Privacy Policy

StaticForms ("we", "our", "us") is operated by UPG. Our service is available at static-forms.com. If you have questions about this policy, contact us at support@static-forms.com.

We collect and process the following categories of data:

• Account data — your email address and name, provided when you sign up via Clerk (our authentication provider).
• Form submission data — the content of form submissions sent to your endpoints. This includes any fields your visitors fill in (name, email, message, etc.). This data is stored in our database on your behalf.
• Configuration data — your SMTP2GO API keys, Telegram bot tokens, and other integration credentials. These are stored encrypted at rest using AES-256-GCM.
• Usage data — submission counts, timestamps, and basic request metadata (IP address, user-agent) for spam protection and logging purposes.

• To deliver the service — routing form submissions to the notification channels you configure (email via SMTP2GO, Telegram).
• To store submissions in your dashboard inbox.
• To authenticate you and manage your account.
• To prevent spam and abuse (origin validation, honeypot checks).
• To communicate with you about your account or the service.

We do not sell your data or your visitors' data to any third party.

StaticForms integrates with and relies on the following third-party services. Each has its own privacy policy:

• Clerk — authentication and user management. clerk.com/privacy
• SMTP2GO — email delivery. When you configure an SMTP2GO account, email notification content is transmitted through SMTP2GO's infrastructure. smtp2go.com/privacy
• Telegram — instant message notifications. When you configure a Telegram bot, submission data is transmitted to Telegram's API. telegram.org/privacy
• Cloudflare — infrastructure and edge network. All traffic passes through Cloudflare. cloudflare.com/privacypolicy

Form submissions are retained until you delete them or close your account. Account data is deleted within 30 days of account closure. You may request deletion of your data at any time by emailing support@static-forms.com.

We use only the cookies strictly necessary to operate the service — specifically, the session cookie set by Clerk for authentication. We do not use advertising or tracking cookies.

Depending on your location, you may have rights under GDPR, CCPA, or other applicable laws, including the right to access, correct, or delete your personal data. To exercise these rights, contact us at support@static-forms.com.

All data is transmitted over HTTPS. Sensitive credentials (API keys, tokens) are encrypted at rest using AES-256-GCM before storage. We take reasonable precautions, but no system is 100% secure — use the service accordingly.

We may update this policy from time to time. We will notify registered users of material changes by email. Continued use of the service after changes constitutes acceptance.