Privacy policy
Effective 19 October 2026
FormDrop (https://formdrop.wouldairecommend.workers.dev) is run by SupaDesign, operated by Darren Buckley, a sole trader based in Cobh, Co. Cork, Ireland ("we", "us"). We are the data controller for account data. This policy explains what we collect, why, and your rights under the GDPR.
What we collect
- Account data: your email address, plan and form settings.
- Form submissions sent to your forms by your site visitors. You are the controller of that data and we process it on your behalf (see "Data processing" in the Terms).
- Abuse-prevention data: a one-way hash of the submitter IP address (kept 24 hours) for rate limiting; we do not store raw IP addresses with submissions.
We do not sell personal data, we do not run advertising trackers, and our page analytics are aggregate counters (page path, day, referring site) with no cookies, no IP storage and no fingerprinting.
Why we use it (legal bases)
- To provide the service you signed up for (contract, Art. 6(1)(b) GDPR).
- To keep it secure and prevent abuse, e.g. rate limits and spam filtering (legitimate interests, Art. 6(1)(f)).
- To bill paid plans and keep tax records (contract and legal obligation, Art. 6(1)(b) and (c)).
- Service emails such as sign-in links, alerts you configured and billing notices (contract). We do not send marketing email without your opt-in.
Who processes data for us
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, database (D1, EU jurisdiction), content delivery, DDoS protection | Data stored in the EU; served from Cloudflare edge worldwide |
| Stripe Payments Europe, Ltd. | Card payments and invoices for paid plans (we never see card numbers) | Ireland / United States |
| Resend, Inc. (only once email is switched on) | Sending sign-in links and notification emails | United States |
| Cloudflare Workers AI | Spam classification of submission text (not used for training) | Cloudflare network |
Where a provider processes data outside the EEA, transfers rely on the EU-U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.
How long we keep it
- Submissions: per your plan history (30 days free, 1 year Pro, unlimited Business) or until you delete them.
- Spam: 30 days.
- Submissions received after your monthly limit (including grace): held for 7 days, hidden until you upgrade, then deleted automatically.
- Account data: until you delete your account.
- Billing records: 6 years (Irish tax law).
Cookies
We set one strictly necessary cookie when you sign in (a session identifier, 30 days). No consent banner is needed because we use no analytics or advertising cookies.
Your rights
You can access, correct, export or delete your data, object to processing, or restrict it. Most of this is self-serve in the app (export and delete account); otherwise email hello@wouldairecommend.com and we will reply within 30 days. You can also complain to the Data Protection Commission (Ireland), dataprotection.ie, or your local authority.
Changes
We will post changes here and, for material changes, email account holders at least 30 days before they apply.
Contact
SupaDesign, operated by Darren Buckley, Cobh, Co. Cork, Ireland · hello@wouldairecommend.com