Privacy Policy

When you are invited to an account and sign in, we store your name, your email address, a hash of your password, and a session record so you stay signed in. We keep a log of invitations sent and accepted.

If you connect an advertising or calendar account, we store the access and refresh tokens that connection issues, encrypted. We never see or store the password to those accounts.

What a form asks for is set by the business that built it, so the answers vary. Typically they include a name, an email address, a phone number, and details about what the person is asking for.

Alongside the answers, and whether or not the form asks for them, we record:

• Marketing attribution carried in the link that brought you to the page: utm_source, utm_medium, utm_campaign, utm_term, utm_content and similar, plus advertising click identifiers such as gclid, gbraid, wbraid, fbclid, msclkid, ttclid and their equivalents on other platforms.
• The address of the page the form appeared on, and the page that referred you to it.
• Any additional hidden values the business has configured its own page to pass through.
• Your browser's user agent string.
• A one way hash of your IP address. We do not store the IP address itself, and the hash cannot be turned back into one.
• The exact consent wording shown next to a phone question at the moment it was answered, whether a box was checked, and the time. This is kept so that what you were told can be produced later in the words that were actually on the screen.
• Answers typed into a form that was never submitted, so that returning to the page does not mean starting over.

Forms may also use an anti abuse check provided by Cloudflare, which assesses whether the submission is automated.

Some forms ask for a one time code by text message to confirm that a phone number is real and reachable. Where that is switched on, the number is sent to Twilio for the sole purpose of delivering that code.

Whether a business may call or text you beyond that is governed by the consent wording shown next to the phone question on its form, which names that business. We do not send marketing messages of our own to numbers collected through forms on this service.

Message and data rates may apply. Reply HELP for help or STOP to opt out of messages from any number that contacts you.

No Mobile or opt in information will be shared with third party for any marketing and advertisement purposes.

A business can configure its form to report completed submissions back to the advertising platform that paid for the visit, so it can tell which ads worked.

Where an email address or phone number is included in that report, it is hashed with SHA-256 before it leaves our systems. The platform receives the hash and never the plain value. Click identifiers and the browser cookies those platforms set on the business's own page, such as _fbp and _fbc, are passed through as they were received.

The platforms that may receive this are Meta, through its Conversions API, and Google, through Google Ads and Google Analytics. What those companies do with it is governed by their own policies, not ours.

Answers are delivered to the business whose form collected them, by email, by text message, or to a system of theirs such as a CRM or an automation tool. Where that business has told us to deliver to a destination it does not itself own, such as a partner or a lead buyer, that delivery happens on its instructions and under its own privacy policy.

We use the following companies to run the service, each limited to what their function needs:

• Vercel, for hosting.
• Neon, for the database.
• Twilio, for text messages and phone verification.
• Resend, for email notifications.
• DeBounce, for checking whether an email address is deliverable, where that is switched on.
• Cloudflare, for the anti abuse check.
• Cal.com, Calendly and Google Calendar, where a form offers appointment booking.
• Meta and Google, for the conversion reporting described above.

We do not sell information, and we do not share it for anyone else's advertising purposes beyond the conversion reporting a business switches on for its own campaigns.

We will disclose information where the law requires it, and where it is necessary to investigate abuse of the service.

A form that was started and abandoned is deleted automatically thirty days after it was last touched.

A completed submission is kept until the business that collected it deletes it, or asks us to. Accounts and their forms are kept for as long as the account is open.

Logs of deliveries and conversion reports are kept so that a failure can be diagnosed and retried.

Information is held on servers in the United States. Access and refresh tokens for connected advertising and calendar accounts are encrypted at rest. Passwords are stored only as hashes. Administrative access requires an account we have invited.

No service can promise that it will never be breached, and we do not.

You can ask us what we hold about you, ask for it to be corrected, or ask for it to be deleted. Where your information came from a form, the business that built the form decides, and we will pass the request to them and tell you who they are.

If you are a California resident, the California Consumer Privacy Act gives you the right to know what personal information is collected, to have it deleted, to correct it, and not to be discriminated against for asking. We do not sell personal information and do not share it for cross context behavioral advertising as that law defines those terms.

Requests go to support@infinitymediala.com.

The service is not directed at children under thirteen, and we do not knowingly collect information from them. If you believe a child has submitted information through a form, write to us and it will be deleted.

If this policy changes, the date at the top changes with it. Where the change is significant, account holders will be told directly.

Write to support@infinitymediala.com, or to Infinity Media LA at the address below.