Privacy Policy

For your Drapi.dev account, we decide how the data is used and act as the controller.

For form submissions, the customer who owns the form decides what to collect and why. They are the controller of that data, and Drapi.dev processes it on their behalf as a processor. If you submitted a form on someone else’s website, contact that website’s owner first about your data; we will help them respond to your request.

Account data. When you sign up we collect your email address, an optional name, and your password, which is stored only as a salted hash. We also store one-time codes used to verify your email address and reset your password, and your plan and notification preferences.

Content you create. Projects, forms, allowed domains, notification settings, and the API keys you generate.

Form submissions.Whatever fields the submitter sends to a customer’s form endpoint, plus technical metadata recorded with each submission: IP address, user agent, and the Origin and Referer of the page the form was sent from.

Usage data. Monthly counts of submissions and notification emails per account and project, used to apply plan limits.

• To provide the service: receive, store, and display submissions and send notification emails.
• To protect the service and our customers: rate limiting by IP address, checking that submissions come from allowed domains, and filtering spam.
• To enforce plan limits and handle plan changes.
• To send account emails, such as verification codes, password resets, and important service notices.
• To respond to support requests.

We do not sell personal data, use form submissions for advertising, or use them to train machine-learning models. Our legal bases are performance of our contract with you, our legitimate interest in keeping the service secure and working, and compliance with legal obligations.

We share data only with the providers we need to run Drapi.dev:

• Convex: database and backend hosting, where account data and submissions are stored.
• Vercel: hosting for the website and dashboard.
• Resend and Brevo: delivery of notification and account emails, depending on the provider selected for a form.

These providers process data under their own security and data-protection commitments, and only to provide their service to us. We may also disclose data if the law requires it, or to protect the rights and safety of our users or the public.

We use strictly necessary cookies to keep you signed in. The dashboard also stores small interface preferences (such as your theme and which submissions you have already seen) in your browser’s local storage. We do not use advertising or third-party tracking cookies.

Submissions are kept until the customer deletes them, deletes the form or project, or deletes their account. Deleting your account from Settingspermanently removes your projects, forms, domains, submissions, and usage records. Residual copies in backups expire on our providers’ normal backup schedule.

All traffic to Drapi.dev is encrypted with HTTPS. Passwords are hashed, API keys can be revoked at any time, and form endpoints can be restricted to the domains you allow. No system is perfectly secure, but we work to protect your data and will notify affected customers of a breach as the law requires.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Customers can view, export (CSV), and delete their data directly in the dashboard. For anything else, email support@drapi.dev. You may also complain to your local data-protection authority.

Our providers may store and process data in countries other than yours, including the United States. Where required, these transfers rely on appropriate safeguards such as Standard Contractual Clauses.

Drapi.dev is not directed at children under 16, and we do not knowingly create accounts for them. Customers must not use Drapi.dev to collect data from children in breach of applicable law.

We will update the date above when this policy changes, and email account holders about material changes before they take effect. Using Drapi.dev is also governed by our Terms of Service.