FormGoat Privacy Policy
This English version is the governing version of this Policy. Translations into other languages are provided for convenience only; in the event of any discrepancy, this version prevails (section 11).
1. Data controller
The controller of personal data (the "controller", "we", "us") is:
Pavel Kanakhistov — sole trader (autónomo)
NIF: Z1825610J
Country of establishment: Spain
Postal address: available on request (contact below)
Contact for privacy matters, the exercise of your rights, and complaints: [email protected]. This address serves as the single point of contact under every data-protection regime applicable to the Service (section 13).
A representative in the EU under Article 27 GDPR is not required — the controller is established in the EU (Spain).
2. What data we collect
2.1. User profile and account sign-in
- Name and email address — from Google where you sign in with Google.
- Google account identifier.
- Sign in with Apple (mobile app): the Apple user identifier and the name and email address that Apple passes to us. If you choose to hide your email, Apple gives us a relay address (…@privaterelay.appleid.com) instead of your real one.
- Sign-in by one-time email code. If you sign in with a code, we store your email address, a cryptographic hash of the code (the code itself is never stored in clear text), its validity period — 10 minutes — and a counter of the attempts made to enter the code. The record is deleted immediately upon a successful sign-in or on expiry.
- Abuse-prevention records: counters of the frequency of code requests, tied to the address and to the Service as a whole.
- How you found us. If you allowed analytics cookies, when you create an account on the website we save the campaign labels (
utm_source,utm_medium,utm_campaign,utm_term,utm_content) of the link by which you first came to the site, the page you arrived on and the date. This shows us which channels bring users. Without that consent the labels are neither read nor saved. - Registration date, plan, remaining balance.
We neither receive nor store your password under any sign-in method.
2.2. Subscription and transaction data
- Plan, payment history, invoices.
- Payments are processed by Stripe; your card details do not reach us and are not stored by us. From Stripe we receive a customer identifier, the subscription status and invoice data.
- Purchases in the mobile app are processed by Google Play or the Apple App Store; your payment details do not reach us. From the store we receive the purchase token or transaction identifier, the product, the subscription status and its expiry date — at the time of purchase and subsequently through the store's server notifications (renewal, cancellation, refund).
- Tips for FG: Audiobook Maker (section 2.10) made on formgoat.ai are processed by Stripe; your card details do not reach us. From Stripe we receive your email address, the amount, whether the tip is one-time or monthly, a customer identifier and the payment status. No FormGoat account is created for a tip. Tips in the Mac App Store version of the app are processed by Apple, which does not share your identity with us.
2.3. Document and application data
The documents you upload (passports, questionnaires, official certificates and statements, bookings, previous applications and the like) are processed using OCR and AI in order to extract data. In connection with providing the Service we process:
- the uploaded files — until their automatic deletion (section 4);
- the application profile — structured data derived from the documents;
- page-level application data — which fields have been completed and with what values;
- bulk-import data — where you upload a consolidated spreadsheet (Excel / CSV) we store the original "field name — value" pairs for each person, in order to use them when completing the application. Such a file will typically contain the data of many individuals (section 2.5);
- the DS-160 security question answer — if you save it, or if the DS-160 Chrome Extension enters it into the form, we store it on the server together with the application so that it is available to you from any device and is entered automatically. This answer is required in order to retrieve the application on
ceac.state.gov; treat it as an access credential. Storage and deletion are governed by section 4; - the provenance of each value — the document from which it was obtained.
2.4. Special categories of data (Article 9 GDPR)
Documents used to complete visa and other official forms may contain special categories of personal data — in particular data revealing racial or ethnic origin (nationality, place of birth, a name in a national alphabet) and, in certain cases, biometric data (photographs in documents).
We process such data solely on the basis of your explicit consent (Article 9(2)(a) GDPR), which you give when uploading documents. You may withdraw your consent at any time by deleting the relevant data or your account; withdrawal does not affect the lawfulness of processing carried out before it.
