Privacy Policy

tuyaform ("we", "us") operates tuyaform.com, a free online form builder and e-signature service. This policy covers our marketing site, the app, and the public signing pages we host on your behalf.

We are the data controller for account and visitor data. When you send a document to be signed, you are the controller of your signers' data and we process it as your service provider.

tuyaform.com is operated by HiveDevOps Technology Sociedad de Responsabilidad Limitada (S.R.L.), based in San José, Costa Rica, which is the data controller under the GDPR for account and visitor data. To exercise your rights or ask about this policy, contact us using the details under "Questions about your privacy?" below.

When you send a document to be signed, you are the data controller for your signers' personal data and tuyaform acts as your processor, handling that data only on your instructions.

Account information: your email address, provided when you sign in. We use passwordless magic links, so we never collect or store a password.

Documents and signatures: the files you upload, the forms you build, the fields you place, and the signatures, names, and responses your recipients submit.

Signer information: when someone signs a document you sent, we record their name, email, signature image, the time of each action, and their IP address and user agent. This audit trail is what makes the resulting PDF legally defensible.

Usage analytics: aggregate, privacy-friendly metrics — pages visited, referrers, broad device and country information, and performance timings — measured through Vercel Web Analytics and Speed Insights. These are collected without cookies and without cross-site tracking, and are not linked to your identity (see "Analytics" below).

Cookies and similar technologies: a small number of first-party cookies for sign-in sessions, security (CSRF protection), and your language preference, plus Google AdSense advertising cookies that load only after you consent (see below).

To provide the service: build forms, deliver documents, collect signatures, and generate the Certificate of Completion and audit trail.

To communicate with you: transactional emails such as sign requests, reminders, and completion notices, sent through our email provider.

To keep the service safe: detect abuse, prevent fraud, enforce rate limits, and protect signer access.

To improve the product and to show ads that keep tuyaform free.

tuyaform is free because it is ad-supported. We display ads on our marketing pages, including through Google AdSense and similar partners.

These partners may use cookies and device identifiers to show and measure ads. We do not control their cookies; you can manage personalized advertising through Google Ads Settings and tools like youradchoices.com or your browser settings.

We do not show third-party ads on the private signing pages a recipient uses to sign your documents.

To understand which pages are useful and to keep tuyaform fast, we use Vercel Web Analytics and Vercel Speed Insights. They are privacy-friendly by design: they set no cookies, do not track you across sites, and do not build a profile of you.

They report only aggregate metrics — such as page views, referrers, broad device and country information, and performance timings — and we do not link this analytics data to your name, email, or account. We use it only in aggregate to improve the product, never to identify you or to advertise to you.

We do not sell your personal information.

We share data with the service providers that run tuyaform: Supabase (database, authentication, and file storage), Resend (transactional email), Vercel (hosting), and Polar (payments and subscription billing for paid plans). They process data only on our instructions.

We share advertising data with ad partners as described above.

We may disclose information if required by law, to respond to legal process, or to protect the rights, safety, and security of our users and the service.

We keep documents, signatures, and audit records for as long as your account is active so that completed agreements remain available and verifiable.

You can delete documents from your dashboard. To delete your account, contact us; we then remove your personal data within a reasonable period, except where we must retain records to comply with legal obligations or resolve disputes.

Data is encrypted in transit and at rest. Access to signed documents is controlled by high-entropy, expiring access tokens, and signer actions run through hardened, audited database functions.

No system is perfectly secure, but we work to protect your data and to limit access to it. See our Security page for more detail.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Residents of the EEA/UK (GDPR) and California (CCPA/CPRA) have these rights.

You can exercise some of these rights directly in your dashboard — for example deleting documents and exporting your response data — and the rest (access, correction, account deletion, objection) by contacting us. We will not discriminate against you for exercising your rights.

If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection (supervisory) authority.

Our providers may process data in the United States and other countries. Where required, we rely on appropriate safeguards such as standard contractual clauses for international transfers.

tuyaform is not intended for children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy as the service evolves. We will revise the "last updated" date above, and for material changes we will provide a more prominent notice.