Acceptable use policy for forms: what you may not collect or do

Updated 2026-10-30

Do not use AI Form API to collect secrets, deceive people or break the law. We block fields that ask for passwords, PINs, card numbers, passport numbers, national ID numbers and similar data. Anyone can report a form from its page. This policy applies from 2026-10-30.

What is not allowed

  • Credentials and secrets. Passwords, passcodes, PINs, CVV or CVC codes, one-time codes, 2FA codes, seed or recovery phrases, private keys.
  • Payment and account numbers. Card numbers, IBANs and bank logins. We take no payments.
  • Government identity numbers. Social security, passport and national ID numbers. This includes the German Personalausweis, Reisepass and Steuer-ID, the Indian Aadhaar number and the UK National Insurance number (NIN).
  • Phishing and impersonation. Forms that pretend to be a bank, a company, a government body, a login page or another person.
  • Deception. Forms that trick people about who is asking or why.
  • Spam and harassment. Using forms or agent fill to send unwanted messages or to harass people.
  • Illegal content. Anything unlawful where you or your respondents are.
  • Attacks on the service. Probing, overloading, or bypassing limits, tokens or spam checks.

How we block it

When you create or change a form, the API checks the id, label and help of every field against a list of blocked terms in English and German. A match returns 422 blocked_field. The list is in Forms and fields.

A word list cannot catch everything. So we also use these limits:

  • no custom HTML or JavaScript,
  • no redirect after submit on the free plan,
  • limits on how fast forms, tokens and responses can be made. See Rate limits and quotas.

Do not hide a blocked request behind other words. That breaks this policy even if the check misses it.

Your responsibility

You are responsible for your forms, and for the forms your AI agent makes with your API key. If your form collects personal data, you control that data. AI Form API processes it for you. You need a lawful reason to ask for it. Tell people who is asking and why. See our privacy policy and terms.

How reports work

  1. Every public form page has a Report abuse link in its footer. It opens /abuse?form= plus the form's slug.
  2. The reporter picks a reason. They can add details and an optional email address.
  3. We store the report and get it by email. We store the reporter's IP address only as a hash. The report form allows 5 reports an hour for each IP address. We keep reports for 1 year.
  4. We review the report.
  5. If the form breaks this policy, we act within 24 hours of a valid report. We close the form. We delete the responses that a phishing form collected. We suspend repeat offenders. We email the form owner.

Send reports about someone's use of the service, security problems and privacy requests to hello@aiformapi.com. It is the only contact address.

If we got it wrong

Appeal by email to hello@aiformapi.com. Name the form and say why the action was wrong. We answer within 7 days. See also Security.

Questions

Can I ask for a password or card number in a form?

No. The API rejects fields that ask for passwords, PINs, card numbers, IBANs, passport numbers, national ID numbers and similar data with the error blocked_field. Do not look for ways around the check.

How do I report a form?

Use the Report abuse link in the footer of the form page. Tell us why. You can leave an email address if you want a reply.

What happens to a form that breaks these rules?

After a valid report we close the form within 24 hours. We delete responses that a phishing form collected, suspend repeat offenders and email the form owner.