Privacy Policy

Last updated: 11 September 2026

This policy explains how Atticus Intelligence Ltd ("we", "us"), a company registered in England and Wales under number 16130885 with its registered office at 324 Ben Jonson House, Barbican, London, EC2Y 8NQ, handles personal data in connection with BetterForms (the "Service").

Contact: privacy@usebetterforms.com

1. Two different roles

We handle personal data in two distinct capacities, and your rights differ depending on which applies.

We are the controller of data about people who hold an account with us — form creators, team members, billing contacts, and visitors to our website. Sections 2 to 11 below describe this.

We are a processor of the answers submitted to forms created by our customers. When you fill in a form built on our platform, the person or organisation that created that form is the controller of your answers. They decide what to ask, why, and how long to keep it. We process those answers only on their instructions. Section 12 explains what this means for respondents.

If you are a respondent and want your answers corrected or deleted, contact the organisation that sent you the form. If you cannot identify or reach them, contact us at privacy@usebetterforms.com and we will try to help, but we may need to refer you to them.

2. Data we collect as controller

Account data. Name, email address, password credentials, profile image, and organisation membership. Authentication is handled by our provider Clerk; we do not store your password ourselves.

Billing data. Billing name, address, country, VAT or tax identifiers, subscription plan, seat count, and invoice history. Card details are collected and stored by Stripe. We never see or store full card numbers.

Form content you create. The questions, settings, branding, and goal descriptions you enter when building a form. Where you use our AI generation feature, the prompt text you provide is sent to our AI provider to produce the form.

Usage and technical data. IP address, browser and device type, pages viewed, features used, timestamps, and error logs. Used to operate, secure, and improve the Service.

Product analytics. How our website and the signed-in application are used: pages opened, features used, forms created and published, and the timing of those events. These records are keyed to your account identifier once you sign in, and to a random identifier before that. They do not include your form questions, your respondents' answers, or the text of your AI prompts. Section 10 explains the cookies involved, and section 12 explains why none of this applies to people filling in your forms.

Communications. Emails and support messages you send us, and our replies.

3. Signing in with Google

You can create a BetterForms account and sign in with your Google account. This is optional; email and password sign-in is also available.

What we receive. When you choose to sign in with Google, Google asks you to approve the request and then shares a limited set of profile information with us: your name, your email address, your profile picture, your preferred language, and the unique identifier Google assigns to your account. We request only the standard openid, email, and profile scopes. We do not request access to Gmail, Google Drive, Google Calendar, Google Contacts, or any other Google service, and we cannot read, create, modify, or delete anything in your Google account.

Why we use it. To create your account, to recognise you when you return, to show your name and picture in your workspace, and to send you the service emails described in section 4. This is the same account data described in section 2 — signing in with Google is simply how we come to hold it.

How we store it. Your Google profile information is held in your BetterForms account record by our authentication provider Clerk, listed in section 6. It is retained for as long as your account is open and then deleted on the timetable in section 8.

What we do not do. We do not sell Google user data. We do not use it for advertising or ad targeting, and we do not use it to train or improve AI or machine learning models. We do not transfer it to anyone other than the sub-processors listed in section 6, and then only to operate the Service, where you direct us to, or where the law requires it. No person at BetterForms reads your Google user data except where you have asked us to look at a specific support issue, where it is necessary for security, or where the law requires it.

Limited Use. BetterForms' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting. You can withdraw our access at any time at myaccount.google.com/permissions. Doing so stops you signing in with Google, but does not by itself delete your BetterForms account or your forms — to delete those, see section 9.

4. Why we use it, and our legal basis

Where we rely on legitimate interests, we have assessed that our interests do not override your rights. You can object at any time — see section 9.

5. AI processing

Two features involve sending data to third-party AI providers.

Form generation. The prompt you type is sent to our AI provider to generate questions. Do not include personal data or confidential information in these prompts.

Response analysis. When a form closes, open-text answers are converted into numerical representations (embeddings) and grouped by similarity. A small number of representative answers from each group are then sent to a language model to produce a theme name and summary. Not every answer is sent to a language model, but every open-text answer is sent to an embedding provider.