2.5. Third-party data and use through an agency
You may upload documents containing the data of other persons — relatives or clients, where you use the Service as an agent, migration adviser or other representative, including through the bulk import of a consolidated spreadsheet. In that case you act as the controller of such data and you warrant that you have a lawful basis for processing it: that you are the data subject, their legal representative, or that you have obtained their explicit consent (including consent to special categories of data under Article 9 GDPR).
We process such data as a processor on your instructions, solely for the purposes of the services you request from FormGoat. A data processing agreement (DPA) is available to business users on request. In the terminology of Indian data-protection law, in this scenario you are the Data Fiduciary and we are a Data Processor.
2.6. Improving the quality of the Service
We may use data processed in the course of providing the Service in order to improve the quality of our algorithms and of the Service in general, including the development and training of our models.
For these purposes we use data in de-identified form: identifying elements (names, document numbers, dates of birth, addresses and other direct identifiers) are removed before use. To the extent that such data is anonymous, it falls outside the scope of the GDPR. Beyond that, we rely on legitimate interests (Article 6(1)(f) GDPR) — the improvement of the Service — and apply technical and organisational data-minimisation measures. You may object to this processing (Article 21 GDPR) by writing to us.
2.7. Fill-quality telemetry
In order to understand where the algorithm goes wrong, we record for each completed field the fact alone: whether a value was suggested and whether the user changed it, together with the model's confidence, the source of the value, and the identifier of the form page.
Field values are not included in telemetry — neither those suggested nor those corrected. We separately record the fact that the DS-160 App or the DS-160 Chrome Extension encountered an unfamiliar page structure, so that we are able to release support for the changed form.
The log of network requests in the DS-160 App is kept in the memory of your device only and serves the purpose of self-diagnosis; it is not transmitted to the server. You may copy it and send it to us yourself when contacting support — in which case you control precisely what is sent.
The legal basis is legitimate interests (Article 6(1)(f) GDPR) in maintaining the operability and quality of the Service.
2.8. Mobile app
- Files and photos. The app sends to the server only the files you choose and the photos you take or select for a particular fill. It uses the system file and photo pickers and does not request access to your photo library as a whole. Source files are deleted from the server as soon as processing is complete; the filled document and the working session are kept for the periods in section 4.
- Fill history — the name of the form, the date, the number of fields and a link to the filled document — is kept until you delete the entry or your account.
- On the device the app keeps your sign-in token in the device's protected storage (Android Keystore / iOS Keychain), and the documents you download in its own folder. When you sign out or delete your account, the token and the documents are removed from the device. Uninstalling the app removes the documents and, on Android, the token as well. On iOS the system keeps the token in the Keychain after the app is uninstalled: if you install the app again, you will be signed in to your account automatically. To remove the token, sign out before uninstalling the app.
- App analytics. The app contains Google Analytics for Firebase, a Google service with which we count installations of the app and measure how well our advertising of it works (Google Ads). It records usage events — for example the first launch after installation, sessions, time spent in the app, in-app purchases (plan and price), updates and removal of the app — together with the device model, the operating system and app versions, the language, the approximate location (country, region, city) derived from the IP address and, on Android, the source of the installation reported by Google Play. We do not pass to it your name, email address, account identifier or anything from your documents.
- Identifiers only with consent. Without your consent these events are sent without the app instance identifier and without the advertising identifier (Android advertising ID), and are not linked to you or to your device. The identifiers are used only if you consent to it in the app; where the app asks for consent, you can withdraw it at any time in the app's settings.
- The app does not access your device's location (GPS), does not set cookies and does not show advertising.
