Privacy Policy
Last updated: September 2026
Responses to forms of our customers
Websites of our customers show their forms with sendplane.app or send the responses of their forms to sendplane.app. For these responses, the website owner is the controller and we are the processor. We process the responses only on the instructions of the website owner, as the Data Processing Agreement states.
Did you fill in a form on a website that uses sendplane.app? Send your questions and requests about your data to that website. We help the website owner to answer them.
The rest of this policy is about the data for which we are the controller: the data of our customers, their team members and the visitors of sendplane.app.
Data we process
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Visit to sendplane.app: IP address, browser type, the requested page and the time | Send the pages. Find errors and stop abuse. | Legitimate interest (Art. 6(1)(f) GDPR) | Deleted by Vercel after 1 day |
| Account: email address of each team member, business name, notification email addresses, role in the team | Provide the service. | Contract (Art. 6(1)(b) GDPR) | Until you delete your login or the account |
| Emails that we send: address, subject and content | Send login links, notifications, confirmations and invitations. | Contract (Art. 6(1)(b) GDPR) | Deleted after 30 days |
| Login: time, IP address and browser type of each login | Keep your account safe. | Legitimate interest (Art. 6(1)(f) GDPR) | Deleted by Supabase after 7 days |
| Invitation: email address of the invited person | Send the invitation and add the person to the team. | Legitimate interest of the team (Art. 6(1)(f) GDPR) | Until the person joins or the team removes the invitation |
| Billing: name, email address, billing address, VAT number, payment method, invoices | Collect the payment for the plan. Keep the records that tax law requires. | Contract and legal obligation (Art. 6(1)(b) and (c) GDPR) | 7 years, as Dutch tax law requires |
| Integrations: name of the Slack workspace and channel, the Slack access token, the forms.app API key | Post responses in Slack. Import forms from forms.app. | Contract (Art. 6(1)(b) GDPR) | Slack: until you disconnect Slack or delete the account. forms.app key: until the import is complete. |
| Email to us: your email address and message | Answer your question. | Legitimate interest (Art. 6(1)(f) GDPR) | 2 years after the last contact |
You enter your card details on the pages of Stripe. Stripe stores them.
The controller of this data is Reach Digital B.V., A. van Leeuwenhoekweg 38 C6, 2408 AN Alphen aan den Rijn, the Netherlands, KvK 61711454. It runs sendplane.app as a trade name.
Cookies
sendplane.app sets only the cookies that the dashboard needs to work. All scripts and fonts load from sendplane.app.
| Cookie | Purpose | Duration |
|---|---|---|
| sb-…-auth-token | Keeps you logged in to the dashboard. | Until you log out, at most 400 days |
| sb-…-auth-token-code-verifier | Connects the login link to the browser that asked for it. | Until you log in |
| slack_oauth_state | Protects the connection to Slack against forged requests. | 10 minutes |
Checkout and the billing portal are pages of Stripe on stripe.com. The Stripe Privacy Policy applies to them.
Companies that process data for us
We have a data processing agreement with each of these companies. The database, the files and the servers are in Frankfurt, Germany.
| Company | Service | Location of the data | Safeguard for transfers outside the EU |
|---|---|---|---|
| Vercel Inc. | Servers of the website, the dashboard and the API | Frankfurt, Germany | EU-US Data Privacy Framework, Standard Contractual Clauses |
| Supabase Pte. Ltd. | Database, login and file storage | Frankfurt, Germany | Standard Contractual Clauses |
| Plus Five Five, Inc. (Resend) | Dublin, Ireland, and the US | EU-US Data Privacy Framework, Standard Contractual Clauses | |
| Stripe Payments Europe, Limited | Payments and invoices | Ireland and the US | EU-US Data Privacy Framework, Standard Contractual Clauses |
Vercel, Resend and Stripe process part of the data in the US. Supabase staff in the US and Singapore can access the data for support. For these transfers, we use the safeguards of Chapter V GDPR in the table.
Stripe is also a controller for some payment data, for example to prevent fraud. The Stripe Privacy Policy applies to that data.
A customer can connect Slack. Then sendplane.app posts the responses in the Slack workspace of that customer. The customer chooses this, and the agreement between the customer and Slack applies.
Security
- All connections use TLS. The database and the files are encrypted at rest.
- You log in with a one-time link by email.
- We store API keys, Slack tokens and forms.app keys encrypted with AES-256-GCM.
- Each team sees only its own data. Roles control who manages the team, the API key and the billing.
Your rights
You have the right to access, correct and delete your data, to restrict its processing and to receive it in a machine-readable format. You may object to processing that is based on legitimate interest, and file a complaint with a supervisory authority.
- Change your business name and notification address on the Settings page.
- Delete your login, or the account with all forms and responses, on the Settings page.
- Export the responses of a form as CSV on its Responses page.
Send other requests about your data to info@sendplane.app.