GDPR Compliance

Nicelyformed LLC (“Nicelyformed”), based in London, United Kingdom, is committed to protecting the rights of individuals in the United Kingdom and the European Economic Area (EEA) under the UK GDPR and the EU General Data Protection Regulation (GDPR). This page summarizes how we support those rights. Our contact for all data protection matters is contact@nicelyformed.ai.

Roles

When you build forms with Nicelyformed, you act as the data controller for the responses you collect, and we act as a data processor handling that data on your behalf. For your own account information, we act as the controller.

Lawful basis for processing

We process personal data on the basis of performing our contract with you, your consent where applicable, and our legitimate interests in operating and securing the service.

Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request erasure of your data (“right to be forgotten”).
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Withdraw consent at any time.
• Lodge a complaint with your local supervisory authority.

Security

Data is encrypted in transit, and the answers respondents submit through forms are additionally encrypted at rest at the application layer (AES-256) before they are written to our database. Access to production data is limited to what is needed to operate the service.

Data retention and deletion

You stay in control of the data your forms collect: deleting a form removes the submissions collected with it, and you can export your submissions at any time from the submissions table. Deleting your account deletes your forms and their submissions within 30 days; encrypted backups are overwritten within a further 30 days. Partially completed submissions that a respondent never finished are kept alongside the form's submissions and follow the same rules.

Breach notification

If we become aware of a personal data breach affecting data we process on your behalf, we will notify you without undue delay and in any case within 72 hours of becoming aware, with the information you need to meet your own obligations as a controller.

Subprocessors

We use a small number of service providers to run Nicelyformed, each under a contract that limits how they may process data:

• Vercel: application hosting, file storage for uploads, and cookieless site analytics (United States and European Union).
• Neon: the database that stores accounts, forms, and submissions (United States).
• Stripe: payment processing for paid plans (United States and European Union).
• Resend: transactional email such as sign-in links and submission alerts (United States).
• Google: the Gemini API that powers form generation, editing, and insights (United States). Data sent to it is not used to train Google's models.

We will update this list before adding a subprocessor that handles personal data. Customers with a signed DPA can ask to be notified of changes by email.

Data transfers

Our subprocessors process data mainly in the United States. Where personal data of people in the UK or EEA is transferred outside those areas, we rely on the UK International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses) and the EU Standard Contractual Clauses, together with each provider's own safeguards and, where applicable, their certification under the EU-US Data Privacy Framework.

Data processing agreement

If you require a Data Processing Agreement (DPA) for your use of the service, email us at contact@nicelyformed.ai and we will provide one. Our DPA incorporates the transfer instruments above and the subprocessor list on this page.

Exercising your rights

To exercise any of your rights, email us at contact@nicelyformed.ai from the address on your account. We will respond within the timeframes required by applicable law. If you answered someone else's form, the form owner is the controller for those answers; contact them first, and we will support their response as the processor. You also have the right to lodge a complaint with your supervisory authority: in the UK, the Information Commissioner's Office (ico.org.uk). See our Privacy Policy for more on how we handle data.