Privacy policy

This explains what Fillfront collects, why, how long it stays, and who else it reaches. It is written to be read rather than to be survived.

Last updated: 9 October 2026.

Who is responsible

This site is operated by FillFront, a sole trader established in France, who is the data controller for the personal data described here. For anything in this policy, including a request to see or delete your data, click the questions bubble on the homepage and ask — it reaches us directly.

What is collected

Documents you upload. When you turn a PDF into a form, that file is stored so the form can be shown and completed copies produced. Whatever the document contains is up to you, and it is worth reading the terms before uploading anything sensitive.

Answers people submit. When someone fills in a form, their answers are stored and drawn onto a copy of the original PDF for the person who created the form. Nobody needs an account to fill one in, and none is created for them.

Your email address, if you give one. Creating an account or asking for a link back to a form records the address so that link can be sent.

Usage data. Each visit records an anonymous identifier, the page or action, the IP address, the country derived from it, the referring site, and any campaign tags in the link. This is what shows which pages are worth keeping.

How long it is kept

Raw IP addresses are erased from usage records after 30 days. The country and referrer stay; the address itself, which is the part that identifies a person, does not.

Cached completed PDFs are deleted after 90 days. The submitted answers remain, so the document can be regenerated on request — it is the stored copy that goes, not the response.

Deleted forms are removed permanently 72 hours after you delete them, together with their PDFs, thumbnails and completed copies. The delay exists so an accidental deletion can be undone.

Files uploaded only to the fillable PDF checker are deleted within the hour, whether or not you go on to build anything. They are examined and discarded.

Who else sees it

Your documents are not sold, and they are not used to train anything.

Hotjar and Clicky receive usage data — pages viewed and how the interface is used — so the site can be improved. They are kept off the form builder, your submissions, the pages your recipients fill in, and the sign-in and account pages, so they do not receive your documents, your private links or the answers submitted to your forms.

Anthropic receives a document only when someone presses the Detect fields button by hand. The detection that runs automatically on every upload works entirely on our own server and never sends the file anywhere. The manual button is currently restricted to us rather than offered to visitors, so this happens when we are working on a form or investigating a problem, never as part of an ordinary upload. Anthropic processes the file in the United States and does not use it to train models.

Google receives your email address, name and Google account id only if you choose "Continue with Google" to sign in. We store the id to recognise the same account next time; nothing is shared with Google beyond the sign-in itself.

Stripe handles payment for the paid plan. Your name, email address and card details go to Stripe, not to us — we never see or store a card number. What we keep is the amount, the currency, the date and Stripe's own reference ids, which is what lets us match a payment to a form and issue a refund. Stripe emails your receipt.

Resend delivers the emails the site sends: sign-in and confirmation links, and the notification a form's creator gets when someone submits it. That notification contains the submitted answers, so Resend handles them in transit.

ipinfo.io, and freegeoip.app as a fallback, receive a visitor's IP address to work out which country it is in. Nothing else is sent with it, and the request is encrypted.

The files themselves and the database are stored on our own server. Once a night a backup copy of both — including the answers submitted to forms — is sent to DigitalOcean Spaces in Amsterdam, so the service can be restored if the server fails. Each backup is deleted after 10 days.

Why it is allowed

Storing your documents, your forms and the answers submitted to them is necessary to provide the service you asked for. Usage data is collected on the basis of legitimate interests: knowing which pages work is what keeps a free tool worth running. You can object to that, and the section below says how.

Your rights

If you are in the EU or the UK, you can ask for a copy of your personal data, ask for it to be corrected or erased, ask for its use to be restricted, object to processing based on legitimate interests, or ask for it in a portable form. Ask through the questions bubble on the homepage and expect a reply within a month.

If you think this has been handled badly, you can complain to a supervisory authority. Ours is the CNIL in France; you may also complain to the authority for the country you live in.

Cookies

A session cookie keeps you attached to your own forms while you work, and is required for the site to function. Hotjar and Clicky set their own cookies for the usage measurement described above. There are no advertising cookies.

Changes

If this policy changes in a way that affects what happens to your data, the date at the top will change with it.