Privacy Policy
In plain language
- We do not run analytics, advertising or tracking cookies. There is one cookie, and it only keeps you logged in.
- We do not log your IP address or your browser's user agent.
- We never sell your data, and we never use it to train AI models.
- If you fill in someone's form, they control that data, not us. Contact them first.
- When you use an AI feature, your request text is sent to a model provider. Section 6 lists exactly who.
This summary is for orientation only. The detailed sections below are the operative policy.
1. Who this covers
This policy explains how [LEGAL ENTITY NAME] ([UEN / REGISTRATION NUMBER]), operator of AdvanceForm, handles personal data.
It covers two different groups of people, whose situations are genuinely different. Please read the part that applies to you.
2. Two roles, two policies
Most privacy policies blur this. It matters, so we will be explicit.
| If you are… | Then… | Read |
|---|---|---|
| An account holder: you log in and build forms | We are the controller of your account data. We decide how it is handled, and this policy governs it. | Part A |
| A respondent: you filled in someone's form | The form owner is the controller. We are their intermediary and only act on their instructions. Their privacy practices govern your data, not ours. | Part B |
3. Part A: if you hold an account
What we collect
- Account details: your username, your email address if one was supplied, your role, your plan and billing cycle, your AI credit balance, your language preference, and the date the account was created.
- Authentication: a cryptographic hash of your password. We never store the password itself and cannot recover it. If you sign in with Google, we store the email address and profile name Google returns, and no password at all.
- What you build: your events, form fields, configuration and settings.
- Correspondence: emails you send us, for example to arrange a plan or request a credit top-up.
What we do not collect
We do not log IP addresses or user-agent strings. We do not use analytics, tag managers, session recording, heat-mapping, advertising pixels or any third-party tracking. There is no behavioural profiling. We do not buy or receive personal data about you from data brokers.
Why we use it
- To provide the Service, authenticate you and keep your session active.
- To operate plans and AI credit balances.
- To reply to you, and to send service-related notices such as material changes to our terms.
- To keep the Service secure and to investigate misuse.
- To comply with law.
Under the PDPA we rely on your consent, given when you create an account and use the Service, and on the legitimate interests of operating and securing it. We do not send marketing email; if that ever changes, it will be opt-in and separately consented.
4. Part B: if you filled in a form
The organisation or person who published that form decides what it asks, why, and what happens to your answers. They are the data controller. We host it for them.
If you want to access, correct or delete your response, or you want to know why a question was asked, contact whoever gave you the form link. We generally cannot identify which form you filled in, and we will not alter or release another party's data without their instruction. If you reach us first, we will direct you to them.
What we hold on their behalf
Only the answers you submitted, and the date and time of submission. Your answers are stored as structured data keyed to the questions asked.
We do not attach your IP address, device fingerprint, location or any tracking identifier to your response. Filling in a form does not create an account for you and does not place any cookie in your browser.
Who can see it
Only the account that owns the form. This boundary is enforced on our servers, not merely hidden in the interface, and it applies to our administrators too. An administrator cannot read the responses belonging to another account's event. Administrators can see only account-level metadata, such as how many responses an event has received.
6. Who else processes data
We use a small number of sub-processors. This is the complete list.
| Provider | What it receives | When |
|---|---|---|
| Cloudflare, Inc. Hosting, edge network, Cloudflare D1 database |
All stored data and all traffic to the Service | Always |
| Google LLC Google Identity Services |
Your email address and profile name | Only if you choose to sign in with Google |
| Google LLC Generative Language API (Gemma models) |
The text of your AI request, see section 7 | Only when you use an AI feature |
| A self-hosted Gemma model operated by us, running on our own hardware. No third party receives your data in this case; it is processed by us, on infrastructure we control. | The text of your AI request, see section 7 | Only when you use an AI feature, and only if the provider above is unavailable |
We do not sell personal data. We do not share it with advertisers or data brokers. We may disclose data where we are legally required to, or to establish or defend legal claims.
If we add or replace a sub-processor, we will update this page and change the "last updated" date.
7. AI processing
AdvanceForm can draft forms, propose dashboard cards, suggest roster assignments and propose allocation plans. These features call a language model, which means text leaves our servers. We would rather be precise about this than reassuring.
What is sent
- Generating or editing a form: the brief you typed and the current structure of your form; question labels, types and options.
