Privacy notice
Last updated 26 July 2026
This notice explains what ava42 (“we”) does with personal information. It covers two different groups of people, because we handle their data differently:
- Customers - people with an ava42 account who build forms.
- Respondents - people who fill in a form built by a customer. For that data we act on the customer's instructions; the customer decides what to ask and why. If you answered a form and want your response removed, contact the organisation that sent it to you, or email us and we'll put you in touch.
What we collect
- Account data. Your email address, and your name if you sign in with Google or tell us. We use passwordless sign-in, so we never store a password.
- Content you create. Your forms, their settings, and the responses they collect. Whatever your questions ask for is what we end up storing.
- Responses. The answers submitted to your forms, plus any parameters included in the form's link (for example
?utm_source=newsletter), and the time of submission. - Billing data. If you subscribe, Stripe processes your payment and we keep your subscription status, invoice history and Stripe customer id. We never see or store your card number.
- Operational logs. Ordinary server logs needed to run and secure the service.
- Aggregate page counts. We count how many times each public page was requested, per day - for example "the pricing page: 42 views yesterday". These are totals only: no cookie, no IP address, no device or browser details, and nothing that could be traced to a person or a visit. Published forms carry no counting script of any kind.
We do not run advertising or third-party analytics, and published forms contain no third-party scripts or cookies at all. The only cookie we set is the one that keeps you signed in to your account.
Why we use it
To provide the service, to send the transactional email you ask for (sign-in links and any response notifications you switch on), to take payment, to keep the service secure and working, and to comply with law. We do not use your form content to train AI models.
If you use the AI form builder, the description you type is sent to our AI provider to generate that form. Your responses are never sent there.
Who we share it with
Only the service providers we need to operate, and only for that purpose:
- Fly.io and Tigris - hosting and encrypted backups (United States).
- Stripe - payment processing.
- Resend - sending transactional email.
- Anthropic - only the prompt you type into the AI form builder.
- Google - only if you choose to sign in with Google.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We may disclose information if the law requires it, or to protect our rights and users' safety. If ava42 is ever acquired, this notice travels with the data.
How long we keep it
Your forms and responses stay until you delete them or close your account. Delete a response or a form in the dashboard and it is removed from the live database immediately, and from rolling backups within 30 days. Sign-in tokens expire in 15 minutes; invitations in 7 days. Billing records are kept as long as tax law requires.
Your rights
Wherever you live, you can ask us to access, correct, export or delete your personal information, and we won't treat you worse for asking. California residents have these rights under the CCPA/CPRA, including the right to know what we collect and to opt out of sale - which is moot here, because we don't sell data. You can export your data yourself at any time as CSV or through the API, and delete your forms and responses from the dashboard. To close your account entirely, email us.
Email [email protected] and we'll respond within 30 days.
Security
Traffic is encrypted in transit (HTTPS), backups are encrypted at rest, and access to production is limited to those who need it. No system is perfect; if we ever have a breach affecting your data, we'll tell you and the relevant regulators as the law requires.
Children
ava42 is not for children under 13, and we don't knowingly collect their personal information. If you believe a child has given us data, email us and we'll delete it.
International visitors
We are based in the United States and process data there. If you are elsewhere, using ava42 means your information is transferred to the United States.
Changes
If we change this notice materially, we'll update the date above and email account holders. Continuing to use ava42 after a change means you accept it.