2.9. DS-160 Chrome Extension
- Where it works. The extension works only on the pages of the DS-160 form on
ceac.state.govand with our server atformgoat.ai. On a form page it reads the fields in order to fill them with values from your application profile and to check that they have been filled. It does not read other websites and does not collect your browsing history. - What is sent to the server: the documents you upload, for recognition and data extraction (section 2.3) — once processed, they are not kept on the server, only the data extracted from them is; the page-level application data; the application number that
ceac.state.govassigns to the form and the security question answer that the extension enters into the form (section 2.3); and the fact that a page of the form has an unfamiliar structure (section 2.7). With requests for your account data the extension also sends the time zone of your device and the list of languages set in your browser: they are used to determine the region of your account (section 2.11) and are not stored. - On your device. In the browser's storage the extension keeps your sign-in token, the email address you last signed in with, the application number and the security question answer — encrypted (AES-GCM) with a key that cannot be extracted from the browser — as well as the language and theme settings and a record of your consent. It also keeps an encrypted copy of the documents you uploaded, so that they can be shown next to the form when you return to it; this copy is not sent anywhere.
- Removal from the device. Signing out removes the sign-in token, the security question answers and the other account data stored by the extension; the language and theme settings remain. The copy of the documents remains after signing out: it is removed when you delete the application in the extension or delete your account. Removing the extension from the browser removes all of its data from your device.
- The extension does not set cookies, contains no analytics and shows no advertising.
2.10. FG: Audiobook Maker
- Everything happens on your Mac. The app reads the audio files, folders and images you choose, and writes the finished audiobook to the folder set in its settings. These files and their contents (including titles, authors and other tags) are processed on your device only: they are not sent to us or to anyone else. The app does not require an account.
- On your device the app keeps its settings (destination folder, audio settings, the library to add books to), whether a tip has been made on this Mac (to show the billing button) and a log of its work, which may contain the names and paths of the files you processed. All of this stays in the app's own storage on your Mac and is removed together with the app's data.
- Apple Books and Music. If you choose so in the settings, the app passes the finished audiobook to the Books or Music app on your Mac. What those apps do with it is governed by Apple's terms.
- Network. The app does not contact our servers. Buttons in the app open formgoat.ai pages in your browser — our website, the tip page and the billing page — and the website's own rules (section 2.2, cookies) apply there. After a tip, the thank-you page opens the app through a link that carries no personal data. In the Mac App Store version the app connects to the App Store only to show and process tips.
- The app does not set cookies, contains no analytics and shows no advertising.
2.11. Account region
Prices and payment methods may differ by region. To decide which apply to you, your account is assigned a region: India or all other countries. The region does not affect how forms are filled; it only determines which prices and payment methods we offer you.
- How it is determined. The first time you use the DS-160 Chrome Extension after signing in, we look at three signs: the country of your IP address, which we determine on our own server from a locally stored database (IP Geolocation by DB-IP) without sending your IP address to anyone; the time zone of your device; and the languages set in your browser. If two of the three point to India, the region of the account is India.
- Applications. The region of the account also becomes India if three or more applications charged to the account are for applicants whose home address, as extracted from the documents (section 2.3), is in India.
- What is stored: the region, how it was determined, the country of your IP address at that moment, which of the three signs matched, and the number of such applications. Your IP address, time zone and list of languages are not stored for this purpose.
- If the region is wrong, write to [email protected]: we will review it and correct it manually.
