Acceptable Use Policy

• Do not make forms that pretend to come from a bank, an email or cloud provider, a government, or any other person or organisation you do not represent. Do not use their names, logos or look to make people trust your form.
• Do not ask for sign-in details for another service, such as an email or bank password, a one-time code or a recovery phrase.
• Do not run scams: fake prizes, advance-fee schemes, fake job offers or investment schemes, or anything else meant to trick people out of money or information.

• Payment cards and banking: full card numbers, security codes or online banking credentials. FlowyForm does not process payments and is not built to PCI DSS standards.
• Passwords for any account or system.
• Protected health information under HIPAA. We do not sign business associate agreements.
• Sensitive information without a lawful basis: government ID numbers, health, biometric or genetic data, information about sexual life, religion, political opinions or criminal records. Collect these only when the law allows, you truly need them, and respondents are told why. Your forms are your responsibility.

Forms, images, files and messages must not contain or link to:

• material that sexually exploits or endangers children, which we report to the authorities;
• threats, harassment, or content that promotes violence or hatred against people for who they are;
• malware, or links meant to install it;
• content that infringes someone’s copyright, trademark or other rights;
• sexually explicit material;
• the sale of illegal goods or services, or anything else illegal where you or your respondents are.

• Do not use notification or confirmation emails, or webhooks, to send messages people did not ask for. Confirmation emails go only to people who filled in your form and must relate to it.
• Do not add email addresses as notification recipients unless their owners agreed to receive them.
• Follow anti-spam laws such as Canada’s CASL and the US CAN-SPAM Act when you contact respondents later.

• Do not try to get into accounts, forms or systems you are not allowed to use, or to get around plan limits, rate limits or security controls.
• Do not load-test, scan or probe FlowyForm without our written permission. Do not flood forms with automated submissions, or point webhooks at systems you do not own.
• Do not interfere with other customers’ use of FlowyForm, or resell it without our agreement.

Found a security issue? Please tell us at help@flowyform.com before sharing it with anyone (see our Security page). We will not take action against good-faith research that follows that page.

If your form is aimed at children, or you know children will fill it in, you must follow the laws that protect them. For example, the US COPPA requires verifiable parental consent before collecting personal information from children under 13. Ask only what you need, and do not ask children for contact details unless a parent has agreed.

If a FlowyForm form looks like phishing, a scam, or breaks this policy, email help@flowyform.com with the subject “Abuse report” and the form’s link. Do not enter any more information into it. We look at reports quickly, and phishing reports first.

For copyright complaints, send the same address the work you own, where it appears and your contact details. We forward valid notices to the form owner, as Canada’s Copyright Act provides, and remove content where required.

Depending on how serious it is, we may warn you, unpublish a form, remove content, or suspend or close your account. For phishing, malware, child exploitation or other serious harm, we act immediately, without notice and without refund. We may share information with law enforcement where the law allows or requires. If you think we made a mistake, email us and a person will review it.