Privacy Policy

At KirokuForms, a product of Chelsea AI Ventures Ltd., we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our form building and submission collection service.

This Privacy Policy applies to information we collect:

• On our websites (kirokuforms.com and related domains)
• Through our web application and service
• Through forms created using our service
• In email, text, and other electronic communications

Please read this Privacy Policy carefully. By using KirokuForms, you consent to the data practices described in this policy.

Account Information

When you create an account, we collect:

• Name and email address
• Payment information when subscribing to paid plans
• Account preferences and settings

Form Creation and Management

When you create and manage forms, we collect:

• Form content, fields, and configuration
• Customization settings and branding preferences
• Domain verification information for forms

Form Submission Data

When your forms collect submissions, we process:

• All data submitted through your forms
• Metadata about submissions (IP address, timestamp, referrer, user agent)
• Files uploaded through your forms (if file upload fields are used)

Note: You are the data controller for form submission data. We process this data on your behalf as a data processor.

Usage Data

We automatically collect certain information about how you use our service:

• Log data (IP address, browser type, pages visited, time spent)
• Device information (device type, operating system)
• Form analytics (views, completion rates, abandonment rates)

Cookies and Similar Technologies

We use cookies and similar tracking technologies to track activity on our website and hold certain information. See our Cookie Policy for more details.

Account Management

• To create and maintain your account
• To provide access to our features and services
• To process and manage your subscription
• To communicate with you about your account and our services

Form Submission Processing

• To store and process form submissions on your behalf
• To provide you with analytics about your forms
• To prevent spam, abuse, and fraudulent submissions

Service Improvement

• To analyze usage patterns and improve our service
• To troubleshoot issues and maintain security
• To develop new features and functionality

Marketing and Communication

• To send you product updates and newsletters (if opted in)
• To provide customer support and respond to inquiries
• To inform you about new features, promotions, or offers

We may share your information with:

Service Providers

We use third-party service providers to help us operate our business and provide our services:

• Hosting and infrastructure providers
• Payment processors
• Email service providers
• Analytics providers
• Customer support tools

These providers are contractually obligated to use your information only to provide services to us and in accordance with this Privacy Policy.

Business Transfers

If KirokuForms or Chelsea AI Ventures is involved in a merger, acquisition, or asset sale, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).

With Your Consent

We may share your information with other parties with your consent or at your direction.

As a form creation and submission collection service, we handle two categories of personal data:

Your Data (as our Customer)

This is the information you provide when creating an account and using our service. For this data, Chelsea AI Ventures Ltd. acts as the data controller.

End-User Data (Form Submissions)

This is the information collected through forms you create. For this data:

• You are the data controller
• Chelsea AI Ventures Ltd. is the data processor
• You are responsible for obtaining appropriate consent from your form users
• You should provide your own privacy policy for form submissions

When collecting personal data through your forms, you should:

• Clearly inform users about what data you're collecting and why
• Obtain appropriate consent for data collection
• Provide a link to your privacy policy
• Only collect data necessary for your stated purposes

We process and store form submission data according to your instructions and our Terms of Service.

Our customers can put a KirokuForms form on their own website and set it to open as a popup. Where they have, our script runs on their pages, so this section says what it watches, what it sends us, and how you stop it. All of it is about the popup: a form sitting in a page does none of these things.

What the script watches

Only what the form's owner switched on. A popup can be set to open when your pointer moves toward the top of the window, when you switch tabs or click away, when you scroll past a point on the page, when you click a particular thing, when part of the page comes into view, after a set time, or after a stretch with no activity. To notice those, the script listens for ordinary browser events: pointer movement, key presses, scrolling, clicks, touches, and the window losing focus. It reads none of what you type until you choose to submit the form, and it sees nothing outside the page it is running on.

What is kept on your device

One entry in your browser's local storage, named kiroku:popup: followed by the form's id. It records when that popup was last shown to you and whether you already answered it, so it does not reopen on every page you visit. The entry stays on your device and is never sent to us. Our form script sets no cookies of its own, on any site.

What is sent to us

Three counts, and nothing else: that a popup was shown (popup_shown), that someone filled in the form it offered (popup_converted), and that someone closed it without filling it in (popup_declined). Each one carries the form's id, which of the settings above opened it, the address of the page, and the address of the page you arrived from. None of them carries your name, your email address, or anything you typed. The message reaches us as an ordinary web request, so it carries your IP address; we use that to limit how often the address can be called, and we do not record it against the count.

How your consent choice is honoured

We show you no cookie banner of our own. A second banner on a site that already has one would be worse for you than either alone, so we read the answer you gave the site's own banner instead. The form's owner tells us where their banner keeps that answer: in a cookie, in browser storage, on the page itself, or in the site's Google consent settings. If the answer is no, the popup still opens and still works, and none of the three counts above is sent. If the site has no cookie banner at all, there is nothing for us to read and the counts above are still sent, which is a disclosure that site's owner is responsible for making to you.

How to withdraw

Change your answer in the site's own cookie banner. We re-read it about once a second while you are on the page, so a change to no takes effect during your visit rather than on your next one: the script drops every listener described above, cancels its timers, and sends nothing further. Blocking cookies and site data for that site in your browser also clears the stored entry above.