3. Legal bases for processing (Articles 6 and 9 GDPR)
| Category of data | Purpose | Legal basis |
|---|---|---|
| Account profile | Authentication, administration of the account | Performance of a contract — Art. 6(1)(b) |
| One-time sign-in codes (hash) | Verifying control of the email address at sign-in | Performance of a contract — Art. 6(1)(b) |
| Request-frequency counters | Preventing abuse and the sending of codes to third-party addresses | Legitimate interests — Art. 6(1)(f) |
| Subscription and balance | Plan management, billing | Performance of a contract — Art. 6(1)(b) |
| Store purchase data (mobile app) | Activating and maintaining a subscription bought in the app | Performance of a contract — Art. 6(1)(b) |
| Tips for FG: Audiobook Maker | Processing the payment you make and managing a monthly tip | Performance of a contract — Art. 6(1)(b) |
| Ordinary document and application data | Completing forms at your request | Performance of a contract — Art. 6(1)(b) |
| Security question answer | Auto-filling the answer into the application form, and access to the saved form from any device | Performance of a contract — Art. 6(1)(b) |
| Special categories | Completing visa and other official forms | Explicit consent — Art. 9(2)(a) |
| Fill-quality telemetry (no field values) | Detecting errors of the algorithm and changes to the form | Legitimate interests — Art. 6(1)(f) |
| Account region (country of the IP address, time zone, browser languages, applicants' home country) | Offering the prices and payment methods of your region and preventing their misuse | Legitimate interests — Art. 6(1)(f) |
| De-identified data | Improving and training algorithms, quality of the Service | Legitimate interests — Art. 6(1)(f); anonymous data outside the scope of the GDPR |
| Payment records | Compliance with tax and accounting law | Legal obligation — Art. 6(1)(c) |
| Consent records | Demonstrating consent | Legal obligation — Art. 6(1)(c), Art. 7(1) |
| Analytics (cookies) | Improvement of the Service | Consent — Art. 6(1)(a) |
| Campaign labels of the first visit (website) | Understanding which channels bring users | Consent — Art. 6(1)(a) |
| App analytics without identifiers (mobile app) | Counting installations, measuring the app's advertising | Legitimate interests — Art. 6(1)(f) |
| App analytics identifiers (mobile app) | The same, linked to the device | Consent — Art. 6(1)(a) |
| Dispute resolution, security | Protection of rights and prevention of abuse | Legitimate interests — Art. 6(1)(f) |
We do not sell your data and do not use it for behavioural advertising. Every form-filling outcome requires human review; we do not take solely automated decisions producing legal effects within the meaning of Article 22 GDPR.
4. Retention periods
| Category | Period | Note |
|---|---|---|
| User profile (name, email, account) | Until the account is deleted | Retained while the account is active |
| Uploaded files | 14 days from upload | Automatic deletion |
| Extracted data, application profiles, page data | 1 year | Automatic scheduled deletion |
| Bulk-import data (spreadsheets) | 1 year | Deleted together with the application data |
| Security question answer | Until the application or the account is deleted, and no longer than 1 year | Deleted together with the application data |
| Fill-quality telemetry (flags, no field values) | Retained while the account exists; de-identified on deletion | Contains no field values; on deletion of the application form or the account the link to you ceases to exist (section 9) |
| One-time sign-in codes | 10 minutes, or until a successful sign-in | Only the hash is stored |
| Request-frequency counters | up to 24 hours | Operational records |
| Consent records | Term of the account plus the limitation period | Evidence of consent (Art. 7(1) GDPR) |
| Account region | Until the account is deleted | Only the region, how it was determined, the country of the IP address and the matched signs (section 2.11) |
| Payment records and invoices | 6 years (Código de Comercio, Art. 30) | Legal obligation; not deleted on request before that period expires |
Product specifics
Chrome Extension: the uploaded file — 14 days; the application profile — 1 year.
DS-160 Desktop App and DS-160 Chrome Extension: uploaded documents are not kept on the server once processed; application data — 1 year. Under the BUSINESS plan the retention period is agreed individually and may be indefinite, in which case the data is retained until the application or the account is deleted. Where an application is deleted manually, all personal data relating to it, including the security question answer and the page data, is destroyed without undue delay; a record containing no personal data is retained for statistical purposes. On your device the DS-160 Chrome Extension keeps the copy of the documents until you delete the application or your account, or remove the extension, and the sign-in token until you sign out (section 2.9).
FormGoat Docs: working session — 24 hours; application profiles — 1 year.
FG: Audiobook Maker: we store nothing on our servers about your use of the app; the data on your Mac is kept until you delete it or the app. Records of tips are kept as payment records (see the table above).
Mobile app: source files — deleted as soon as processing is complete; working session — 24 hours; filled document — 14 days; fill history — until you delete the entry or your account; app analytics events — kept by Google Analytics for no longer than 14 months.
Outdated document data is deleted automatically on a schedule. The user profile and payment records are not affected by that process.
