Privacy Policy

Last updated: August 6, 2026

This is an English translation provided for reference. The Japanese version is the authoritative text.

1. Basic Policy

The operator of FORMLOVA (hereinafter "we" or "the Operator") recognizes the importance of personal information and strives to protect it. FORMLOVA (hereinafter "the Service") complies with the Act on the Protection of Personal Information (APPI) of Japan and other applicable laws and guidelines, and handles personal information appropriately in accordance with this Privacy Policy.

2. Age Restriction

The Service is intended for individuals aged 16 and older. We do not knowingly collect personal information from individuals under the age of 16. If we become aware that personal information has been provided by an individual under the age of 16, we will promptly delete such data.

Form creators are responsible for verifying the age of form respondents. When collecting personal information from individuals under the age of 16, form creators must take appropriate measures, such as obtaining parental consent, in compliance with applicable laws (Article 8 of the GDPR, COPPA, etc.).

3. Personal Information We Collect

The Service collects the following personal information.

Account Information

• Email address
• Password (stored in hashed form; never stored in plaintext)
• Name
• Organization name (optional)

Form Response Data

We collect all data entered by respondents into forms created by users. This may include text, selections, file uploads, email addresses, phone numbers, and more.

Respondent Identification Information

When a form is submitted, we generate and store an email address or a hash of the IP address and browser information (User-Agent) for the purpose of preventing duplicate responses and identifying respondents. Hash values are generated through an irreversible transformation, so the original information cannot be recovered.

Usage Information

• IP address
• Browser information (User-Agent)
• Access date and time
• Page view history
• Time spent on pages
• Device information

Email Delivery Information

We record email open times (detected via tracking pixel), link click times, and the target links.

Payment Information

We use Stripe for paid plan payments. Payment information such as credit card numbers is processed directly by Stripe, and we do not store card information on our servers. We only retain the customer ID issued by Stripe and payment history.

Cookies

We use cookies for session management and maintaining authentication state. See "15. Use of Cookies" for details.

Conversation Traces (Opt-In, Disabled by Default)

For usage via MCP clients, we offer a feature that stores summarized traces of conversations (including the names of the tools that were executed). This feature is opt-in and is disabled by default. No conversation traces are stored unless a user explicitly enables the feature. Only short summaries to which redaction of personal information has been applied are stored; we do not store the raw transcript of conversations. See "12. Records Associated with MCP Usage" for details.

Personal Memory

We record user tendencies and preferences (patterns in choices regarding form design, question structure, publication settings, email tone, form category, and language). We do not store the content of form response data itself. See "12. Records Associated with MCP Usage" for details.

MCP Tool Execution Logs

For every operation executed from an MCP client, we record the name of the tool executed, the arguments passed to it, and the output text returned (up to 10,000 characters). These logs are separate from conversation traces: they are not subject to opt-in and are always collected as records necessary for operating the Service. Before storage we redact confidential information such as passwords and tokens and mask email addresses; however, output may include the body of form responses, and it is not possible to mask all such content. See "12. Records Associated with MCP Usage" for details.

External Integration Information

When a user connects the Google Sheets integration or the LINE integration, we store the information required for that integration. For the Google Sheets integration, we store the Google account access token and refresh token. For the LINE integration, we store LINE user IDs, friend information, tap history for distributed links, and the channel access token (stored encrypted). These integrations are disabled by default and become active only when a user connects them.

4. Purpose of Use

We use the collected personal information for the following purposes.

• Provision, operation, and improvement of the Service
• Account authentication and management
• Sending emails (response notifications, auto-reply emails, reminder emails, bulk emails to mailing lists)
• Measuring email delivery effectiveness (tracking opens and clicks)
• Generating and managing identification information for preventing duplicate form responses
• Service provision via AI clients through the MCP protocol
• Storing conversation traces to improve service quality and to let users review their own operation history (only when explicitly enabled by opt-in)
• Accumulating personal memory to improve the accuracy of suggestions and default settings
• Recording MCP tool execution logs to investigate defects, detect and counter abuse, and improve service quality
• A/B testing and funnel analysis for form improvement
• Linking response data to external CRM services based on user instructions
• Synchronizing form response data to Google Sheets based on user instructions
• Delivering messages via LINE and measuring taps on distributed links, based on user instructions
• Analysis and statistics on usage (aggregated in a non-personally-identifiable manner)
• Responding to inquiries
• Investigating and responding to Terms of Service violations
• Legal compliance

5. Third-Party Provision (Outsourcing)

We outsource the handling of personal information to the following providers to the extent necessary for providing the Service (Article 27, Paragraph 5, Item 1 of the APPI). We confirm that outsourcing partners meet our standards for safe management of personal information and exercise necessary and appropriate supervision over their handling of personal information.

