Privacy Policy

RouteForms is a small SaaS product that relays Google Form submissions to Slack and routes them based on rules you define. References to “we”, “us”, and “RouteForms” in this policy refer to the operators of routeforms.com.

You can reach us about anything on this page at routeforms@gmail.com.

Account information

When you sign in with Google through our authentication provider (Supabase Auth), we receive your name, email address, and profile picture URL from Google. We store these in our user database so we can show your account inside the app.

Form configuration you create

• Form names you set
• Webhook secrets we generate for your forms (used to authenticate incoming submissions)
• Slack incoming-webhook URLs you paste in (used to deliver responses to Slack)
• Channel labels you type for your own reference
• Routing rules you define (field name, operator, value, destination)
• Optional client workspaces and the forms you assign to them

Form submission data

When a Google Form submission is forwarded to our webhook by your Apps Script, we receive the full submission payload (every answer, plus metadata our Apps Script adds such as the form title, form ID, response ID, and submission timestamp). We store this payload so you can review responses in the dashboard and retry failed deliveries.

Delivery records

For each Slack delivery attempt we record: the destination, the HTTP status code Slack returned, whether it succeeded, an error message if it failed, and the timestamp.

Billing information

We use Lemon Squeezy as our merchant of record. When you upgrade to a paid plan, Lemon Squeezy collects your payment details directly — we never see your card number. We store the Lemon Squeezy customer ID, subscription ID, plan variant, and renewal date they return to us, so we can show the right plan inside RouteForms.

Usage analytics

We use Vercel Analytics, which records anonymised, aggregated page views and Web Vitals. It does not use cookies and does not track individual users across sites.

• To provide the core service: receiving submissions, evaluating rules, delivering to Slack
• To show you what happened to each submission in the dashboard
• To bill you correctly for paid plans and manage your subscription
• To send transactional emails (e.g. failed-delivery alerts) when you opt in
• To improve product performance and fix bugs
• To meet legal obligations (e.g. tax records for billing)

We rely on the following service providers to operate RouteForms. Each handles a specific scope of data:

• Supabase (database + authentication) — stores your account, forms, rules, submissions, and delivery logs. Database hosted in Singapore. Privacy policy.
• Vercel (application hosting + analytics) — runs the web app and webhook endpoints. Functions pinned to the Singapore region. Privacy policy.
• Google (sign-in + Apps Script) — supplies your account profile when you sign in. Your Apps Script forwards Google Forms responses to us. Privacy policy.
• Slack (message delivery) — receives the messages we post to your channels via the webhook URL you provide. Privacy policy.
• Lemon Squeezy (billing) — processes payments, stores card details, and acts as the merchant of record. Privacy policy.
• Resend (transactional email) — sends optional failed-delivery alert emails if you turn them on. Privacy policy.

• Account information — until you ask us to delete your account
• Forms, rules, and Slack webhook URLs — until you delete them or your account
• Submission payloads — kept while your account is active so you can review and retry them
• Delivery logs — kept while your account is active
• Billing records — retained as required by tax and accounting law

We plan to add per-plan retention windows for delivery logs and old submissions in a future release. This page will be updated when that ships.

We do not sell your data, and we do not share it for advertising. We share data with the subprocessors listed in section 4 only as needed to operate the service. We may disclose data when legally required (e.g. a binding subpoena), and we will inform you unless the law forbids it.

You can ask us to do any of the following at any time by emailing routeforms@gmail.com from the email on your account:

• Access the personal data we hold about you
• Correct anything inaccurate
• Delete your account and the data associated with it
• Export a copy of your forms, rules, and submissions
• Withdraw consent to optional features (e.g. failed-delivery email alerts)
• Object to a particular processing activity

We aim to respond to data requests within 30 days. If you are based in the European Economic Area, the United Kingdom, or California, you have additional rights under GDPR, UK GDPR, and the CCPA respectively; the rights above are written to cover those regimes.

Our application and database run in Singapore. Our subprocessors are based in various jurisdictions (including the United States and the European Union). When data moves between these regions, we rely on the protective measures each subprocessor provides, such as standard contractual clauses.

All traffic to RouteForms is served over HTTPS. Data at rest in our database is encrypted by Supabase. Webhook secrets are unique per form and are never displayed in full after creation. Slack webhook URLs are stored encrypted at rest and shown masked in the dashboard. More detail is on our security page.

RouteForms is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe we have, please contact us and we will delete it.

We may update this policy as the product evolves. When we make material changes we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email.

For privacy questions, data requests, or anything else covered above, email routeforms@gmail.com.