, archives, and Office files with macros.

Signatures. If a form asks you to sign, you type your name or draw your signature, as the form allows. When you submit, we save a signature record (a signing certificate) with your response. It holds:

• a unique envelope ID;
• the time on our server;
• whether you typed or drew your signature, and the name you typed;
• your name as the form collected it;
• the consent wording you were shown, if any, and whether you agreed;
• your IP address;
• the form and its version; and
• a SHA-256 fingerprint of your answers and these details, which makes the record tamper-evident.

The form owner sees this record. You see the envelope ID when you submit. If you draw your signature, the drawing is kept as an image in the same private file storage, and scanned like any file. We don't verify who signed.

5 How we use information

For our own relationship with visitors and Customers. We use information to:

• create and secure accounts;
• manage subscriptions and billing;
• send the emails described below;
• answer questions;
• investigate incidents and abuse;
• comply with the law; and
• bring or defend legal claims.

We use operational information to keep the Services reliable and to improve them.

Emails we send. We don't send marketing emails. If we ever do, we'll send them only to people who opt in. While you have an account, we send emails you can't turn off: confirmation links, sign-in codes and other security messages, trial reminders, purchase confirmations, renewal reminders, payment problems, and notice of changes to our terms or prices. You can't buy a plan until you confirm your email address. By default, a workspace's forms don't send confirmations to Respondents until an Admin of the workspace confirms their email address. Alerts meant for a teammate who hasn't confirmed go to the workspace's first Admin instead. This helps stop Sentraform being used to send unwanted email.

For Customer Data. We:

• host forms;
• record submitted responses, files, signatures and form progress;
• keep response and contact lists;
• send the notifications a Customer turns on;
• assign responses to its team members when it asks;
• support the Customer;
• protect the Services; and
• follow the Customer's lawful instructions.

A Customer's team can see a contact list that combines people's responses across that Customer's own forms. We don't give one Customer access to another's responses.

Lead scores. A Customer can set up scores for its responses. They're calculated from its own rules. Sentraform doesn't decide credit eligibility, or any other legal outcome, for a Respondent.

What we don't do. We don't:

• sell Customer Data;
• use form answers for Sentraform's advertising, or send them to advertising services;
• contact Respondents to market Sentraform based on their form answers;
• build profiles of Respondents across unrelated Customers; or
• use Customer Data to train artificial intelligence models.

No AI provider processes Customer Data. We'll update this Policy before any feature sends Customer Data to one.

De-identified statistics. We may use de-identified, aggregated statistics to understand performance and improve the Services. We keep reasonable safeguards against re-identification, and we don't try to re-identify the statistics. We require the same of anyone who receives them.

6 Alerts, assignment, and advertising measurement

Response alerts. On plans with email notifications, a Customer can have us email one member of its workspace when a response arrives. The alert names the form and the workspace, says how many files came with the response, and links to Sentraform. It never contains answers or files.

Confirmations to Respondents. If a form collects your email address and its owner turns on confirmations, we email you on the owner's behalf. The email shows the owner's workspace name followed by "via Sentraform", with the owner's logo and colors and the thank-you message the owner wrote. Replies normally go to the owner's team. It doesn't repeat your answers.

Assigning responses. A Customer can have us label each new response with the next person on a list of its own team members. This is called round-robin. We don't send the response to that person or to anyone else; the Customer's team sees the label in Sentraform.

Google Ads and other advertising. Sentraform has no connection to Google Ads or any other advertising service, and sends them nothing. A form owner may save an ad click ID from the form's link with your response (Section 3), and use it in its own advertising tools, under its own notice and that service's terms. Before we offer a connection that sends data to an advertising service, we'll update this Policy.

7 Cookies, browser storage, and similar technologies

What we use. Sentraform sets no cookies of its own. We use:

• your browser's local storage, to keep you signed in and remember a few settings; and
• its session storage, for short-lived things such as a form visit's random ID. Your browser clears session storage when you close the tab.

The tables below list each item, what it's for, and how long it lasts.

Our website (sentraform.com: the home, pricing, contact, terms and privacy pages)

The app (sentraform.com/app, sign-in and sign-up)

Forms (sentraform.com/f/…, including forms embedded on other websites)

Forms set no cookies, and your answers stay in the page until you submit. When a form is embedded on another site, your browser may partition or block this storage; the form still works. A website that embeds a form is responsible for its own cookies and trackers.

Payments. Our billing pages load Stripe's code from js.stripe.com only when you open a payment form, or when your bank needs to confirm a payment. Stripe then:

• sets the fraud-prevention cookies listed above;
• sees your IP address and device details; and
• may load a security challenge it uses against fraud.

See Stripe's privacy and cookie policies. Stripe uses these cookies to prevent fraud; we don't use them ourselves.

Analytics and monitoring. We use no third-party analytics, advertising, session-replay or error-monitoring tools on our website, our app, or Customers' forms. When a page hits an error, the report goes to Google Cloud, which hosts our servers. It contains only the error, the page's address and your browser type, never form answers. Form progress (Section 3) is counted on our own servers.

