1. About this policy and who we are

This Privacy Policy explains how PDF Form Craft collects, holds, uses, discloses, and protects personal information when operating pdfformcraft.com, app.pdfformcraft.com, and related PDF Form Craft services.

The owner and data controller is PDF Form Craft, Woonona NSW 2517, Australia. Privacy enquiries can be sent through the contact page.

This policy is intended to reflect the Australian Privacy Principles where they apply. Additional rights may apply depending on where you live. In this policy, "personal information" includes information that identifies, relates to, or can reasonably be linked with an individual.

2. Information we collect and hold

The information we handle may include:

• Website and enquiry information: your name, email address, business name, enquiry type, message, and communications with us.
• Abuse reports: the reported form URL, abuse type, description, reporter email, and any screenshot note or link supplied.
• Account and organisation information: contact and business details, account identifiers, roles, team membership, authentication and multi-factor authentication records, preferences, and security events.
• Customer content: uploaded PDFs, form names and fields, validation rules, sharing settings, branding, integrations, and other form configuration.
• Respondent and submission information: answers submitted through forms, contact details requested by a customer, completed PDFs, submission status, verification records, and related metadata.
• Subscription and billing information: plan, billing contact, transaction records, and payment status. Payment card details may be processed directly by a payment provider rather than stored by us.
• Technical and usage information: IP address, browser and device type, operating system, pages and features used, timestamps, referring pages, aggregate website analytics, page-performance measurements, request and error logs, and security diagnostics.
• Support and feedback: support requests, issue details, attachments, product feedback, and correspondence.

If information is optional, we will generally indicate that at the point of collection. If required information is not provided, we may be unable to create an account, operate a requested feature, investigate a report, or respond to an enquiry.

3. How we collect information

We collect information:

• directly from you when you contact us, create or manage an account, configure a form, or request support;
• from respondents when they complete a form or use document verification;
• from our customers when they invite team members, configure integrations, or provide information about respondents;
• automatically through server logs, cookies, browser storage, and security or diagnostic tools; and
• from service providers such as payment, identity, security, support, and infrastructure providers.

If you provide personal information about another person, you are responsible for having authority to provide it and, where required, telling that person about this policy.

4. How and why we use information

We may use personal information to:

• provide, administer, maintain, and improve PDF Form Craft;
• create accounts, authenticate users, and manage access and subscriptions;
• store PDFs, publish online forms, process submissions, create completed documents, and provide verification;
• respond to enquiries, support requests, privacy requests, and abuse reports;
• send service, security, billing, and administrative communications;
• monitor reliability, diagnose errors, prevent fraud or misuse, and protect users and the service;
• enforce our terms, establish or defend legal claims, and comply with legal obligations; and
• perform analysis using aggregated or de-identified information where practical.

Where privacy law requires a legal basis, processing may be necessary to perform a contract, take requested pre-contractual steps, comply with law, pursue legitimate interests such as security and service improvement, or act with consent. Consent may be withdrawn where processing depends on it, without affecting earlier lawful processing.

If we send direct marketing, we will do so only where permitted and will provide a way to unsubscribe. Opting out of marketing does not prevent essential account, service, billing, or security messages.

5. Sharing and disclosure

We may disclose personal information to:

• authorised staff and contractors who need it to operate or support the service;
• cloud hosting, storage, content delivery, security, monitoring, email, support, billing, and payment providers;
• a customer that created the form through which a respondent supplied information;
• professional advisers, insurers, auditors, and legal representatives;
• regulators, courts, law enforcement, or other parties where required or authorised by law; and
• participants in a merger, financing, reorganisation, sale, or transfer of all or part of the business, subject to appropriate confidentiality arrangements.

We do not sell personal information or customer form-response data. Service providers are authorised to process information only for the services they provide to us, subject to their contracts and applicable law.

6. Overseas processing

PDF Form Craft is based in Australia and uses service providers that may process information in other countries. Depending on the provider and service configuration, these locations may include Australia, the United States, and countries in the European Union or European Economic Area.

We take reasonable steps appropriate to the circumstances to protect personal information disclosed overseas. Privacy and enforcement rights may differ in another country. You can contact us for further information about current provider locations relevant to your information.

