Privacy Policy

The short version.

• If you filled in a form on someone's website, that website's owner decides what happens to your answers. We store and deliver them for the owner. To see or delete your data, ask them. You can also write to us and we'll pass your request on.
• If you use Kibble, we collect what we need to run your account: your name, email and workspace. We don't sell it, we don't show you ads, and our dashboard has no analytics or tracking scripts.
• Where your data is. Kibble stores data in the EU. Some of our providers, including the AI provider we use for triage, process data in the US under standard data protection contracts.
• Questions or requests: [email protected].

#1. Who we are, and our two roles

Kibble is made by Mirio, Inc., a Delaware corporation ("we", "us"). We handle personal data in two different roles.

When businesses use Kibble for their forms, we act for them. Each business that adds a Kibble form to its site ("the customer") decides what the form asks and what happens to the answers. In data protection terms the customer is the controller and we are its processor (a "service provider" under US state laws). We handle those answers only on the customer's instructions, under our Data Processing Addendum. For anything about a form you filled in, the customer's own privacy notice applies, and the customer is the one to contact. Section 3 describes what Kibble stores for customers.

For our own customers and visitors to our site, we decide. We are the controller of the data about the people who sign up for Kibble, use the dashboard, contact us or visit kibbleforms.com. Most of this policy is about that data.

#2. What we collect about our customers, and why

What	Examples	Why we use it	Legal basis (EU/UK)
Account	Your name, email address, and the profile picture address and account id from Google or GitHub if you sign in with them	To give you an account and sign you in	Performing our contract with you
Workspace and team	Workspace name and logo; members' email addresses and roles; which responses you've read; your corrections to triage	To run the workspace you and your team share	Contract
Your agreement to our terms	The version you accepted, when, your IP address and your browser's user agent	To show who agreed to what, and when	Our legitimate interest in proving our agreements
Messages to us	What you send through our contact form or by email	To answer you and follow up	Legitimate interest in answering; steps you asked for before a contract
Your sites and setup	Site names and domains, form definitions, API keys (stored as hashes), and details of the tools and deploys that set up your forms, such as the coding agent used and the commit	To run the service, show you what changed, and limit abuse	Contract; legitimate interest in security
Security and technical data	IP addresses and request details in our hosting providers' logs; sign-in events, including IP addresses, kept by our sign-in provider; error reports	To keep Kibble secure and working, and to investigate abuse	Legitimate interest in security
Billing (once paid plans start)	Your plan, invoices and billing contact. Our payment provider holds your card details; we never see them	To bill you, and to keep tax and accounting records	Contract; legal obligation

Emails. We email you about your account and your forms: sign-in codes, notifications you turn on, and important changes to Kibble or these policies. If we ever send product news, every email will have a one-click unsubscribe link.

We don't sell personal data. We don't share it for advertising or use it for ads. We don't buy data about you from data brokers.

#3. Responses we store for customers

Here is what Kibble stores when someone submits a Kibble form, on the customer's behalf.

• The answers. Whatever the form asks for, such as name, email, company and message, including values the site fills in itself.
• Where the person came from. The page with the form, the page or site that led there, and campaign tags, without the full addresses of other sites.
• Technical details. Such as the browser, the country and a one-way hash of the IP address. The IP address itself isn't stored with a response.
• Spam signals. Such as how quickly the form was filled in and checks on the email domain.
• AI triage. If the customer uses it: what Kibble's AI produces, such as a summary and a category (see section 4).
• Delivery records. Whether each copy sent to the customer's chosen places arrived.

Who sees it. The customer's team sees responses in the Kibble dashboard. Kibble also sends them wherever the customer chooses: email to team members, Slack, the customer's webhooks, or the customer's own database.

How long we keep it. Until the customer deletes the responses, the site or the workspace, or the customer's agreement with us ends (see "Retention" below). Responses sent to a sandbox project, before anyone has claimed it, are deleted after 72 hours.

To see, correct or delete your answers, contact the website you submitted them to; customers can find and delete responses in the dashboard. If you write to us, we'll tell the customer and help them respond. We don't answer requests about a customer's data ourselves unless the customer asks us to, because the data is theirs to manage.

#4. AI triage

Customers can have Kibble's AI read each response to summarize, categorize and assess it. We use AI providers listed on our Subprocessors page for this.

