SmartForm is provided by Black Tree Market OÜ, registry code 17213258, Punane tn 23-193, 13611 Tallinn, Estonia. This policy explains how we process personal data when you use our service.
Our role
We are the controller for account information, subscription administration and the operation and security of SmartForm. For answers, contact information, files and other personal data collected through a customer’s forms, the workspace customer is the controller and we act as their processor on their instructions. Contact the business that owns a form about its use of your submission.
Information we process
Account data includes your name, email address, password hash, authentication sessions and email verification status. If you choose Google sign-in, we receive the identity information needed to authenticate you. Workspace records include membership, permissions, configuration, billing status and audit events. Forms may collect the information their owner requests, including uploaded files.
We also process necessary operational information such as request logs, IP addresses, browser information, errors and security events. We do not ask form visitors to provide payment card details to SmartForm. Payments are handled by the configured payment provider.
Purposes and legal bases
We process account and workspace information to perform our contract, administer subscriptions and provide requested support. We retain billing records to meet legal obligations. Necessary security, abuse prevention and service reliability processing is based on our legitimate interests. Where optional processing requires consent, we request it separately and let you withdraw it.
Cookies
We use essential session and anti-forgery cookies to keep you signed in and protect requests. A workspace preference may be stored locally in your browser. These are necessary for the requested functionality. We do not treat a form submission as consent to marketing.
AI assistance
When you request AI assistance, your prompt and relevant form configuration are sent to our AI provider to produce the requested changes. Connection secrets are not included in the model context. Do not include unnecessary customer personal data in prompts.
Service providers and transfers
We use infrastructure, email, AI and payment providers to operate SmartForm. They may process information only for the services they provide under applicable agreements. Where information is transferred outside the EEA, we use an applicable adequacy decision or appropriate safeguards, including standard contractual clauses where required. Ask us for information relevant to your workspace’s processing arrangements.
Retention and deletion
Workspace owners choose submission retention settings and can delete records and workspaces. Account, audit, security and billing records are retained only as needed for the stated purposes, dispute handling and legal duties. Deleted data may remain in restricted backups until those backups expire. Deleting data from SmartForm does not delete copies already exported or delivered to third parties.
Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, portability or object to processing. You can withdraw consent where processing relies on it. To exercise account rights, contact Black Tree Market OÜ at the registered address above, identifying your account without sending your password. We may need to verify your identity. You can also complain to the Estonian Data Protection Inspectorate or your local supervisory authority.
Security and updates
We apply access controls, tenant isolation, secure password storage and other technical and organisational measures to protect data. No service can guarantee absolute security. We may update this policy as the service changes; material changes will be communicated through the service where appropriate.