We will not provide personal information to any third party other than the above without the user's consent, except in the following cases:

• When required by law
• When necessary to protect the life, body, or property of a person
• When especially necessary for the improvement of public health or the sound development of children
• When it is necessary to cooperate with a national or local government body in executing affairs prescribed by law

External Service Integration via MCP Clients

At the explicit instruction of users, form response data may be sent to other services (HubSpot, Salesforce, Notion, etc.) through MCP clients. Such third-party provision of personal information is based on the user's own judgment and instructions, and the handling of data by the receiving service is governed by that service's privacy policy.

Data Sharing via Team Features

When users use the team feature and invite other members, those members can access form response data according to their permissions (viewer, editor, admin). Invitations and permission settings are the user's responsibility.

6. Transfer of Personal Data to Third Parties in Foreign Countries (Cross-Border Transfer)

In the operation of this Service, we outsource the handling of personal data to the following providers located in foreign countries.

Each provider implements security measures including encryption (at rest and in transit), access controls, and audit logs. We periodically verify that providers take necessary measures to appropriately manage personal data in accordance with Article 28 of the APPI.

Note that LY Corporation is located in Japan, and provision to it does not constitute provision to a third party in a foreign country under Article 28 of the APPI. It is listed in the table above for reference so that recipients of data can be reviewed comprehensively.

7. Security Measures

We implement the following security measures to prevent the leakage, loss, or damage of personal information.

• AES-256 database encryption (Encryption at Rest)
• HTTPS / TLS encryption for all communications (Encryption in Transit)
• Database-level access control via Row Level Security (RLS)
• Hashed password storage (never stored in plaintext)
• OAuth 2.1 authentication for MCP clients (per-user token issuance)
• Minimization of access permissions to personal information
• Recording and regular review of all operations via audit logs
• Regular review and improvement of security measures

8. Data Retention Period

The retention periods for personal information are as follows. Data that exceeds its retention period is promptly deleted.

When an account is deleted, all related data (forms, response data, email delivery history, team member information, etc.) is cascade-deleted.

9. User Rights

Users have the following rights regarding the handling of their personal information.

Rights under Japan's APPI

• Right to request disclosure of personal information
• Right to request correction, addition, or deletion of personal information
• Right to request suspension or erasure of use of personal information
• Right to request suspension of third-party provision

Rights under the GDPR (for EU/EEA residents)

Users residing in the EU/EEA have the following rights under the GDPR (EU General Data Protection Regulation).

• Right of access (Article 15) -- the right to obtain a copy of your personal data
• Right to rectification (Article 16) -- the right to request correction of inaccurate personal data
• Right to erasure ("right to be forgotten" / Article 17) -- the right to request deletion of personal data
• Right to restriction of processing (Article 18)
• Right to data portability (Article 20) -- the right to receive data in a structured format
• Right to object to processing (Article 21)
• Right to withdraw consent (Article 7(3)) -- the right to withdraw consent for consent-based processing at any time

EU/EEA residents have the right to lodge a complaint with their local data protection supervisory authority (Article 77 of the GDPR).

Rights under the UK GDPR (for UK residents)

Users residing in the United Kingdom have the same rights as EU/EEA residents under the UK GDPR (including the Data Protection Act 2018). UK residents have the right to lodge a complaint with the UK ICO (Information Commissioner's Office). For more information, visit https://ico.org.uk.

Rights under the CCPA (for California residents)

Users residing in California have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).

