Privacy Policy

tuyaform ("we", "us") operates tuyaform.com, a free online form builder and e-signature service. This policy covers our marketing site, the app, and the public signing pages we host on your behalf.

We are the data controller for account and visitor data. When you send a document to be signed, you are the controller of your signers' data and we process it as your service provider.

Account information: your email address, provided when you sign in. We use passwordless magic links, so we never collect or store a password.

Documents and signatures: the files you upload, the forms you build, the fields you place, and the signatures, names, and responses your recipients submit.

Signer information: when someone signs a document you sent, we record their name, email, signature image, the time of each action, and their IP address and user agent. This audit trail is what makes the resulting PDF legally defensible.

Usage and device data: pages visited, approximate location, browser type, and similar diagnostics, collected to keep the service running and secure.

Cookies and similar technologies: a small number of cookies for sign-in sessions, your language preference, and advertising (see below).

To provide the service: build forms, deliver documents, collect signatures, and generate the Certificate of Completion and audit trail.

To communicate with you: transactional emails such as sign requests, reminders, and completion notices, sent through our email provider.

To keep the service safe: detect abuse, prevent fraud, enforce rate limits, and protect signer access.

To improve the product and to show ads that keep tuyaform free.

tuyaform is free because it is ad-supported. We display ads on our marketing pages, including through Google AdSense and similar partners.

These partners may use cookies and device identifiers to show and measure ads. We do not control their cookies; you can manage personalized advertising through Google Ads Settings and tools like youradchoices.com or your browser settings.

We do not show third-party ads on the private signing pages a recipient uses to sign your documents.

We do not sell your personal information.

We share data with the service providers that run tuyaform: Supabase (database, authentication, and file storage), Resend (transactional email), and Vercel (hosting). They process data only on our instructions.

We share advertising data with ad partners as described above.

We may disclose information if required by law, to respond to legal process, or to protect the rights, safety, and security of our users and the service.

We keep documents, signatures, and audit records for as long as your account is active so that completed agreements remain available and verifiable.

You can delete documents from your dashboard. When you delete your account, we remove your personal data within a reasonable period, except where we must retain records to comply with legal obligations or resolve disputes.

Data is encrypted in transit and at rest. Access to signed documents is controlled by signed, expiring tokens, and signer actions run through hardened, audited database functions.

No system is perfectly secure, but we work to protect your data and to limit access to it. See our Security page for more detail.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Residents of the EEA/UK (GDPR) and California (CCPA/CPRA) have these rights.

You can exercise most of these rights directly in your dashboard, or by contacting us. We will not discriminate against you for exercising your rights.

Our providers may process data in the United States and other countries. Where required, we rely on appropriate safeguards such as standard contractual clauses for international transfers.

tuyaform is not intended for children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy as the service evolves. We will revise the "last updated" date above, and for material changes we will provide a more prominent notice.