No advertising trackers. Our website, our app and Customers' forms don't load advertising, retargeting or analytics trackers. Measurement that a Customer sets up in its own tools is separate.

Your choices. We use only storage the Services need, so we don't ask for consent. You can clear or block site storage in your browser. You'll be signed out, and forms will still work. Clearing storage doesn't delete responses already submitted; see Section 11 for requests.

Browser signals. We don't sell or share personal information, or use it for targeted advertising, so a Global Privacy Control signal has nothing to turn off. If that changes, we'll treat the signal as a valid request to opt out, for processing we control. We don't track you across other sites, so we don't respond differently to Do Not Track signals. Where a signal relates to processing a Customer directs, the Customer must meet its own duties.

8 Who receives information

Customers and their teams. We make Customer Data available to the Customer it belongs to:

• Who sees responses. In a workspace, Admins, Viewers and custom roles given access to responses can see them. Auditors see totals and the activity log, never responses.
• Files. Files open only for signed-in team members who can see responses, through links that expire after 5 minutes, and we log each one.
• Publishing. Publishing a form doesn't make its responses public.

Companies that help us run Sentraform. These companies, our subprocessors, handle personal information for us. Each receives only what its function needs, and may use it only to provide its service to us. The exception is Stripe, which also uses payment data for its own purposes, such as preventing fraud.

Apart from these companies, and the fraud check Stripe may load on billing pages (Section 7), no other company receives personal information from the Services. We don't use advertising, analytics or AI providers.

Changes to this list. The current list is on our subprocessor list page, at sentraform.com/subprocessors. We post a new subprocessor there at least 30 days before it starts handling personal information, and we email Customers who have a signed data processing agreement with us. If we must replace a subprocessor urgently, we post the change as soon as we can. Under our Terms of Service, that posting is how we notify Customers.

Advisers and legal disclosures. We may disclose necessary information to professional advisers bound by confidentiality. We may also disclose it where the law requires or permits:

• to respond to valid legal process;
• to investigate fraud or abuse;
• to protect rights or safety; or
• to bring or defend claims.

We limit what we disclose to what the purpose reasonably needs.

Business transactions. Necessary information may be disclosed, under appropriate safeguards, in a financing, merger, acquisition, reorganization (including a transfer to an affiliated or successor company), or sale of assets. A successor must handle the information consistently with the law and these commitments, unless it follows a lawful process to change them. We'll give any notice the law requires.

At your direction. We may disclose information when you specifically ask or authorize us to. Your authorization doesn't waive legal requirements or anyone's rights.

9 Security and sensitive information

Our safeguards. Customer Data is stored on Google Cloud in the United States:

• Encryption. It's encrypted in transit (HTTPS) and at rest (AES-256, backups included). Uploaded files are encrypted with our own key.
• Sign-in. Passwords are stored only as salted hashes, sign-ins expire after 24 hours, and two-factor sign-in is available.
• Access. Team roles limit who sees responses.
• Files. Uploaded files are checked and scanned for malware before anyone can open them, and they open only through private links that expire after 5 minutes.
• Logs. Our logs don't record what you type into a form.

Signed-in Customers can see more in the Security section of the app.

Sensitive information. Sentraform isn't built for Social Security numbers, full bank or payment card numbers, government ID numbers, or health information protected under HIPAA. Customers may not collect them, by a question or by a file upload, without our written approval (Section 2). Our alerts and confirmations never contain answers, and our logs and progress records don't capture them.

The Customer's part. The Customer is responsible for its collection notices, legal basis, permissions, choice of recipients, and protection of copies in its own systems. We remain responsible for our own safeguards and our duties as a processor.

Incidents. No method of transmission or storage is completely secure. If a security incident requires notice, we'll notify the affected Customers, individuals or authorities as the law and our agreements require. Report a security issue or vulnerability to security@sentraform.com.

10 Retention and deletion

We keep information only as long as needed for the purpose it was collected for, a Customer's lawful instructions, and legal, security, accounting or dispute needs. Three things override the periods below: a valid earlier deletion request, a shorter Customer instruction we can carry out, and a specific legal duty to keep information. When we keep information for a legal reason, we use it only for that reason.

After a workspace closes. An Admin can close a workspace by emailing support@sentraform.com from their own address, as our Terms of Service describe. The Customer then has 30 days to export its data, subject to security and access restrictions. We delete the workspace's data within 30 days after that window ends, except the records above that we keep longer. Backups and deleted files' recovery copies then expire as the table says.

What doesn't delete data. Cancelling a plan, moving to Free, or turning off a form doesn't close the account or delete existing responses.

Copies held by others. Deleting information from our systems doesn't delete copies already delivered to a Customer or another recipient. They're responsible for their own copies.

11 Your privacy choices and requests

Emails from us. We don't send marketing emails, and we'd send them only to people who opt in. We send necessary account, billing and security messages while you have an account (Section 5). For outreach from a form owner or its partners, use the options in their messages or contact them directly.