7. Customer forms and respondent information

Customers decide what their forms ask, why information is collected, who can access responses, and how those responses are used. For that information, the customer will commonly be the organisation responsible for the collection and PDF Form Craft will process the information to provide the service.

Customers must provide respondents with any collection notice required by law, collect only information reasonably needed for their purpose, configure access appropriately, and respond to requests relating to their use of form data. Respondents should first contact the organisation identified on the form about its collection or use of their answers. We will assist customers with verified privacy requests where reasonably required.

8. Sensitive information and children

PDF Form Craft is a general-purpose form service. Customers may configure forms that request health information, financial details, membership or association information, or other sensitive information. Customers should not request sensitive information unless it is necessary, lawful, appropriately secured, and collected with any consent or notice required by law.

The service is not directed to children acting independently. If a customer uses a form to collect information about a child, that customer is responsible for obtaining any necessary parent or guardian authority and providing an age-appropriate privacy notice.

9. Retention and deletion

We retain personal information only for as long as reasonably needed for the purpose for which it was collected, to provide the service, maintain security and audit records, resolve disputes, or meet legal, accounting, and contractual obligations.

• Account and organisation information is generally retained while the account is active and for a reasonable period afterwards.
• PDFs, forms, submissions, and completed documents are retained according to customer settings, subscription terms, and legal requirements.
• Enquiries and abuse reports are retained as needed to respond, investigate, keep appropriate records, and protect the service.
• Security, access, and diagnostic logs are retained for periods appropriate to operational and security needs.
• Billing and transaction records may be retained for legally required accounting and tax periods.

When information is no longer required, we take reasonable steps to delete or de-identify it. Residual copies may remain temporarily in protected backups until those backups are overwritten or expire.

10. Security and data breaches

We use administrative, technical, and organisational safeguards designed to protect personal information from misuse, interference, loss, unauthorised access, modification, and disclosure. Measures may include access controls, multi-factor authentication, encryption in transit, monitoring, logging, backups, staff or contractor confidentiality obligations, and incident response procedures.

No internet service can guarantee absolute security. If we become aware of a suspected breach, we will investigate, contain, assess, and respond to it. We will notify affected individuals and regulators where required, including under Australia's Notifiable Data Breaches scheme where applicable.

11. Cookies and similar technologies

The public website and application may use cookies, local storage, session storage, and similar technologies to deliver pages, maintain sessions, remember preferences, authenticate users, prevent abuse, protect forms, and diagnose service issues. Hosting and security providers may also process IP addresses and request information in server or security logs.

The public website uses Cloudflare Web Analytics to measure aggregate page views and website performance. The Cloudflare beacon is configured without analytics cookies or browser storage and is not used by us for behavioural advertising, advertising profiles, or cross-site tracking. Cloudflare states that Web Analytics does not collect or use visitors' personal data. Cloudflare processes the measurements as our analytics provider.

You can control cookies and browser storage through your browser, although blocking technologies needed for authentication or security may prevent parts of the service from working. See the Cookie Policy for details of our current analytics and browser-storage approach.

12. Your rights and choices

Depending on applicable law, you may have the right to:

• ask whether we hold personal information about you and request access to it;
• ask us to correct inaccurate, incomplete, or out-of-date information;
• request deletion or restriction of processing in applicable circumstances;
• object to certain processing, including direct marketing;
• withdraw consent where processing relies on consent; and
• request a portable copy of information where applicable.

We may need to verify your identity and request before acting. We may refuse or limit a request where authorised by law and will explain the reason where required. Access may also be limited where it would unreasonably affect another person's privacy.

For information submitted to a customer's form, the customer is usually the appropriate first contact. If you contact us, provide the form URL and enough detail to identify the relevant submission without sending unnecessary sensitive information.

13. Privacy complaints

Use the contact pageand select “Policy issue” as the enquiry type. Describe the issue, relevant dates, and the outcome you are seeking. We will acknowledge the complaint, investigate it, and aim to provide a response within 30 days. We will tell you if additional time is reasonably required.

If you are not satisfied with our response, you may be able to complain to the Office of the Australian Information Commissioner or the privacy regulator in your jurisdiction.

14. Changes to this policy

We may update this policy when our services, providers, information-handling practices, or legal obligations change. The updated version will be published on this page with a revised date. If a change is material, we may also provide notice through the service or by email where appropriate.

15. Contact us