• Right to Know -- the right to request disclosure of the categories and specific pieces of personal information collected over the past 12 months, the sources, purposes of collection, and third parties with whom the information was shared
• Right to Delete -- the right to request deletion of collected personal information, subject to certain legal exceptions
• Right to Opt-Out -- the right to opt out of the "sale" or "sharing" of personal information. We do not sell users' personal information
• Right to Non-Discrimination -- the right not to be discriminated against in terms of service quality or availability for exercising the above rights

California residents may also exercise the above rights through an authorized agent. To submit a request, please contact support@formlova.com. Upon receiving a request, we will verify your identity by matching it against your account registration information.

Data Portability

The Service provides CSV / Excel export functionality for form response data on all plans (including the free plan). Users can retrieve their data at any time and migrate to another service.

Procedure for Exercising Rights

1. Email support@formlova.com with your request
2. We will verify your identity by confirming the email was sent from your registered email address
3. We will respond within 30 days of confirming your request
4. Disclosure requests will be fulfilled by providing electronic records (CSV / Excel files, etc.)
5. We may decline a request if identity cannot be verified or if the request does not meet legal requirements, with notification of the reason
6. Fee: Free

For personal memory, you do not need to follow the procedure above: you can delete it yourself at any time, with immediate effect, by instructing your MCP client in chat (for example, "reset my memory") (MCP tool reset_my_memory; partial deletion by category is also supported).

For conversation traces, you can stop further recording at any time by instructing your MCP client in chat (for example, "disable conversation recording") (MCP tool update_profile). However, this does not delete traces that have already been stored. We do not provide a dedicated feature for deleting stored traces, so if you wish to have them deleted, please follow the procedure above and contact support@formlova.com. If you delete your account, stored conversation traces are also cascade-deleted.

10. Relationship Between Data Controller and Data Processor

Account Information of Form Creators

We act as the data controller and manage this information in accordance with this Policy.

Form Response Data

The form creator is the data controller, and we act as a data processor, processing data based on the form creator's instructions. Requests for disclosure, correction, or deletion of respondent data should be directed to the form creator.

Form creators are responsible for complying with applicable privacy laws and providing appropriate notice to form respondents.

Data Processing Agreement (DPA)

We can provide a Data Processing Agreement (DPA) in compliance with Article 28 of the GDPR. If you require a DPA, please contact support@formlova.com.

11. Data Processing via AI Clients (MCP)

The Service is designed to be operated through AI clients (Claude, ChatGPT, Gemini CLI, etc.) via MCP. When users view or manipulate form response data through an AI client, the data is temporarily loaded into the AI client's (large language model's) context.

This processing is performed based on the user's own instructions. The handling of data within AI clients (whether used for training, data retention period, etc.) is governed by the privacy policy and terms of service of each AI client provider. We are not responsible for the handling of data within AI clients.

Users should understand the risks of handling response data containing personal information through AI clients and use the Service at their own responsibility.

Display of Personal Information in Third-Party AI Clients

The Service's MCP server returns form response data (which may contain personal information) to AI clients based on user instructions. The returned data may be displayed on the AI client's conversation screen. While the server partially masks personal information (e.g., partially hiding email addresses) before returning it, it is not possible to mask all content within responses.

How AI client providers (Anthropic, OpenAI, Google, etc.) retain and use conversation data is governed by each provider's privacy policy. When handling data containing respondents' personal information through AI clients, users are responsible for appropriately notifying respondents of this practice.

12. Records Associated with MCP Usage

In connection with operations performed via MCP clients, the Service stores three kinds of data on our servers (Supabase): conversation traces, personal memory, and MCP tool execution logs. All are tied to the user's own account and are not accessible to other users. All are used solely for providing the Service, improving its quality, investigating defects, and preventing abuse, and none is used by us as training data for large language models.

Of these, only conversation traces are opt-in (disabled by default). Personal memory and MCP tool execution logs are collected as records necessary for operating the Service.

Conversation Traces (Opt-In, Disabled by Default)

Conversation traces record chronological summaries of operations performed in an MCP client. This feature is opt-in and is disabled by default. No conversation traces are stored unless a user explicitly enables the feature.

Only the following are stored:

• Short conversation summaries to which redaction of personal information has been applied
• The names of the FORMLOVA tools that were executed
• The identifier of the related form, the timestamp, and a session identifier used to group a conversation
• Supplementary structured metadata (stored with redaction of confidential information applied)

We do not store the raw transcript of conversations, nor the form response data itself. Note that redaction is a best-effort measure targeting known categories of confidential information, and is not a guarantee that summaries contain no personal information.