5. Recipients and processors
To provide the Service we engage processors — service providers processing data on our instructions (where, under section 2.5, we act as your processor, they are sub-processors). With each of them a data processing agreement (Article 28 GDPR) has been concluded or accepted. The categories of recipients are disclosed below; those with whom you interact directly are named.
| Category of recipient | Region |
|---|---|
| Application hosting and database | EU (Netherlands) |
| Document recognition (OCR) and AI data extraction | USA |
| Payment processing — Stripe; in apps obtained from a store — Google Play, Apple App Store | USA |
| Sign-in — Google, Apple (only for the method you choose) | USA |
| Email delivery, including sign-in codes | USA |
| Site protection and content delivery (CDN) | Global network |
| App stores — Microsoft Store, Chrome Web Store, Google Play, Apple App Store | USA |
| Web analytics — Google Analytics · cookie consent — iubenda (only after consent) | USA · EU |
| App analytics — Google Analytics for Firebase (identifiers only after consent) | USA |
The contents of uploaded documents are received only by the OCR and AI providers, by hosting and by the database; the other categories do not receive them. The set of OCR and AI providers may change — the requirements placed upon them and the transfer safeguards under section 6 remain the same.
A current full list of providers is available on request at [email protected], and to business users as part of the DPA, together with the procedure for notification of a change of sub-processor.
6. International transfers
Hosting and the database are located in the EU (Netherlands) — no transfer outside the EU/EEA takes place in respect of them. The providers of OCR and AI, payment processing, email delivery, analytics and the CDN process data in the USA or outside the EU/EEA. In respect of such transfers we ensure the safeguards of Chapter V GDPR: Standard Contractual Clauses (SCC) approved by the European Commission, and/or certification of the recipient under the EU-U.S. Data Privacy Framework (DPF). A copy of the safeguards and a list of recipients may be requested at [email protected].
7. Security
We implement appropriate technical and organisational measures in accordance with Article 32 GDPR:
- encryption in transit — HTTPS / TLS on all connections;
- encryption at rest at the infrastructure level — managed databases and disk volumes are encrypted by the infrastructure provider;
- authentication via OAuth 2.0 / OpenID Connect and one-time codes — we neither receive nor store your password; one-time codes are stored as a hash only;
- secure authorisation tokens and verification of the owner of the data on every request;
- in the mobile app, the sign-in token is kept in the device's protected storage (Android Keystore / iOS Keychain);
- in the DS-160 Chrome Extension, the sign-in token, the security question answers and the copy of the documents are stored on the device encrypted (AES-GCM) with a key that cannot be extracted from the browser;
- isolation of user data;
- rate limiting and protection against automated abuse;
- minimisation: fill-quality telemetry contains no field values, and the App log does not leave your device.
No system affords absolute security. In the event of a breach entailing a risk to your rights, we will notify the supervisory authority within 72 hours (Article 33) and, where the risk is high, you (Article 34). In respect of data subjects in India, the procedure in section 13 applies.
8. Your rights (GDPR)
- Access (Art. 15) — to request a copy of your data.
- Rectification (Art. 16) — to have inaccuracies corrected.
- Erasure (Art. 17) — to have data deleted; the right is not absolute — payment records are retained by virtue of a legal obligation.
- Restriction of processing (Art. 18).
- Portability (Art. 20) — to receive your data in a machine-readable format.
- Objection (Art. 21) to processing based on legitimate interests.
- Withdrawal of consent (Art. 7(3)) — at any time, without affecting the lawfulness of past processing.
To exercise your rights: [email protected]. We respond within 30 days.
Right to lodge a complaint. You have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR) — in your country of residence or in the country of the controller's establishment. The controller's supervisory authority is the Agencia Española de Protección de Datos (AEPD), www.aepd.es.
9. Account deletion
How to delete: through the App settings (in the mobile app: Settings → Delete Account), or by writing to [email protected]. Step-by-step instructions: formgoat.ai/delete-account.
Deleting your account does not cancel a subscription bought through Google Play or the App Store: cancel it in the store (Purchase and Refund Policy, section 3.2).
