← Back

Privacy Notice

Last updated: April 2026 | Effective under Saudi PDPL (Royal Decree No. M/19)

1. Who we are

FormFlow ("we", "us") is a survey and questionnaire platform. We are the data controller for personal data collected through this platform. Contact: privacy@formflow.app

2. What data we collect

• Survey and questionnaire responses you submit
• Account information (name, email address) when you register
• Anonymised IP address and browser type for security logging
• Session identifiers to track your progress through a survey

3. Legal basis for processing (PDPL Article 10)

We process your personal data on the basis of:

• Consent — you explicitly agree before submitting any survey responses
• Contractual necessity — for account holders, to provide the FormFlow service
• Legitimate interests — anonymised analytics to improve the platform

4. Purpose limitation (PDPL Article 5)

Your response data is used solely for the purpose stated in the consent gate of each survey. It is not used for advertising, profiling, or shared with third parties without your explicit consent.

5. Your rights (PDPL Articles 4, 9)

• Right of access — view all data we hold about you at /pdpl/my-data/
• Right to correction — contact us to correct inaccurate data
• Right to erasure — permanently delete all your data from your account page
• Right to portability — download your data as a JSON file at any time
• Right to withdraw consent — close any survey page before submitting to withdraw

6. Data retention (PDPL Article 18)

Survey responses are retained for a maximum of 12 months from collection. Account data is retained for as long as your account is active. Upon account deletion, all personal data is permanently erased within 30 days.

7. Data security

Data is encrypted in transit (TLS 1.3) and at rest. Access to personal data is restricted to the survey owner and, for enterprise workspaces, designated workspace administrators only.

8. Cross-border transfers

FormFlow stores data within the Kingdom of Saudi Arabia or in jurisdictions that provide adequate data protection. No personal data is transferred to countries without equivalent PDPL protections without your explicit consent.

9. Contact the Data Protection Officer

For any privacy-related enquiries or to exercise your rights, contact our DPO at:
Email: privacy@formflow.app
You may also file a complaint with SADAIA (the Saudi Authority for Data and Artificial Intelligence) at sdaia.gov.sa.