You can enable or disable the feature by instructing your MCP client in chat (for example, "enable conversation recording" or "disable conversation recording") (MCP tool update_profile). You can review stored conversation traces yourself by instructing your client in chat (for example, "show me my conversation records") (MCP tool get_my_conversation_traces).

Disabling the feature stops further recording; it does not delete traces that have already been stored. We do not provide a dedicated feature for deleting stored traces, so if you wish to have them deleted, please contact us following the procedure for exercising rights in "9. User Rights".

Personal Memory

Personal memory records user tendencies and preferences in order to improve the accuracy of subsequent suggestions and default settings. What we record consists of patterns in choices regarding form design, question structure, publication settings, email tone, form category, and language, together with whether a suggestion was accepted. We do not store the content of form response data itself.

You can review the stored content yourself by instructing your MCP client in chat (for example, "show me my memory") (MCP tool get_my_memory). You can delete it at any time, with immediate effect, by instructing your client in chat (for example, "reset my memory") (MCP tool reset_my_memory). Partial deletion by category is also supported. A confirmation is requested before deletion is carried out.

MCP Tool Execution Logs

MCP tool execution logs record every operation executed from an MCP client. They are separate from conversation traces: they are not subject to opt-in and are always collected as records necessary for operating the Service.

The following are stored:

• The name of the tool executed and the arguments passed to it
• The output text returned by the tool (up to 10,000 characters; anything beyond this is not stored)
• The timestamp, processing duration, whether an error occurred and its classification, and a session identifier

Before storage, we redact confidential information such as passwords and tokens and mask email addresses. However, for tools that view, search, or export form responses, the output includes the body of those responses, and it is not possible to mask all such content. When handling response data containing personal information through an MCP client, please do so on the understanding that these records are retained.

Use is limited to investigating defects and determining their causes, detecting and countering abuse, and improving service quality.

Retention Period

Neither conversation traces nor personal memory are subject to automatic deletion after a retention period; they are retained for as long as the account exists. When an account is deleted, they are cascade-deleted as related data. Personal memory can additionally be deleted at any time, without waiting for account deletion, using the reset operation described above.

MCP tool execution logs older than 30 days from recording are deleted by a scheduled job. Because the deletion job runs weekly, the actual retention period is up to approximately 37 days. When an account is deleted, they are cascade-deleted as related data without waiting for the retention period to elapse.

13. Email Tracking

Emails sent from the Service may use the following tracking technologies to measure delivery effectiveness.

• Open tracking: A transparent pixel image (tracking pixel) is embedded in the email body, and the date/time the email was opened is recorded
• Click tracking: Links in the email body are converted to redirect URLs, and the date/time and target link of each click are recorded

This tracking is performed to help form creators understand delivery effectiveness. Form creators can enable or disable tracking when sending emails. Email recipients can prevent open tracking by disabling image display in their email client.

14. Email Unsubscribe

Emails sent from the Service include an unsubscribe link. By clicking the unsubscribe link, you can stop email delivery from that form. After unsubscribing, you are added to a suppression list and no further emails will be sent.

Important service-related notifications (account communications, security notices, etc.) may still be sent after unsubscribing.

15. Use of Cookies

The Service uses cookies for service provision. The cookies we use are classified into the following two categories.

Essential Cookies

These cookies are essential for the basic functionality of the Service. Disabling them may cause some features (such as login) to not function properly.

Functional Cookies

These cookies remember user preferences and enhance usability.

Bot Protection (Cloudflare Turnstile)

We use Cloudflare Turnstile for bot protection during form submission. Turnstile analyzes user behavior patterns but does not collect personally identifiable information.

Do Not Track Signal

At this time, there is no universally accepted technology standard for responding to Do Not Track (DNT) signals. Accordingly, the Service does not automatically respond to DNT signals sent by browsers.

16. Handling of Personally Relevant Information

The Service collects and uses the following personally relevant information.

• Hash values of IP addresses and browser information (for identifying form respondents and preventing duplicate responses)
• Email open dates/times and link click dates/times (for measuring email delivery effectiveness)

When providing this information to third parties where it may be linked to personal data at the recipient, we will obtain the individual's prior consent.

