This Privacy Policy explains how we collect, use, share, and protect personal data when you use Auto Form CRM, Auto Form Builder, the AIDA AI service, and the autoformcrm.com website and account area. We are committed to handling your data lawfully and transparently under the EU General Data Protection Regulation (GDPR).

1. Who We Are

The data controller is V.O.F. Amora Digital, a partnership registered in the Netherlands (KVK no. 99536811). For any privacy question or to exercise your rights, contact us at [email protected].

2. What We Collect

Depending on how you use the Services, we process:

Account data — your name, email address, and a securely hashed password (we never store passwords in plain text).
Billing data — payments are handled by Stripe. We do not store your card number; we keep order and transaction records (such as amounts, currency, plan or credit pack purchased, and payment status).
License & site data — license activations and the URLs of WordPress sites you connect to your account.
AI usage data — your AIDA credit balance and a usage ledger recording, per request, metadata such as the feature used, the AI tier, and token counts. This ledger supports metering, billing, and abuse prevention.
Content submitted for AI processing — when you use an AI feature, the content you provide is sent to our servers and forwarded to our AI provider to generate the result. This can include form descriptions, uploaded documents or images, form submission content, and chat messages. This content is processed solely to provide the AI feature you requested. Per our arrangement with our AI provider, this content is not used to train their models and not used for advertising.
Website & device basics — essential cookies for session and authentication, plus the analytics and advertising technologies described below.

Cookies, analytics & advertising. Our website uses essential cookies needed for it to function (for example to keep you signed in). It also loads analytics and advertising/measurement technologies that may set cookies or similar identifiers, namely: Google Analytics and Google Ads (analytics and conversion measurement), Umami and Contentsquare (website analytics and usage insights), and the Meta (Facebook) pixel, X (Twitter) pixel, and Reddit pixel (advertising and conversion measurement). When you complete a purchase we may also send a server-side conversion event to Reddit to measure ad performance. We do not sell your personal data.

3. Why We Process Data

We rely on the following legal bases under the GDPR:

Performance of a contract — to create and manage your account, deliver licenses and plugin updates, process AI requests, meter and bill AIDA credits, and provide support.
Legitimate interests — to secure the Services, prevent fraud and abuse, and understand and improve how the Services are used, balanced against your rights.
Consent — for non-essential analytics and advertising technologies where consent is required, and for optional marketing communications. You can withdraw consent at any time.
Legal obligation — to meet accounting, tax, and other legal requirements.

We do not sell your personal data. We share it only with service providers (“processors”) who process it on our behalf under appropriate agreements:

Stripe — payment processing.
Anthropic — AI processing that powers AIDA features.
Mailgun — sending transactional and account emails.
Hosting & infrastructure providers — to run our servers and store data.
The analytics and advertising providers listed in Section 2.

We may also disclose data where required by law or to protect our rights, users, or the Services.

5. Retention

Account data is retained while your account is active and for a reasonable period afterwards, unless you ask us to delete it sooner.
Order, transaction, and credit-ledger records are retained as long as needed to meet accounting and tax obligations.
Content submitted for AI processing is used to produce your result and is not retained longer than necessary to provide the feature. The AI usage ledger stores metadata (feature, tier, token counts) — not the content of your prompts, documents, or submissions.

6. International Transfers

Some of our processors — including Anthropic and Stripe — may process data in the United States or other countries outside the European Economic Area. Where data is transferred internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) to protect it.

7. Your Rights

Under the GDPR you have the right to:

access the personal data we hold about you;
request correction of inaccurate or incomplete data;
request erasure of your data;
receive your data in a portable format;
object to or restrict certain processing, and withdraw consent at any time.

To exercise any of these rights, contact [email protected]. You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or the supervisory authority in your country of residence.

8. Security

We use industry-standard measures to protect your data, including encryption in transit (TLS/HTTPS), hashing of account passwords, and encryption at rest of sensitive secrets such as plugin connection tokens. No method of transmission or storage is completely secure, but we work to protect your information and continually improve our safeguards.

9. Children

The Services are not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, please contact us so we can remove it.

10. Changes & Contact

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you. For any privacy question, contact [email protected].

Privacy Policy