HyperForms Privacy Policy

Last updated: November 7, 2026

This Privacy Policy explains what information ANAVTEK LLC, which operates HyperForms ("HyperForms," "we," "us" or "our"), collects through our website at https://myhyperforms.com and the HyperForms service (together, the "Service"), how we use it, who we share it with, and the choices you have. It describes the Service as it works today.

It covers three groups of people:

• our customers, meaning the businesses that use HyperForms, and people who request access;
• people who fill out a HyperForms form on another website ("form users"); and
• people who visit our website.

The short version

• If you fill out a form on a business's website and that form is run by HyperForms, we check your submission for spam and email it to that business. We don't keep a copy. The business decides how to use it.
• We use a few short-lived technical records to block spam and count form views. Section 5 explains how long each is kept.
• We don't use cookies, analytics or advertising tools, and we don't sell personal information.

1. Information we collect

A. If you are a customer, or request access

Access requests. When you request access, we collect your name, work email, company (optional) and what you need forms for (optional). Your request is emailed to our team's inbox, with the reply-to address set to you. We don't store it in a database. As our request form says, we use your email only to get you set up.

Your form settings. Your form fields, the email addresses that receive submissions, and the websites your form may appear on.

Billing information. If we bill you, we keep records of your fees and payments.

Messages you send us. If you email us, we receive your email address and whatever you include in your message.

B. If you fill out a HyperForms form on another website

When you submit a form that a business runs with HyperForms, we process:

• the information you enter, which depends on the questions the business asks;
• any files you upload; and
• your IP address and browser information, which we use only to block spam and abuse, as described below.

We check your submission and email it right away to the business's chosen recipients, with the reply-to address set to your email address if you gave one. We don't store your submission or your files. They exist on our servers only while the submission is being processed. Our server logs record only a random submission ID, the form ID and an error code if sending fails, never what you entered. Copies of the email exist in the business's inbox and, for a limited time, with our email provider.

Spam and abuse protection.

• Rate limiting. To limit repeated submissions, we create a scrambled code from your IP address and the form, and keep it for 10 minutes.
• Cloudflare Turnstile. Our forms use Cloudflare Turnstile to check that submissions come from people, not bots. When you submit, your Turnstile result and your IP address are sent to Cloudflare to be checked. Turnstile processes signals such as your IP address and browser information. Cloudflare says it uses these signals only to detect and block bots, and Turnstile doesn't read what you type into the form. See Cloudflare's Turnstile privacy addendum at https://www.cloudflare.com/turnstile-privacy-policy/.

Form view counts. When a HyperForms form appears on your screen, your browser sends one request to our own servers so we can count views. We turn your IP address into a scrambled code that changes every day and uses a secret key, so we can count unique visitors. That code is deleted after 2 days. To protect against floods of requests, we also keep your IP address for up to 10 minutes. The daily view counts we keep don't identify anyone. No analytics company is involved.

We process form submissions on behalf of the business whose form you filled out. That business decides what the form asks and how the information is used, and its own privacy policy applies. If you have a question or request about your information, please contact that business. If you contact us, we'll help them respond.

C. If you visit our website

Our access request form uses Cloudflare Turnstile in the same way.

Analytics. We don't use analytics or advertising tools on our website or in our forms.

2. How we use information

We use the information described above to:

• provide the Service, including checking submissions, blocking spam, delivering submissions by email and counting form views;
• set up and support customers, and answer questions;
• keep the Service secure, prevent fraud and abuse, and enforce our Terms of Service; and
• comply with the law and protect the rights and safety of our customers, form users, the public and ourselves.

3. Cookies and similar technologies

Our website and our forms don't set cookies or use your browser's storage. Cloudflare Turnstile runs in its own frame from Cloudflare's systems, under Cloudflare's terms.

Do Not Track. Our website doesn't change how it works in response to Do Not Track or Global Privacy Control signals, because there is no tracking for those signals to turn off. Other than the providers named in this policy, we don't allow third parties to collect information about your activity on our website over time and across other websites.

4. How we share information

Service providers. We use these companies to run the Service. They handle personal information only to provide their services to us.

