Privacy Policy

1. Introduction

IntakeForge ("we," "us," or "our") operates the IntakeForge web application available at intakeforge.app. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service. Please read this policy carefully. By using IntakeForge, you agree to the practices described here.

2. Information We Collect

2a. Information You Provide

• Form prompts and descriptions you enter to generate intake forms
• Edits, customizations, and content within your form drafts
• Template names and organizational preferences

2b. Information from Google

When you connect your Google account, we receive and store:

• Your Google account name, email address, and profile picture (for account identification)
• OAuth access and refresh tokens (to act on your behalf when creating forms and sheets)
• Google user ID (sub) to uniquely identify your account

2c. Usage and Technical Data

• Server logs including IP address, browser type, pages visited, and timestamps
• Error logs for debugging and service improvement
• Payment information processed by Stripe (we do not store card numbers)

3. How We Use Google User Data

Our use of data received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

We use Google user data only to:

• Google Forms API: Create intake forms in your Google Drive on your behalf
• Google Sheets API: Create linked response spreadsheets in your Google Drive on your behalf
• Google Drive API: Manage file permissions for forms and sheets we create for you
• Google userinfo: Identify your account and display your name and photo in the app

We do not: sell your Google data, use it for advertising, share it with third parties for their independent use, or use it for any purpose other than providing IntakeForge features directly to you.

4. How We Use Your Information

• To provide, operate, and improve the IntakeForge service
• To authenticate your identity and maintain your account
• To generate AI-powered intake forms based on your prompts
• To publish forms and response sheets to your Google account
• To process subscription payments through Stripe
• To send transactional emails related to your account (billing receipts, service notices)
• To analyze aggregate usage patterns to improve our service
• To detect and prevent fraud, abuse, and security incidents
• To comply with legal obligations

5. Data Sharing and Disclosure

We do not sell your personal information. We may share your information with:

• Google LLC — via the Google Forms, Sheets, Drive, and OAuth APIs to deliver core features
• Stripe Inc. — to process subscription payments securely
• Anthropic PBC — form prompts are sent to Claude AI for form generation (no personal account data is sent)
• Google Cloud Platform — our backend infrastructure provider
• Vercel Inc. — our frontend hosting provider
• Law enforcement or government authorities — when required by law, court order, or to protect the rights, property, or safety of IntakeForge, our users, or the public
• Successor entities — in connection with a merger, acquisition, or sale of assets, with notice provided to affected users

6. Data Retention

• Form drafts and templates are retained until you delete them or request account deletion
• Google OAuth tokens are retained while your account is active and deleted upon account deletion
• Server logs are retained for up to 90 days for security and debugging purposes
• Billing records are retained as required by applicable law (typically 7 years)

7. Security

We implement industry-standard security measures including:

• TLS/HTTPS encryption for all data in transit
• JWT-based authentication with 30-day expiration
• OAuth tokens stored encrypted at rest
• Google Cloud infrastructure with built-in DDoS protection
• No storage of payment card data (handled entirely by Stripe)
• Principle of least privilege — we request only the Google API scopes necessary

Despite these measures, no system is 100% secure. We cannot guarantee absolute security of your data.

8. Your Rights and Choices

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your account and associated data
• Revoke Google access: Visit myaccount.google.com/permissions to revoke IntakeForge's access to your Google account at any time
• Data portability: Request an export of your form drafts and account data
• Opt out of AI generation: Use the rule-based form generator by contacting us

To exercise these rights, email contact@intakeforge.com. We will respond within 30 days.

9. Children's Privacy

IntakeForge is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn we have collected such information, we will delete it promptly.

10. International Data Transfers

Your information may be transferred to and processed in the United States and other countries where our service providers operate. By using IntakeForge, you consent to such transfers. We ensure appropriate safeguards are in place in accordance with applicable law.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page with an updated date, and where appropriate, by email. Your continued use of IntakeForge after changes constitutes acceptance.

12. Contact Us

For privacy questions, data requests, or concerns:

• Email: contact@intakeforge.com
• Website: intakeforge.app