Last updated October 28, 2026
Privacy Policy
This Privacy Policy explains how Dculus Software (“Dculus”, “we”, “us”) handles personal data when you visit dculus.com, use the hosted Dculus Forms service at forms.dculus.com, or fill in a form built with it.
It does not cover self-hosted installations of Dculus Forms. Whoever runs a self-hosted installation is responsible for the data in it.
Who we are
Dculus Forms is run by Dculus Software, the trading name of its founder, an individual based in India. Dculus Software is not yet a registered company. If we incorporate, the new company will take over this policy, and we will tell you before that happens.
1. Our two roles
- For account holders and website visitors, we are the controller. We decide how your data is used, as described in this policy.
- For form responses, we are the processor. The organisation that published the form is the controller. If you filled in a form, contact that organisation about your response. We process responses only on their instructions and under our Terms of Service.
2. Data we collect
Account data. Your name, email address, password (stored hashed), profile picture, and the organisations you belong to. If you sign in with Google, we receive your name, email address and profile picture from Google.
Your content. The forms, templates, files, settings and integrations you create.
Form responses. The answers and files respondents submit. If a form requires sign-in, the respondent’s account is linked to their response. Edits to a response are recorded with the editor, time, IP address and browser.
Form analytics. When someone views or submits a form, we record an anonymous session ID, the browser, operating system, device type, language, time zone, approximate location (country, region and city, derived from the IP address) and time taken to complete the form. We use this to show form owners aggregated analytics.
Billing data. Your plan, billing address and invoices. Card details are collected and stored by our payment processor, Chargebee. We never see your full card number.
AI feature data. The prompts you send to AI features and the form or response data needed to answer them, plus usage counts such as the number of tokens processed.
Technical data. IP address, browser and device information, and error reports, used to keep the Service secure and working.
Website analytics. On dculus.com we use Google Analytics, Google Tag Manager and Mixpanel to understand which pages people visit and which links they click. These tools set cookies or similar identifiers.
Support messages. What you send us when you contact us.
3. How we use data
- to provide, maintain and secure the Service;
- to create and manage your account and send service emails, such as verification codes, invitations and password resets;
- to process payments and enforce plan limits;
- to provide form analytics to form owners;
- to run AI features you choose to use;
- to understand and improve how the website and Service are used;
- to prevent fraud, abuse and phishing; and
- to comply with legal obligations.
We do not sell personal data, and we do not use your content or form responses to train AI models.
4. Legal bases
Where the EU or UK GDPR applies, we rely on: contract, to provide the Service you signed up for; legitimate interests, to secure, analyse and improve the Service and prevent abuse; consent, for non-essential cookies and analytics where required; and legal obligation, for tax, accounting and lawful requests.
Under India’s Digital Personal Data Protection Act, 2023, we process your data on the basis of your consent or for legitimate uses the Act allows, such as providing a service you asked for.
5. Who we share data with
We share personal data only with service providers that help us run the Service, under contracts that require them to protect it and use it only on our instructions:
| Provider | Purpose | Location |
|---|---|---|
| Microsoft Azure | Application hosting | India |
| Microsoft Azure OpenAI | AI form building and insights | United States |
| Neon | Managed PostgreSQL database | Singapore |
| Cloudflare | File storage, CDN and network security | Asia-Pacific and global edge |
| Amazon Web Services (SES) | Transactional email | India |
| Chargebee | Subscription billing and payments | United States |
| Sentry | Error monitoring | United States |
| Optional sign-in with Google; website analytics | United States | |
| Mixpanel | Website analytics (dculus.com only) | United States |
If you connect an integration, such as a webhook or email notification, form data is sent to the destination you configure. We may also disclose data when the law requires it, to protect rights and safety, or as part of a merger or acquisition, in which case this policy continues to apply.
6. International transfers
Our application servers are in India and our database is in Singapore. Some providers, listed above, process data in other countries. Where data leaves the European Economic Area or the UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
7. How long we keep data
- Account data and your content are kept while your account is active. When you delete your account, we delete it within 30 days.
- Form responses are kept until the form owner deletes them, or deletes the form or account.
- Backups are overwritten within 30 days.
- Billing records are kept as long as tax and accounting law requires.
- Temporary export files are deleted after 5 hours.
8. Security
We encrypt data in transit with TLS, store passwords hashed, keep uploaded response files in private storage reachable only through short-lived signed links, and restrict access to customer data to people who need it. No system is perfectly secure. If a breach affects your personal data, we will notify you and the authorities as the law requires.
9. Your rights
Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict how we use it, and withdraw consent at any time. You can update most account data in your account settings. For anything else, email [email protected]. We will respond within 30 days.
If you filled in a form, send requests about your response to the organisation that published it. We will help them respond.
You also have the right to complain to your local data protection authority, or, in India, to the Data Protection Board of India.
10. Cookies and local storage
The Service uses strictly necessary cookies to keep you signed in. Public form pages use your browser’s local storage to keep respondents signed in where a form requires it, and to store an anonymous analytics session ID and the time a form was started. On dculus.com, analytics cookies are set by Google Analytics and Mixpanel. You can block or delete cookies in your browser settings.
11. Children
The Service is not directed at children. Account holders must be at least 18. Form owners who collect data from children are responsible for obtaining the consent the law requires.
12. Changes to this policy
We may update this policy. For material changes we will notify account holders by email or in the Service before they take effect. The date at the top shows when it was last changed.
13. Contact and grievances
For privacy questions, requests or complaints, including grievances under India’s Digital Personal Data Protection Act, email [email protected]. The founder handles these requests personally.