• What's sent: what the AI needs to do the job, such as the form's questions, the answers and the customer's triage settings. We leave out contact details such as email addresses and phone numbers, and technical details such as IP addresses.
• What the provider does with it: it returns the result. It may not use the data to train its models, and keeps it only briefly, under its terms with us, for example to monitor abuse.
• No decisions are made automatically. Triage helps the customer's team understand and prioritize responses. Our terms forbid customers from using it as the sole basis for decisions with legal or similarly significant effects on a person.
• Customers can switch triage off for any form. Nothing from that form is then sent to the AI provider.

#5. Who we share data with

• Service providers who host and run Kibble for us, listed with their locations on our Subprocessors page. They may use the data only to provide their services to us.
• Places customers send responses, such as Slack, webhooks and databases. The customer chooses these, and they're covered by the customer's own agreements.
• Google or GitHub, if you sign in with them. They tell us who you are; their own privacy policies cover what they do.
• When the law requires it, or to protect people's safety, our rights or the security of Kibble. If a government asks for a customer's data, we'll direct the request to the customer where we can, and tell the customer unless the law forbids it.
• If our business changes hands, in a merger, acquisition or sale of assets. The data stays under this policy, and we'll give notice before it falls under a different one.

#6. Where data is processed

Location. Kibble stores its data in the EU. Mirio, Inc. is a US company, and some of our providers process data in the US; the Subprocessors page says which.

Transfers. When personal data from the EU, UK or Switzerland is transferred to the US, we rely on the European Commission's Standard Contractual Clauses and their UK and Swiss equivalents. We also rely on the EU-US Data Privacy Framework where a provider is certified under it. The DPA has the details for customers.

#7. Retention

We keep personal data only as long as we need it for the purposes above:

• Account and workspace data: until you delete it. You can delete your account in Settings → Profile, and owners can delete a workspace in Settings → General.
• Responses: until the customer deletes them, or the agreement ends (then as the Terms describe). Sandbox responses are deleted after 72 hours.
• Records of accepting our terms, and messages to us: as long as we may need them to show what was agreed or to follow up.
• Logs: a short time, unless we need them to investigate a security issue.
• Backups: deleted data leaves our backups within 30 days.

#8. Cookies and browser storage

On kibbleforms.com and in the dashboard we use only our own cookies, for two things: keeping you signed in and secure, and remembering your settings (such as your workspace and light or dark mode). There are no analytics, advertising or third-party tracking cookies.

On customers' sites, Kibble forms set no cookies. They keep a little information in the browser's session storage, which is cleared when the tab closes: what's needed to save progress through a form, and, unless the customer turns it off, where the visitor came from. It's sent to us only with a submission. If a customer adds a bot check, the provider of that check may set its own. Customers decide whether their site needs a consent banner for these.

Do Not Track and Global Privacy Control. We don't track people across other sites, and we don't sell or share personal data for advertising. So these browser signals don't change anything we do, because there's nothing for them to turn off.

#9. Security

We protect data with encryption in transit and at rest, access limited to the people who need it, hashed keys and other measures described on our Security page. If a breach affects your personal data, we'll tell you, and the authorities where required, without undue delay.

#10. Your rights

Depending on where you live, you can ask us to:

• access the personal data we hold about you, or receive a copy in a portable format;
• correct it;
• delete it;
• restrict or object to how we use it, including any use based on our legitimate interests;
• withdraw consent, where we rely on it.

You can delete your account yourself in Settings → Profile. For anything else, email [email protected]. We may need to confirm your identity first. We answer within one month, or 45 days where US state law allows, and we'll tell you if we need longer. We won't treat you differently for using these rights.

If your request is about a form you filled in on someone else's site, we'll pass it to that customer, as section 3 explains.

US residents. Under California and other US state privacy laws you have the rights above, a right to know what we collect and why (this policy), and a right not to have your data sold or shared for advertising. We don't sell or share it, and we don't use sensitive personal information to infer things about you. You can use an authorized agent to make a request.

Complaints. If you're in the EU, UK or Switzerland, you can complain to your local data protection authority. We'd like the chance to sort it out first, so please write to us.

#11. Children

Kibble is a business service: accounts are for people 18 and over, and our Acceptable Use Policy forbids aiming forms at children under 16. We don't knowingly collect personal data from children. If you think a child has given us personal data, email us and we'll delete it.

#12. Changes to this policy

When we change this policy we'll update the date at the top. For significant changes we'll email account holders before the change takes effect. Earlier versions are available on request.

#13. Contact

Mirio, Inc. (Kibble). Email [email protected] for privacy questions and requests.