- Roster and summary assistance: the above, plus a capped, aggregated sample of real responses, so the suggestions reflect your actual data. The application shows a privacy notice at the point of use, before anything is sent.
Where it goes
To the two model providers listed in section 6: first Google's Generative Language API, and if that is unavailable, our own self-hosted model. No other provider receives it.
What does not happen
Your data is not used to train our models or, to the best of our knowledge and the terms under which we access them, the models of our providers. AI features are never invoked automatically, only when you press a generate button.
If your responses contain information you are not permitted to disclose to a processor, do not use the roster or summary AI features on that event. Every other part of the Service works without them.
8. Security
The measures we actually operate:
- All traffic is served over HTTPS. Data at rest in Cloudflare D1 is encrypted by Cloudflare.
- Passwords are stored only as salted, iterated hashes (PBKDF2 or bcrypt depending on deployment). Plain-text passwords are never stored, logged or recoverable.
- Session cookies are
HttpOnly,SecureandSameSite=Lax, and are cryptographically signed. - Event data is owner-scoped on the server. Access is checked on every request, not merely hidden in the interface.
- Quiz answer keys are stripped from the public form payload, so they cannot be recovered from the page source.
- We minimise by default: no IP logs, no user-agent logs, no analytics, no third-party scripts on public pages.
No system is perfectly secure, and we do not claim otherwise. If you believe you have found a vulnerability, please report it to zhengda@sohsimple.sg, we welcome good-faith reports and will not pursue researchers who disclose responsibly and do not access or destroy other people's data.
If a breach occurs that is likely to result in significant harm, we will notify affected account holders and the Personal Data Protection Commission as the PDPA requires. Where the data affected belongs to your respondents, we will notify you so that you can meet your own obligations as their controller.
9. Retention and deletion
How long we hold responses depends on your plan.
| Plan | Retention of responses |
|---|---|
| Free | We may delete responses older than 3 months. Treat the Free plan as suitable for running an event, not as an archive, export anything you need to keep. |
| Lite, Plus, Max | No scheduled expiry. Responses are retained for as long as your paid plan is active, until you delete them. |
Beyond the Free-plan limit above, we do not delete anything automatically. Your events and responses remain until you delete them or your account is deleted.
If a paid plan lapses back to Free, the 3-month limit begins to apply to that account. Export your data before downgrading or cancelling.
Deleting an event permanently deletes its questions and every response to it. Deleting an account permanently deletes every event it owns and everything within them. Both are irreversible, export first if you need the data.
Subject to the Free-plan limit above, retention is under your control, so you are responsible for deleting respondent data when you no longer have a reason to hold it. The PDPA requires personal data to be destroyed once the purpose for collecting it has ended and retention is no longer necessary for legal or business purposes. We provide the delete controls; deciding when to use them is your call.
Backups taken by our infrastructure provider may persist for a limited period after deletion before being overwritten in the ordinary course.
10. International transfers
AdvanceForm runs on Cloudflare's global edge network, so data may be processed at locations outside Singapore. AI requests are processed by the providers in section 6, which may also be outside Singapore.
Where we transfer personal data abroad, we take steps intended to ensure it receives protection comparable to that required under the PDPA, principally through our contractual arrangements with those providers.
11. Children
The Service is not directed at children, and account holders must be 18 or older.
A published form may legitimately collect data from minors; a school trip sign-up, for instance. Where it does, the form owner is responsible for obtaining parental or guardian consent where the law requires it. We have no visibility into who fills in a form and cannot obtain that consent for you.
12. Your rights
Account holders may ask us to access, correct or delete their account data, withdraw consent, or receive a copy of it. Most of this is available directly in the application; account settings, and CSV or Excel export of any event.
Respondents should contact the form owner, for the reasons set out in Part B.
To exercise a right, email zhengda@sohsimple.sg. We will respond within 30 days. We may need to verify your identity first. Withdrawing consent to processing that is necessary to operate your account effectively means closing the account.
If you are unsatisfied with our response, you may complain to Singapore's Personal Data Protection Commission.
13. Changes
We may update this policy. The "last updated" date changes when we do. For material changes we will give notice by email or in the application before they take effect.
This policy is offered in other languages for convenience; the English version governs in the event of any inconsistency.
14. Contact
Data protection enquiries: zhengda@sohsimple.sg
[LEGAL ENTITY NAME], [REGISTERED ADDRESS], Singapore.
Organisations needing contractual data-processing terms should see our Data Processing Addendum.