Form views are counted separately

Apart from popups, our script counts once each time one of our forms loads on a page, so its owner can see how many people reached it. That count carries the address of the page, the address of the page you arrived from, your browser's user-agent string, and the network portion of your IP address: the last part is cut off before the count is stored, so what we keep looks like 203.0.113.x and not like the address the request came from. Stored beside it is the country, region and city our hosting provider resolves from the address at its edge, before the request reaches us. The consent setting described above does not govern any of this, because the count goes out as the form starts loading, before we know what that setting says. As with form submissions, the owner of the site is the data controller here and is responsible for describing this in their own privacy policy.

You can connect a Google account so that submissions to your forms are written into a Google Sheet. This section says exactly what we do with that access, because Google requires us to and because it is the sort of thing you should be able to check. It applies only if you connect the integration; nothing here happens otherwise.

What we ask for

One permission: https://www.googleapis.com/auth/spreadsheets, which lets us read and write Google Sheets. We ask for nothing else. In particular we do not ask for access to your Google Drive, so we cannot see, list or open any other file in your account, and we cannot read your email, contacts or calendar.

What we do with it

Only what the integration is for. We create a new spreadsheet when you ask us to, or open the one whose link you paste. In that spreadsheet we read the first row of the tab you chose, to see what the columns are; we add a row each time somebody submits your form; and we update the status cell of a row when a submission's status changes. We look up rows by submission id to do that. We do not read any other part of the spreadsheet, and we touch no other file.

What we store, and where

The access and refresh tokens Google issues, encrypted with AES-256-GCM in our database, plus the id of the spreadsheet you chose and the name of the tab. The tokens are what let us write the next submission without asking you to sign in again. Nobody at KirokuForms reads your spreadsheet content; we write to it and do not copy it back.

What we never do

We do not sell data obtained through Google APIs, we do not transfer it to anyone except as needed to provide this feature or where the law requires it, we do not use it for advertising, and we do not use it to train artificial-intelligence or machine-learning models. KirokuForms' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How to disconnect

Open the Google Sheets settings for your form and choose Disconnect. We hand the permission back to Google straight away and delete the stored tokens, so we can no longer reach the spreadsheet. Rows already written stay in your sheet, because it is your file. You can also withdraw the permission yourself at any time from your Google account's third-party access page, which has the same effect from Google's side.

We implement appropriate technical and organizational measures to protect your information:

• All data is encrypted in transit using TLS/SSL
• Data at rest is encrypted in our database
• Access to your data is limited to authorized personnel
• Regular security assessments and testing

While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

Depending on your location, you may have certain rights regarding your personal information:

European Economic Area (EEA), UK, and Similar Jurisdictions

Under the General Data Protection Regulation (GDPR) and similar laws, you have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your data (in certain circumstances)
• Restrict or object to processing
• Data portability
• Withdraw consent
• Lodge a complaint with a supervisory authority

California Residents

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), you have the right to:

• Know what personal information is collected about you
• Access your personal information
• Delete personal information (with exceptions)
• Opt-out of the sale or sharing of personal information
• Non-discrimination for exercising your rights

Exercising Your Rights

To exercise any of these rights, please contact us at privacy@chelseaai.co.uk. We will respond to your request within the timeframe required by applicable law.

We retain your information for as long as necessary to provide our services and fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

Account Information

We retain your account information for as long as your account is active. If you close your account, we will delete or anonymize your account information within 90 days, except where:

• We need to maintain records for legal purposes
• We need to retain certain information to protect our legal interests
• We are required to retain data to comply with regulatory requirements

Form Submission Data

We retain form submission data according to your instructions:

• Active accounts: Data is retained until you delete it or close your account
• Account closure: You may export your data before closing your account
• After account closure: Form submission data is deleted within 90 days

Counts From Our Form Script

The counts described under "Popups on Sites That Embed Our Forms" are kept for 365 days and then deleted by a job that runs every night. On our paid plans the form's owner can change that period in their KirokuForms settings, to as little as 7 days or as long as 3 years, which is the longest period any account can set. Whichever period they choose applies to every count on their forms. Counts recorded before 5 September 2026 still hold a whole IP address rather than its network portion, and are deleted at the end of the same period.

Chelsea AI Ventures Ltd is registered in England and operates from London, United Kingdom.

The service and its database run in the United Kingdom and the European Union, and nowhere else. Requests are served from London, with Frankfurt configured as a secondary European region, and the database holding your account and your form submissions is hosted in London.

Some providers we depend on are based outside the UK and EEA, so a limited amount of personal data reaches them:

• Payments. Stripe processes subscription payments and holds the billing details you give it. We never receive or store your card number.
• Email. Google Workspace delivers the email we send you, so your address and the contents of those messages pass through it.

Where personal data does leave the UK or EEA, the transfer relies on the safeguards that provider offers, which for both of the above are the UK International Data Transfer Addendum and the Standard Contractual Clauses approved by the European Commission.

If you connect an integration to your account (for example a spreadsheet, a chat tool, or a CRM), submissions you route to it are sent wherever that service operates. You choose those connections and the receiving service's own privacy policy governs what it does with the data.

Our Service is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If we learn we have collected personal information from a child under 16, we will delete that information promptly.

If you are a parent or guardian and believe we may have collected information about your child, please contact us at privacy@chelseaai.co.uk.

We may update our Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last updated" date at the top of this page
• Sending an email notification for significant changes

We encourage you to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

If you have any questions about this Privacy Policy or our data practices, please contact us:

Chelsea AI Ventures Ltd
Attn: Privacy Officer
41 Abbey Gardens, London W6 8QR
Email: privacy@chelseaai.co.uk

If you have a data protection concern and are located in the EU/EEA, our Data Protection Officer can be contacted at dpo@chelseaai.co.uk.