Controller: Cuppaform (“Cuppaform”, “we”) — trade name/brand.
Last updated: 17 October 2026 (Europe/Amsterdam)
Language: English (default)
1. Who we are
Cuppaform (trade name/brand, cuppaform.com) is an AI form builder: you describe a form and Cuppaform helps you build, share and manage it. Cuppaform is currently in a pre-launch phase (waitlist / early access). Cuppaform is the controller for the processing described in this Privacy Policy.
Privacy contact: via the contact page. Formal company details are available on request.
2. Roles under the GDPR
| Context | Who is controller? |
|---|---|
| The cuppaform.com website, the waitlist / early-access list, the contact form, and (once available) customer accounts, support and billing | Cuppaform (controller) |
| Personal data of respondents collected through forms that you (the customer) build and publish with Cuppaform, once the form builder is available | You (the customer) are controller; Cuppaform acts as processor. A data processing agreement (DPA / verwerkersovereenkomst) will be offered when the form builder launches |
This Privacy Policy mainly covers processing where Cuppaform is controller. If you filled in a form that someone else built with Cuppaform, please contact the organisation that published that form first; it decides how your answers are used.
3. What we process and why
3.1 Waitlist and early access
- Data: email address; chosen language (locale); the page where you signed up; a consent marker; and a timestamp
- Purpose: keep you informed about the launch of Cuppaform and invite you to early access
- Legal basis: consent (Art. 6(1)(a) GDPR). No waitlist emails are sent at this stage. You can withdraw consent and have your data removed at any time via the contact page, without affecting earlier lawful processing
- Where: stored in our own setup hosted on Cloudflare
3.2 Contact form
- Data: your email address and message, plus the chosen language (locale), the page you sent it from, a consent marker and a timestamp
- Purpose: answer your question or request
- Legal basis: legitimate interest in responding to enquiries (Art. 6(1)(f)) or steps prior to entering into a contract at your request (Art. 6(1)(b))
3.3 Email correspondence
- Data: email address, name, content of emails and attachments you send us
- Purpose: communicate with you about the waitlist, early access, support and other questions
- Legal basis: legitimate interest (Art. 6(1)(f)) and/or contract (Art. 6(1)(b))
- Note: our email on the cuppaform.com domain runs via Google Workspace
3.4 Accounts and the form builder (once available)
- Data: account details (name, email, organisation, login data), usage and configuration data, and — where paid plans are introduced — subscription and billing data
- Purpose: provide and secure the Cuppaform service, support, invoicing
- Legal basis: performance of contract (Art. 6(1)(b)); legal obligations (Art. 6(1)(c)) for fiscal records; legitimate interest in security and abuse prevention (Art. 6(1)(f))
- Before accounts, AI features or paid plans go live, we will update this Privacy Policy where needed, including any additional providers involved
3.5 Respondent data and prompts (as processor, once available)
- Data: answers that respondents submit in your forms, and the descriptions/prompts and content you enter to generate forms
- Purpose: host and operate the form builder for you
- Legal basis (your side): determined by you as controller; we process on your documented instructions (Art. 28 GDPR) under the DPA
3.6 Technical data and security
- Data: IP address, browser/user agent, timestamps and similar request data
- Purpose: deliver the website, protect it against abuse and attacks, and keep it running
- Legal basis: legitimate interest in a secure and working website (Art. 6(1)(f))
- Note: the website is hosted and delivered via Cloudflare
3.7 Cookies and local storage
We do not use tracking, advertising or analytics cookies.
We only use functional storage: your theme choice (for example light/dark) and your language choice are stored in your browser’s localStorage, so the site remembers your preferences. Both are strictly necessary for the functions you chose. This information stays on your device, is not used to track you, and no consent is required for it. You can delete it at any time by clearing your browser’s site data.
As part of security and delivery, Cloudflare may set strictly necessary security-related cookies. If we ever want to use non-essential cookies or analytics, we will ask for your consent first and update this policy.
4. Categories of data (summary)
- Identity and contact data (email address; name/organisation if provided)
- Waitlist / early-access data (sign-up date, consent)
- Contact form and email correspondence
- Technical / log data (IP, user agent, timestamps — as needed for security and operations)
- Functional preference (theme choice in localStorage, on your device)
- Once available: account data, and respondent data / prompts processed as your data under your controllership (see §2)
We do not intentionally collect special categories of personal data for our own purposes as controller. Please do not submit such data via the waitlist or contact form.
5. Retention
We retain personal data only for as long as needed for the purposes described in this policy and to meet applicable legal obligations. We also retain data as needed to handle deletion or other rights requests.
| Data | Approach |
|---|---|
| Waitlist / early access | Until you withdraw consent or unsubscribe, or until the waitlist / early-access phase ends and the data is no longer needed for that purpose |
| Contact form and email correspondence | For as long as needed to handle your request and for a reasonable follow-up / archive period |
| Accounts / billing (once available) | For the duration of the customer relationship and as long as required for legal / fiscal obligations |
| Respondent data / prompts (once available) | Per your instructions as controller and the DPA |
| Security / operational logs | For as long as needed for security, abuse prevention and operations |
| Theme choice (localStorage) | On your device until you clear it |
6. Recipients and processors
We engage the following providers as processors:
- Cloudflare — website hosting, CDN, security and storage of waitlist / early-access data
- Google (Google Workspace) — email on the cuppaform.com domain
- Authorities where legally required
- Professional advisers under confidentiality where reasonably needed
When accounts, AI features or paid plans go live, additional providers may be needed; we will update this list before that happens. The current list is available on request. We do not sell personal data.
7. International transfers
Cloudflare and Google are providers with group companies in the United States, so personal data may be processed outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we rely on appropriate safeguards as required by the GDPR, such as an adequacy decision (for example the EU-U.S. Data Privacy Framework where the provider is certified) and/or EU Standard Contractual Clauses (SCCs).
8. Your rights (GDPR)
Where Cuppaform is controller, you may request:
- Access, rectification, erasure
- Restriction of processing
- Data portability (where applicable)
- Objection to processing based on legitimate interest
- Withdrawal of consent (without affecting prior lawful processing)
- You may also lodge a complaint with the Dutch Autoriteit Persoonsgegevens (or your local EU supervisory authority)
Submit privacy requests via the contact page. We may ask you to confirm your identity.
For respondent data in forms built with Cuppaform, contact the organisation that published the form (the controller) first; we assist as processor.
9. Security
We apply appropriate technical and organisational measures, including access control, encryption in transit (HTTPS) and limiting access to those who need it. No measure is perfect; please report suspected incidents via the contact page.
10. Children
Cuppaform is intended for professionals, teams and businesses. The waitlist and the service are not directed at children, and we do not knowingly collect data from children under 16.
11. Changes
We may update this policy, for example when accounts, AI features or paid plans go live. Material changes will be announced on the site and/or by email where appropriate. The “Last updated” date changes on each revision.
12. Contact
Cuppaform
Privacy and other questions: via the contact page.