17. Automated Decision-Making and Profiling

The Service statistically analyzes respondent behavioral data (dropout rate, completion rate, etc.) in its A/B testing and form optimization features. However, these analyses are aggregate-level statistical processing and do not constitute automated decision-making that produces legal effects or similarly significant effects on individuals (Article 22(1) of the GDPR).

18. Legal Basis for Processing under the GDPR

Processing of personal data of EU/EEA resident users is based on the following legal grounds.

• Performance of a contract (Article 6(1)(b) GDPR): Processing necessary for service provision, including account creation, form creation/management, response data storage, and email delivery
• Consent (Article 6(1)(a) GDPR): Marketing emails, email tracking
• Legitimate interests (Article 6(1)(f) GDPR): Service improvement, fraud prevention, security
• Legal obligation (Article 6(1)(c) GDPR): Tax and accounting record retention obligations

For processing based on consent, users may withdraw consent at any time. Withdrawal is effective only for future processing.

International Data Transfers from the EU/EEA

Japan has received an adequacy decision from the European Commission. For onward transfers from Japan to the United States and other third countries, we confirm that each provider has implemented Standard Contractual Clauses (SCCs) or other appropriate safeguards.

UK GDPR Compliance

We also provide the Service in compliance with the UK GDPR (including the Data Protection Act 2018). The same legal grounds as those applied to EU/EEA residents are applied to the processing of personal data of UK residents.

Data Protection Officer (DPO)

We are not subject to the DPO appointment obligation under Article 37 of the GDPR and have not appointed a DPO. Inquiries from EU/EEA/UK residents regarding the handling of personal data are accepted at support@formlova.com.

19. Data Breach Notification

In the event of a personal data breach, we will provide notification in accordance with applicable laws as follows.

Notification under the GDPR

• We will report to the competent data protection supervisory authority within 72 hours of becoming aware of the breach
• If the breach poses a high risk to the rights and freedoms of data subjects, we will notify affected data subjects without undue delay

Notification under Japan's APPI (as amended in 2022)

• We will report to the Personal Information Protection Commission with a preliminary report (within 3-5 days) and a detailed report (within 30 days, or 60 days in cases of unauthorized access)
• We will notify affected individuals of the summary of the incident, the types of personal data involved, the cause, and the measures we have taken

Notification Content

• Summary and timeline of the breach
• Types and approximate number of affected data records
• Measures taken and steps to mitigate damage
• Contact information

Notification Method

Affected users will be notified via email to their registered email address and through a notice published on our website.

20. For Form Respondents

Personal data of those who have responded to forms on FORMLOVA is stored on the Service's servers based on the instructions of the form creator.

The form creator is responsible for managing respondent data. Respondents should direct requests for data disclosure, correction, or deletion to the form creator.

If you cannot reach the form creator, please contact support@formlova.com. We will coordinate with the form creator and respond within a reasonable scope.

21. Disclaimer

While we strive to appropriately manage personal information in accordance with this Policy, we cannot be held responsible for the following.

• Cases where form creators inappropriately collect or use the personal information of third parties
• Cases where users send personal data to third-party services through AI clients
• Leakage of personal information resulting from users failing to properly manage their account information
• Leakage of personal information due to natural disasters, cyberattacks, or other force majeure events

22. Amendment Procedure

We may amend this Privacy Policy as necessary due to changes in laws or service content.

• In the case of material changes, we will provide advance notice via email to the registered email address or through an announcement within the Service
• The amended Privacy Policy takes effect upon publication on this page
• Continued use of the Service after amendment constitutes agreement to the amended Policy

23. Governing Law and Jurisdiction

This Privacy Policy shall be governed by and construed in accordance with the laws of Japan. Any disputes arising from this Policy shall be subject to the exclusive jurisdiction of the Tokyo District Court as the court of first instance. However, mandatory provisions under the GDPR and other applicable EU legislation shall take precedence for EU/EEA residents, mandatory provisions under the UK GDPR and the Data Protection Act 2018 shall take precedence for UK residents, and mandatory provisions under the CCPA/CPRA shall take precedence for California residents.

24. Contact

For inquiries regarding the handling of personal information or disclosure requests, please contact us using the information below.

Effective date: February 26, 2026