We store your email address, your forms, the answers people give, and hashes of keys, tokens and IP addresses. We never see the chats between people and their AI agents. We set only the cookies needed to sign you in. We run no tracking and show no consent banner.
This policy applies from 2026-10-30.
Who we are
AI Form API is run by one individual. We write "we". Write to hello@aiformapi.com about privacy, your data or this policy.
What data we store
| Data | Why | Notes |
|---|---|---|
| Your email address | To sign you in and contact you | Sign-in link tokens are hashed. They last 15 minutes |
| API key hashes and key prefixes | To check your requests | We cannot show a key again |
| Session records | To keep you signed in for 30 days | The session id is a hash |
| Forms: title, description, fields, settings | To run your forms | Deleted with the form |
| Responses: answers, source, time | To give them back to you | Deleted with the form |
| IP address hashes | Rate limits and abuse checks | Salted SHA-256. We hold no raw IP |
| Fill token hashes | To check agent submits | A token works for 60 minutes |
| Webhook URLs, secrets, last delivery status | To call your server | Secrets are plain text, because we need them to sign each call. We show them once |
| Monthly usage counters | To apply plan limits | Counts only |
| Abuse reports | To review reports about forms | Reason, details, optional email, IP hash |
What we do not store
- The chat between a person and their AI agent. We get only the final answers.
- Raw IP addresses in our database.
- Passwords. There are none. You sign in with email links.
- Card details. We take no payments, and forms cannot ask for card numbers.
- Passport numbers and national ID numbers. Forms cannot ask for them. See Acceptable use.
If you fill in a form
The person who made the form gets your answers. We store them for that person. They decide why they ask and what they do with the answers. Ask them about their use of your data.
To change or delete your answers, ask the form owner first. If you cannot reach them, write to hello@aiformapi.com.
If you use an AI agent to fill a form, that agent's provider governs what you tell it. We do not control it.
Form owners
If you collect personal data with a form, you are the controller. You decide why and how it is used. AI Form API is your processor. We process responses on your behalf, only to run the service for you. A data processing agreement is available on request at hello@aiformapi.com.
You need a lawful reason to ask for personal data. Tell people who you are and what you will do with their answers. Answer their requests. See the terms. For your own account data (your email address and sign-in records), AI Form API is the controller.
Who processes data for us
| Provider | What it does for us | Region |
|---|---|---|
| Vercel | Hosting. Serves the site and runs the API | We do not state a region |
| Neon | Postgres database: accounts, forms, responses | EU, Frankfurt |
| Upstash | Rate limit counters, keyed by hashed IP addresses and emails, and by key, account and form ids | EU |
| Resend | Sends sign-in links and the optional new-response notice. It gets the recipient address and the message | We do not state a region |
| Cloudflare Turnstile | Spam check. It gets the visitor's IP address and browser data | We do not state a region |
Vercel sees the IP address of each request and may keep its own server logs. Write to hello@aiformapi.com about transfers of data outside your country.
How long we keep data
- Accounts, forms and responses: until you delete them. Deleting a form deletes its responses.
- Deleted accounts: we remove the account and its data within 30 days of your request.
- Abuse reports: 1 year.
- Sign-in links and sessions: a link works once, for 15 minutes. A session lasts 30 days.
- Backups: these follow our database host's retention. Deleted data can stay in a backup until the host removes that backup.
Your rights
You can ask for a copy of your data, a correction, deletion, or an end to a use. You can export a form's responses as JSON or CSV at any time: see Responses.
Email hello@aiformapi.com from the address on your account. We answer within 30 days. You can also complain to the data protection authority in your country.
Cookies
We set these cookies, and only when you sign in:
| Cookie | What it holds | How long |
|---|---|---|
afs_session | A signed session id. Scripts cannot read it | Up to 30 days, or until you sign out |
afs_in | The value 1. It lets the header show a dashboard link | Up to 30 days, or until you sign out |
afs_flash_key | Your first API key, set at your first sign-in so the dashboard can show it once. Scripts cannot read it | 5 minutes at most |
All three are needed to sign you in. We run no analytics, advertising or tracking, and show no cookie consent banner. A person filling in a form needs no cookies from us.
Cloudflare Turnstile runs only on sign-up, when a form is submitted, when an agent fill code is created and on the abuse report form.
Children
You must be at least 16 to have an account. If we learn that an account belongs to someone younger, we close it and delete its data. Filling in a form needs no account. A form owner who asks children for personal data must do it lawfully.
Changes
The date of the last update is at the top. If a change affects what happens to your data, we email account holders 30 days before it applies.
See also Security and Acceptable use.
Questions
Do you store the chats between people and their AI agents?
No. We never see that chat. We get only the final answers, from the agent over HTTP or MCP, or pasted by the person into the form page.
How do I delete my data?
Delete a form in the dashboard or with the API, and its responses go with it. To delete your account, email hello@aiformapi.com from the address on the account. We remove it within 30 days.
Do you use cookies?
Only to sign you in. We run no tracking and show no consent banner.