Your rights. Depending on the law that applies to you and our role, you may ask to:

• know what personal information is held about you, where it came from, and who received it;
• get a copy, including in a portable format;
• correct it;
• delete it;
• withdraw consent;
• limit the use of sensitive personal information;
• opt out of sale, targeted advertising or certain profiling; or
• object to or restrict certain processing.

These rights have conditions and exceptions set by law. We won't unlawfully discriminate or retaliate against you for using them.

How to make a request. Email privacy@sentraform.com. For a request about an account, write from the address on the account. Tell us which account or form the request concerns, and what you're asking for. Don't send a Social Security number, full bank details or an identity document by email.

Verification. If we need to confirm who you are, we'll ask only for what's proportionate, through an appropriate channel, and use it only for that purpose. We don't require verification for opt-out requests where the law forbids it.

Authorized agents. An agent may make a request for you, with the authority the law requires. We may ask for proof of that authority and, where permitted, confirm your identity with you.

Timing and appeals. We respond within 45 days. If we need more time, we'll tell you why, and we may take up to 45 more days where the law allows. If we deny a request, we'll explain why. Where the law gives you a right to appeal, email privacy@sentraform.com with the subject "Privacy Appeal". If we deny the appeal, we'll tell you how to complain to the relevant regulator.

Requests about a form you filled out. For Customer Data, the Customer usually decides the request and instructs us to retrieve, correct or delete the information. We'll pass your request to the Customer or otherwise help, and we'll respond directly where the law requires us to. Requests about Sentraform's own accounts, website, billing or support should come to us.

12 Additional US state disclosures

This section adds to the Policy where a US state privacy law applies. Which rights apply depends on the law and the processing. We don't treat business contact information or financial information as exempt only because the Services are sold to businesses.

In the past 12 months, or since we began operating if shorter, we collected and disclosed the following categories.

These categories may also be disclosed for legal process, professional advice, or a business transaction, as Section 8 describes. Section 10 gives retention periods.

No sale or sharing. For personal information we handle for our own purposes, we don't sell it, share it for cross-context behavioral advertising, or use it for targeted advertising. We don't knowingly sell or share the personal information of anyone under 16.

Customer-directed processing. Processing that a Customer directs, such as its use of click IDs it saves, is governed by that Customer's notice, instructions and contracts. Our statement about our own practices doesn't describe every Customer's onward use.

Sensitive personal information. For information we control, we use sensitive personal information only to provide the Services, for security, to verify identity, and to meet legal duties. We don't use it to infer characteristics about a person.

California residents. You have the rights to know and access, correct, delete, opt out of sale or sharing, and limit the use and disclosure of sensitive personal information, as the law provides. Use Section 11 to exercise them.

Residents of other states. Where your state's law gives you a right to appeal, to opt out of certain profiling, or to consent before sensitive data is processed, we honor it for processing we control and help Customers do so for theirs.

13 Children and specialized data

Children. Sentraform accounts and our website are for adults doing business. We don't knowingly collect information directly from children under 13 for our own purposes. Customers may not use the Services to collect information directly from children under 13, or to run a form directed at children, without our separate written approval and the protections the law requires. Information an adult gives about a child can carry its own obligations, and also needs an approved use.

Categories that need separate approval. Support for ordinary business forms doesn't extend to:

• Social Security numbers, full bank or payment card numbers, and government ID numbers;
• health information protected under HIPAA (we don't sign business associate agreements);
• other health information, including consumer health data under state law;
• biometric identifiers used to identify a person;
• precise location; or
• other categories that need specialized safeguards.

Customers need our separate written approval, verified controls, and the necessary agreements before collecting any of these.

If something was collected that shouldn't have been. Email privacy@sentraform.com. We'll investigate and act as our role and the law require, including deleting the information or helping the responsible Customer do so. To report the form itself, use "Report this form" or email safety@sentraform.com.

14 Where information is processed

United States only. The Services are intended for use in the United States. We don't direct them to people in other countries, and Customers may not use them to target people outside the United States without our written agreement.

Locations. Our servers, database, encryption keys, file storage and logs are in Google Cloud's us-central1 region, in Iowa, and Google keeps our backups in the United States. Our team works in the United States. Some providers handle information elsewhere as part of their service:

• Vercel delivers pages from locations around the world, close to you;
• Stripe processes payments globally;
• Google's error-reporting service is global, so error reports may be processed outside the United States; and
• Google Workspace, which runs our email, may store messages outside the United States.

We commit to a particular storage location only if we agree to it in writing.

If you're outside the United States. If you use the Services from another country, your information will be processed in the locations above. We and the relevant Customer must use the legally required safeguards for that processing. This Policy doesn't create a legal mechanism for international transfers, and doesn't waive any rights you have under your local law.

15 Changes and contact details

Changes. We may update this Policy as our practices or the law change. We'll update the date at the top, and give at least 30 days' notice of material changes by account email or a notice in the Services, unless a faster change is needed for legal or security reasons. If a new use needs your consent, we'll get it first. Continuing to use the Services isn't consent where the law requires an affirmative choice.