This policy explains how Superforms handles information when people create forms, connect an AI agent, respond to a form, or otherwise use the service. Superforms is built to move questions from an AI-assisted workflow into a shareable form and return the submitted answers to the form creator.
Information we process
- Creator account information. When a creator signs in, we receive basic account information from the authentication provider, such as an account ID, name, email address, and profile image when available.
- Forms and workflow information. We process form titles, questions, goals, hidden creator context, response settings, ownership information, and public link identifiers.
- Responses. We process the respondent name when supplied, typed answers, voice transcripts, screenshots or other supported image attachments, follow-up answers, submission status, and timestamps.
- Agent connection information. We process OAuth client details, authorization grants, scopes, hashed tokens, connection status, and identifiers needed to connect Superforms to an AI client. We do not receive a user's Google password or an AI provider account password.
- Technical information. Hosting and security systems may process IP address, browser or client type, request metadata, timestamps, errors, and similar operational information.
Voice and AI processing
If a respondent chooses voice input, the browser captures audio only after microphone permission is granted. Audio is sent to OpenAI for transcription or realtime voice processing. Superforms stores the resulting transcript as part of the response. Raw recorded audio is processed to produce the transcript and is not stored as the form response by Superforms.
Superforms may send form questions, creator-provided context, and response text to OpenAI to decide whether to ask a follow-up or to produce a response summary. AI output can be incomplete or inaccurate. The original submitted response remains the source of truth.
How we use information
- Provide, maintain, and improve forms, response collection, and agent connections.
- Authenticate creators and enforce access to private forms and responses.
- Transcribe voice answers and generate configured follow-up questions or summaries.
- Diagnose errors, secure the service, prevent abuse, and meet legal obligations.
- Respond to support, privacy, and account requests.
Service providers and connected agents
Superforms relies on service providers to operate the product, including Vercel for hosting, Supabase for database services, Clerk and Google for creator authentication, and OpenAI for transcription and configured AI processing. These providers process information under their own agreements and privacy terms.
When a creator connects Superforms to Claude, ChatGPT, Codex, Cursor, or another agent, that provider may receive tool inputs and results needed to complete the creator's request. Use of the AI provider is also governed by the creator's relationship with that provider. Creators should avoid placing information in a form that they are not authorized to share with the connected provider.
Public links and private credentials
A public form link can be opened by anyone who has the link. Creators should share it only with intended respondents. Agent tokens, OAuth tokens, and account response tools are private access mechanisms and should not be shared. A form creator can read the responses submitted to that form.
Retention and deletion
We retain account records, forms, responses, and authorization records for as long as needed to provide and secure the service, comply with legal obligations, resolve disputes, and enforce agreements. Backup and security records may remain for a limited period after active data is removed.
To request access, correction, export, or deletion, use the instructions on the support page. Do not include sensitive form content in a public support request.
Security
We use technical and organizational measures intended to protect information, including hashed private credentials and scoped authorization. No internet service is completely secure, and we cannot guarantee absolute security. Revoke a connected agent and contact support if you believe a private credential or account has been compromised.
Children
Superforms is not directed to children under 13, and we do not knowingly collect their personal information. Contact support if you believe a child has submitted personal information to the service.
International processing
Superforms and its providers may process information in countries other than the one where a creator or respondent lives. Those countries may have different data-protection laws.
Changes and questions
We may update this policy as the product changes. The date at the top identifies the latest version. For privacy questions or requests, follow the private-contact instructions on the support page.