• Vercel: hosts our website and forms, and processes every submission. It keeps server logs.
• Resend: delivers submission emails, including any attached files, and access requests.
• Cloudflare: provides Turnstile bot protection and our domain name service, and carries traffic to our database server through a secure tunnel.
• Upstash: keeps our short-lived rate-limiting counters in the United States.
• Hetzner: hosts our server in Helsinki, Finland, which runs our database. It holds form settings, including recipient email addresses, view counts and the 2-day view codes.
• Backblaze: stores our encrypted nightly database backups in the United States.

The businesses whose forms you fill out. If you are a form user, your submission is delivered to the business that runs the form, as described in section 1B.

Legal and safety reasons. We may disclose information if we believe in good faith that it's needed to comply with the law or a valid legal process, to respond to valid law-enforcement requests, to investigate or stop fraud, abuse or security problems, to enforce our Terms, or to protect the rights, property or safety of our customers, the people they deal with, the public or ourselves.

Business transfers. If we are involved in a merger, acquisition, financing, or sale of all or part of our business, information may be transferred as part of that deal. We will require the recipient to protect it in line with this policy.

No selling or sharing. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined under California law. We don't use advertising pixels, and we don't give personal information to third parties for their own marketing.

5. How long we keep information

• Form submissions and uploaded files: we don't keep them. Our email provider, Resend, keeps copies of sent emails for a limited time under its own terms, and the business keeps them in its own inbox.
• Rate-limiting codes and the flood-protection IP address: 10 minutes, then deleted automatically.
• Daily view codes: 2 days, then deleted automatically. Daily view counts, which don't identify anyone, are kept while the form exists.
• Turnstile checks: handled by Cloudflare under its own terms.
• Access requests and messages you send us: kept for 12 months after our last contact with you and then deleted, unless you become a customer.
• Form settings, including recipient email addresses: kept while you use the Service, and removed by our team when a form is retired.
• Server logs: kept by Vercel for a limited time under its own terms.
• Database backups. We back up our database every night. Backups are encrypted before they leave our server and are stored with Backblaze in the United States. Daily backups are kept for 14 days and weekly backups for 8 weeks, then deleted automatically. Before some changes to our database, we may also take a one-off encrypted copy, which is kept on our server in Finland and doesn't yet expire automatically. Information we delete can remain in backups until those backups are deleted.

We may keep information longer where the law requires it, or where we need it to resolve disputes, investigate abuse or enforce our agreements.

6. Your choices and rights

Access and correction. You can ask us for a copy of the personal information we hold about you, or ask us to correct it, by emailing andrew@hyperdigitalagency.com.

Deletion. Because we don't store form submissions, requests about a submission should go to the business that received it. To ask us to delete your access request or your form settings, email andrew@hyperdigitalagency.com. We will confirm the request comes from you and complete it within 30 days. We may keep records we need for legal reasons or to prevent abuse.

California residents. California law gives California residents certain rights over their personal information, including the right to know what we collect, to get a copy, to ask us to delete or correct it, and to opt out of its sale or sharing. We offer the access, correction and deletion options above to everyone, wherever they live. You may use an authorized agent to make a request for you, and we may ask for proof that the agent is authorized. We will not treat you differently for using any of these rights.

7. Security

We use reasonable measures to protect information, including encrypting our database backups before they leave our server. No method of storing or sending information is completely secure, so we can't guarantee absolute security. If a security breach affects your personal information, we will notify you as the law requires.

8. Children

The Service is for businesses and professionals. It is not directed to children under 13, and we don't knowingly collect personal information from children. If you believe a child has given us personal information, email andrew@hyperdigitalagency.com and we will delete it.

9. Where information is processed

Our website and forms are hosted in the United States (Washington, D.C. area), our email provider sends from the United States, and our rate-limiting counters are kept in the United States. Our database runs on a server in Helsinki, Finland, in the European Union, and our encrypted database backups are stored in the United States. This means some information moves between the United States and Finland. Some of our providers run global networks, so information may also be processed in other countries. If you use the Service from another country, your information will be transferred across borders, and privacy laws in those places may differ from the laws where you live.

10. Changes to this policy

We may update this Privacy Policy from time to time, including when we add new features. We will show the date of the latest version at the top of this page. If we make a material change, we will email our customers before the change takes effect.

11. Contact us

If you have questions about this policy or want to make a request, contact us at:

ANAVTEK LLC, operator of HyperForms

Email: andrew@hyperdigitalagency.com

Mail: ANAVTEK LLC, 9461 Charleville Blvd PMB 22533, Beverly Hills, CA 90212