PRIVACY POLICY

1. Our Absolute Commitment to Student Privacy (K-12 Disclaimer)

FormsVault is strictly a business-to-business (B2B) professional productivity tool. Our software is not directed at, marketed to, or intended for use by children or K-12 students under the age of eighteen (18). We do not knowingly collect, request, or maintain student profiles or student Personally Identifiable Information (PII).

If you choose to distribute forms or quizzes to a minor audience, or use our tools in an educational environment, you do so entirely independently. You assume sole responsibility for securing any necessary parental or institutional consents required by your local laws.

2. Google OAuth Permissions & Restrictive Security

To create, format, and synchronize forms directly inside your Google Workspace™, the Add-on requests access to your Google account via standard OAuth protocols.

• Least-Privileged Access: We intentionally restrict our platform to the highly secure https://www.googleapis.com/auth/drive.file OAuth scope. This means FormsVault cannot see, read, modify, or delete your personal files, corporate documents, or any other pre-existing data inside your Google Drive™.
• Strict Isolation: Our access is strictly limited to files that are explicitly created by the FormsVault Add-on, or documents you intentionally open using our tool. You retain absolute permission control within your native Google Account settings.

3. The Information We Process

We keep our data footprint as small as possible. The data we interact with falls into two distinct categories:

3.1 Account and Subscriber Data (Information You Provide)

• Account Setup & Zero-Trust Authentication: When you link your Google Account via Single Sign-On (SSO), we establish a secure, zero-trust access framework. We use Google Workspace SSO exclusively for authentication. We do not create, store, or manage user passwords on our systems. We receive only basic administrative details such as your name, email address, and language preferences to authenticate your profile.
• Secure Billing: All financial transactions are managed directly by our official global Merchant of Record, LemonSqueezy.com. They handle your payment cards, invoicing, fraud prevention, and localized international taxes. FormsVault receives confirmation of your payment status and subscription tier, but we never see, access, or store your raw credit card numbers or banking credentials.

3.2 Ephemeral Execution Data (In-Memory Only)

To build your forms and generate analytical insights, our system briefly processes the reference materials and response sheets you point the app toward:

• AI Model Inputs: Text targets, document uploads (like reference PDFs up to 20MB), or website URLs that you paste into our console to anchor your AI form generation.
• Analytics Fields & Refresh Processing: When you initiate our Quiz Insights or Form Insights modules—or whenever you manually click "Refresh" to update your dashboard with incoming background response metrics—the Add-on executes a temporary, short-term read call over the live rows of your linked Google Forms™ responses or linked Google Sheets data.
• Interaction Tracking: When using our AI Quiz Monitor, the Add-on monitors context-based, browser-level Document Object Model (DOM) signals (such as tab switches or full-screen status changes) inside the respondent's window frame. FormsVault never records, streams, or requests permissions for your respondents’ physical hardware, webcams, or microphones.

4. Our Data Protection Model: Zero Persistent Server Storage

FormsVault does not maintain a persistent database of your operational business content or respondent answers

• In-Memory Operations: Your uploaded reference materials, form text strings, participant responses, and browser event signals are processed strictly in-memory using secure Google Gemini APIs on Google Cloud.
• Immediate Post-Execution Erasure: Each individual processing run, whether executed during initial report generation or triggered later via a subsequent user "Refresh" instruction, treats your data metrics as ephemeral inputs. The parsed values are processed strictly within volatile active server memory (RAM) and are permanently dropped and completely scrubbed the exact second the updated analytical view is rendered back to your interface.
• No AI Training: Your proprietary business text, prompts, curriculum data, and participant responses are strictly confidential. They are never cached on our servers and are never used to train public machine learning or artificial intelligence models.

5. Storage Ownership: Your Individual Google Drive™

Because we utilize the drive.file scope, all output forms, surveys, testing templates, and analytics summaries generated by our extension are written and synchronized directly to your personal or corporate Google Drive™ account . FormsVault does not provide or use third-party cloud storage. Storage management, backup file recovery, user sharing configurations, and data deletion parameters remain governed entirely by you within your own secure Google ecosystem.

6. Enterprise-Grade Encryption & Infrastructure

To ensure the highest industry standards of platform privacy, protection, and compliance, our infrastructure implements multiple layers of security:

• Encryption Standards: All administrative data is secured using AES-256 encryption at rest and TLS 1.3 encryption in transit, protecting your data from unauthorized access.
• Google Cloud Infrastructure: Our application is deployed entirely on Google Cloud, utilizing SOC 2 compliant data centers that feature built-in multi-region redundancy, automatic scaling, and a 99.9% uptime Service Level Agreement (SLA).

7. How We Use and Share Your Information

We use your basic administrative account data strictly for clear, business-focused reasons:

• To log you into your Add-on workspace environment securely.
• To manage, allocate, and adjust your FormsVault AI Credits.
• To send essential updates, technical assistance replies, or mandatory account notifications (such as a 30-day advance notice of pricing modifications).

We do not sell, rent, trade, or lease your personal information to third parties. Data is shared only with our primary operational processing channels: Google Cloud Platform / Gemini APIs (for secure in-memory generation) and Lemon Squeezy (for payment management).

8. Global Compliance & Your Privacy Rights

FormsVault follows global data protection baselines across our primary target markets, including the US CAN-SPAM Act, the UK/EU General Data Protection Regulation (GDPR), the Australian Privacy Act, and the Singapore Personal Data Protection Act (PDPA).

You possess clear, understandable rights regarding your personal administrative Account Data:

• Access & Correction: You can request a summary of the basic account details we hold for you or update your profile information at any time.
• Account Deletion: You can request that we permanently delete your user profile information from our authentication logs. Please note that deleting your profile will immediately cancel your active subscription and delete any remaining FormsVault AI Credits.

9. Updates to This Policy

We may occasionally update this Privacy Policy to reflect app performance upgrades or changes in global privacy rules. When we make updates, we will change the "Last Updated" date at the very top of this page. We suggest checking this page from time to time to stay informed.

10. Contact and Compliance

For enquiries regarding this Privacy Policy or our data practices, please contact our Data Protection Officer.

Data Protection Officer

Preethkaran Jayaraj

SALESVAULT TECHNOLOGIES PTE. LTD.

160 Robinson Road, #14-04, Singapore Business Federation Center

Singapore, 068914

Email: info@formsvault.ai