We use OpenAI for this. We have contractual terms in place that prohibit it from using data submitted through our account to train its models. We do not use customer content or response data to train our own models.

Automated analysis produces summaries and groupings that may be incomplete or inaccurate. It does not produce decisions with legal or similarly significant effects about any individual.

6. Sub-processors

We use the following providers. This list may change; we will update it here and, for material changes, notify account holders.

7. International transfers

Some providers listed above process data outside the UK and EEA, including in the United States. Where that happens, we rely on UK International Data Transfer Agreements, the EU Standard Contractual Clauses with the UK Addendum, or an adequacy decision, together with additional safeguards where appropriate. You can request details of the mechanism used for a specific provider at privacy@usebetterforms.com.

8. How long we keep it

• Account data: for as long as your account is open, then 30 days after closure, after which it is deleted or anonymised.
• Form content and responses: according to your plan's history setting. Free accounts retain response history for 30 days on a rolling basis. Paid accounts retain it until you delete it or close your account.
• Analysis outputs: alongside the responses they were generated from.
• Billing records: 7 years, to meet UK tax and accounting requirements.
• Security and audit logs: 12 months.
• Support correspondence: 24 months.

Backups are retained for 30 days and overwritten on a rolling cycle, so deleted data may persist in backups for that period.

9. Your rights

Under UK and EU data protection law you may request access to your data, correction of inaccurate data, deletion, restriction of processing, portability, and you may object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time without affecting prior processing.

To exercise any of these, email privacy@usebetterforms.com. We will respond within one month. We may ask you to verify your identity.

If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk, or to your local supervisory authority if you are in the EEA.

10. Cookies

Strictly necessary. Cookies that keep you signed in, maintain your session, and prevent fraud. These do not require consent.

Analytics. We use PostHog to understand how our website and the signed-in application are used — which pages are opened, which features are used, and where people give up. This stores a random identifier in a first-party cookie and in local storage on our own domain, and the requests carrying it are routed through our own domain rather than sent to PostHog directly. Under UK and EU cookie rules these are not strictly necessary, so we rely on your consent for them.

We ask before any of this is stored. Until you accept, the analytics code is not loaded and nothing is placed on your device; declining is one click, in the same place and of the same weight as accepting. You can change your mind at any time using the Cookies link in the footer — withdrawing removes the identifier that was stored and stops any further collection.

We do not use advertising or marketing cookies. We do not record your screen or your keystrokes. We do not share any of this with advertising networks, and we do not use it to build a profile of you for anyone else's purposes.

Forms you publish set none of this. Analytics is not loaded at all on the pages where a respondent fills in a form — not disabled after loading, but never started. Opening a form built on our platform places nothing on the respondent's device beyond what is strictly necessary to show the form and submit their answers.

11. Security

We encrypt data in transit using TLS and at rest. Access to production systems is restricted, authenticated, and logged. We maintain an audit log of significant account actions. We test and review our security arrangements periodically.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the ICO within 72 hours where required and inform you without undue delay where the risk is high.

12. Information for form respondents

If you have received a link to a form built on our platform:

• The organisation that created the form decides what data is collected and why. They are responsible for telling you that, and for having a lawful basis to collect it.
• We store your answers on their behalf and process them to produce the analysis described in section 5.
• We may collect limited technical data such as IP address and browser type for security and abuse prevention. Where we record that you have submitted a form, we do so against a keyed hash of your IP address rather than the address itself, so the record cannot be read back as a list of who opened which form.
• We do not run analytics or tracking on the pages where you fill in a form, and we do not place analytics cookies on your device. See section 10.
• We do not sell your answers, use them for advertising, or use them to train AI models.
• To access, correct, or delete your answers, contact the organisation that sent you the form.

13. Children

The Service is not directed at children under 16 and we do not knowingly collect their data through account signup. Customers who use the Service to collect responses from children are responsible for obtaining any consent required by law.

14. Changes

We may update this policy. Material changes will be notified by email or in-product at least 14 days before taking effect. The date at the top shows the current version.