DRAFT — This document has not been reviewed by a solicitor and is NOT legally effective. Do not rely on it.
Legal

Privacy Policy

Last updated: June 2026 — DRAFT, pending legal review

1. Who we are

AmazingForms is a WordPress plugin published by Pongoe Ltd (referred to in this policy as "we", "us", or "AmazingForms"). Our contact email for privacy matters is privacy@amazingforms.com.

2. What we collect

Account information

When you purchase a licence, your name and email address are collected by Freemius, who act as our Merchant of Record and licence management platform. We receive a copy of your name and email so we can provide support and communicate about your licence. We do not store your payment card details — Freemius and their payment processors handle all card data.

Form submission data

AmazingForms is a self-hosted WordPress plugin. Data submitted through forms you build with AmazingForms is stored in your WordPress database on your server, not ours. We do not have access to your end users' form submissions except when they are processed through the managed AI proxy (see section 3 below).

Usage analytics

With your consent during plugin activation, we collect anonymised usage data: plugin activation/deactivation events, which features are used, and aggregate performance metrics. This data contains no personally identifiable information about you or your users and is used solely to improve the product.

3. How managed AI works

When you use managed AI mode (the default), form submission data is sent from your WordPress server, through our secure proxy, to AI providers — currently Anthropic PBC (Claude models). This processing happens to fulfil your configured agentic workflow (lead qualification, email drafting, CRM routing, etc.).

Important: This data is used only to process your specific request. It is not used to train AI models. Our agreement with Anthropic prohibits use of API data for training purposes.

You can avoid this entirely by switching to BYOK mode (Bring Your Own Key). In BYOK mode, your data travels directly from your WordPress server to the AI provider of your choice, and our proxy is not involved.

4. Training corpus (strictly opt-in)

We are building a proprietary training corpus of anonymised natural language to workflow pairs to improve future AI quality. Contribution to this corpus is strictly opt-in — it is never on by default. If you choose to opt in, submissions are stripped of all personally identifiable information before inclusion. You can withdraw consent at any time.

5. Sub-processors

Sub-processor Purpose Data transferred
Freemius Merchant of Record, licence management, payment processing Name, email, payment data
Anthropic PBC AI inference (managed mode only) Form submission content for processing
FreeScout (self-hosted) Support ticket management Name, email, support correspondence
Email service provider Transactional email (licence keys, receipts) Name, email address

6. Data retention

  • Support ticket data: retained for 2 years after ticket closure.
  • Licence and account data: retained per Freemius policy for the duration of your licence and a reasonable period after.
  • Managed AI proxy logs: retained for 90 days for debugging purposes, then deleted.
  • Form submission data on your server: subject to your own data retention policy — we have no control over it.

7. Your rights

You have the right to access, correct, or delete personal data we hold about you. You also have the right to data portability and, where we rely on legitimate interests as our legal basis, the right to object to processing.

To exercise any of these rights, contact us at privacy@amazingforms.com. We will respond within 30 days.

8. GDPR and CCPA

We comply with the UK GDPR and, where applicable, the EU GDPR and California Consumer Privacy Act (CCPA). Our legal bases for processing are:

  • Contract performance — processing necessary to deliver the plugin and managed AI service you purchased.
  • Legitimate interests — anonymised analytics and security logging, balanced against your rights.
  • Consent — usage analytics opt-in and training corpus opt-in.

For EEA-to-UK or EEA-to-US transfers (for example, when EU-based users' form submissions are processed through the managed AI proxy), we rely on Standard Contractual Clauses where applicable.

9. Changes to this policy

We will notify licence holders by email at least 30 days before making material changes to this policy. The current version will always be published at amazingforms.com/legal/privacy.

10. Contact

Privacy enquiries: privacy@amazingforms.com