What is deleted: your name, email, all uploaded files, extracted data, profiles and application data across all products, including the security question answer, and the region of your account — within 14 days of the request. Residual copies in backup storage are removed in the course of ordinary rotation. Deleting the account in the DS-160 Chrome Extension also removes from your device the copies of documents that the extension keeps there (section 2.9). Individual processors may retain data for their own limited periods in accordance with their terms, over which we cannot always exercise control.
What is retained: payment records (for the statutory retention period, section 4) and records of the consents obtained, as evidence that they were obtained — without the contents of your documents.
Records retained for statistical purposes. We maintain a record of the volume of work performed — how many applications were processed, which models were applied, and fill-quality metrics. Upon deletion of data such records are not deleted but de-identified: the personal fields are cleared, and the record itself remains, without the contents of your documents and without data enabling you to be identified. The legal basis is our legitimate interest in record-keeping and quality control (Article 6(1)(f) GDPR), as described in section 2.6; you may object to this processing (Article 21 GDPR).
10. Minors
The account holder must be a person who has attained the age of 18 (or the age of majority in your jurisdiction). The Service may be used to process the data of minors where the account holder acts as their legal representative (for example, when completing a visa application for a child). We do not knowingly create accounts for minors, do not track the behaviour of children, and do not serve them targeted advertising.
11. Changes to this Policy
We will give not less than 14 days' notice of material changes by email. Previous versions are retained in the documentation repository.
This Policy may be translated into other languages for convenience. In the event of any discrepancy, this English version prevails, except where mandatory rules require interpretation in the language of the data subject.
12. Contact
[email protected]
Postal address: available on request.
13. Global standard and regional specifics
13.1. A single standard. We apply one standard of personal-data protection to all users, irrespective of the country in which they are located. It is based on the GDPR: the legal bases for processing, the rights of data subjects, retention periods, the requirements placed on processors, and the transfer safeguards set out in sections 2–12 apply to everyone. Where the mandatory rules of your country of residence afford you greater rights or shorter periods, those rules apply.
13.2. Roles. In different legal systems our role bears different names — controller, Data Fiduciary, controlador, responsable, owner or operator of a personal data database. The allocation of responsibilities does not change on that account: in respect of the data of your account we act as the controller; in respect of the data of your clients which you upload (section 2.5) you are the controller and we act as processor, processing that data only on your instructions.
13.3. Where to turn. First, to [email protected]; we respond within 30 days at the latest. If our response does not satisfy you, you have the right to lodge a complaint with the supervisory authority of your jurisdiction, where local law provides for one. The controller's supervisory authority is the Agencia Española de Protección de Datos (AEPD), Spain, www.aepd.es; if you are in the EU/EEA you may also lodge it with the authority of your country of residence.
13.4. Regional specifics. Certain legal systems add the following to the baseline standard.
- India (Digital Personal Data Protection Act, 2023) — the right to obtain a summary of the personal data processed and details of the recipients, and to nominate another person to exercise your rights in the event of death or incapacity; grievances are made through the contact above and thereafter to the Data Protection Board of India; on request we will provide this Policy in any language specified in the Eighth Schedule to the Constitution of India.
- Latin America — in Brazil (LGPD) you have the right to request a review of a decision taken solely by automated processing: the Service takes no such decisions, final values being reviewed by a person (section 3), but we will consider any such request and provide an explanation. In Mexico this Policy serves as the aviso de privacidad, and the ARCO rights — access, rectification, cancellation, objection — are exercised through the same contact.
- Kazakhstan — processing is carried out on the basis of your consent in the form provided for by local legislation. The legislation of the Republic imposes requirements as to the place of storage of personal data; until such time as we offer the Service on terms meeting those requirements, you consent to the processing and storage of data on the servers identified in sections 5 and 6.
13.5. Other countries. If the law of your country of residence confers rights not listed above, you may exercise them by writing to [email protected]. We apply the baseline standard in 13.1 and comply with the mandatory rules applicable to the processing of your data.