Privacy Policy
Version 1.3, effective 10 October 2026 · History
In short
- We collect what we need to run your account and create what you ask for, nothing more.
- Your prompts and files go to our AI providers only to produce your results. We don't use them to train AI models, and neither do Google or Anthropic under their paid API terms.
- Your account and files are stored in the EU. Our AI providers process prompts and files, some in the US, under EU-approved safeguards.
- You can download or delete everything in Account at any time.
Who is responsible
SIA Inksform (InksForm), Nometnu iela 3-14, Riga, LV-1048, Latvia, registration number [Registration number], is the controller of the personal data described here. Contact us about privacy at info@inksform.com.
When you put personal data about other people into InksForm, for example photos, customer lists or contact details in your documents, sheets and sites, you are the controller of that data and we process it for you under our Data Processing Agreement. Forms on sites connected to your own Supabase project save straight to your project; we don't receive those submissions.
What we collect
- Account: email address, name, username, profile picture and bio, sign-in records.
- Your work: prompts, uploads, and the images, videos, audio, sites, documents and chats you create, plus the projects, folders and sharing settings around them.
- Voice: recordings you make for dictation or talk mode, sent to ElevenLabs to turn into text.
- Usage and credits: which tools you use, credits spent and bought, and plan status.
- Personalisation: your answers when you set up InksForm (who you make things for, what you want to make first, your business's name, field and country, your experience), and, while "Learn from how I work" is on, small counts of which tools you open and finish, what kind of work you keep, delete or export, whether you pick Light or Pro, and the part of the day you work. Never what you make, type or upload.
- Payments: handled by the seller shown at checkout. We receive plan status and the last digits of the card, never the full card details.
- Connections: keys for services you connect yourself (Claude, GitHub, Vercel, your Supabase), stored encrypted.
- Community and messages: posts, comments, likes, reports and messages you send.
- Invitations: when someone invites you to a workspace or shares work with you by email, your email address and the invitation.
- Legal forms and contact: your name, email and what you tell us when you report content, withdraw from a purchase, subscribe to updates or write to us, and which versions of the Terms your account accepted.
- Technical: IP address, device and browser details, and error logs, kept briefly for security.
You need an email address to have an account; without it we can't provide the service. Everything else is optional.
Why we use it, and on what legal basis
- To provide the service you signed up for: contract (GDPR Art. 6(1)(b)).
- To keep the service secure, prevent abuse and fix problems: legitimate interests (Art. 6(1)(f)).
- To improve the service with aggregated usage statistics: legitimate interests. We don't sell data or build advertising profiles.
- To personalise the service for you (where to start, the order of your tools and Home, Light or Pro) from your setup answers and the personalisation counts: legitimate interests (Art. 6(1)(f)). It only rearranges and suggests within InksForm, tells you why with an Undo, never changes your privacy, sharing, notification, payment or accessibility settings, isn't shared with anyone and doesn't train AI. Turn it off in Settings → AI features, which also deletes the counts.
- To send product news: only with your consent (Art. 6(1)(a)), which you can withdraw at any time.
- To handle content reports and withdrawals, keep records of them, keep accounting records and answer lawful requests: legal obligation under the Digital Services Act, consumer law and accounting law (Art. 6(1)(c)).
AI processing
When you create something, your prompt and the files you choose are sent to the AI provider that makes the result (see the list below). They process it to return your result: Anthropic's Claude writes text, code, the assistant's answers and research reports, and Google's Gemini and Veo make pictures and video and read audio and video. Neither uses it to train its models under its paid API terms. We don't train models on your content.
How we mark AI results is explained in AI at InksForm.
Transfers outside the EU
Your account and your work are stored in the EU (Ireland). Some providers process data in the United States, under the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses, as shown for each in the table above. You can get a copy of the safeguards we rely on by writing to info@inksform.com.
How long we keep it
- Your account and work: while your account is open. Deleted items stay in Recently deleted for 30 days, then are removed for good.
- Database backups: up to 35 days after deletion.
- Personalisation counts: they fade within weeks, and are deleted when you remove an item, reset them or turn learning off in Settings → AI features, or delete your account.
- Technical and security logs: up to 90 days.
- At our AI providers: Google keeps prompts and results for a limited time only to detect abuse, uploaded files for up to 48 hours, and generated videos for about 2 days so you can extend them. Anthropic deletes prompts and results within 30 days, and keeps ones its safety systems flag as misuse for up to 2 years.
- Content reports and our decisions: 3 years after they're closed.
- Withdrawal requests and accounting records: for the periods Latvian accounting and tax law require (generally 5 years).
- Records of which terms you accepted: while your account is open.
- Update subscriptions: until you unsubscribe.
- After you delete your account, we remove your data within 30 days, except what the law requires us to keep.
Your rights
You can access, correct, download or delete your data, restrict some uses, and withdraw consent at any time without affecting what happened before. Most of this is in Account (Download my data, Delete account). For anything else, write to info@inksform.com; we answer within one month (at most two more for complex requests, and we'd tell you why).
Your right to object: where we rely on legitimate interests (security, abuse prevention, usage statistics), you can object at any time for reasons relating to your situation, and we stop unless we have compelling legitimate grounds or need the data for legal claims.
Automated decisions: we don't make decisions with legal or similarly significant effects on you based only on automated processing. Community posts go through an automated safety check before they appear, and a post reported by three people is hidden until a person reviews it; you can ask for a person to review any such decision at info@inksform.com.
You can also complain to the Data State Inspectorate of Latvia (Datu valsts inspekcija) or the data protection authority where you live.
Security
Data is encrypted in transit and at rest. Keys you connect are sealed with AES-256-GCM and only unsealed on the server when needed. Access is limited by strict database rules, and the database is backed up daily.
If a breach affects your data, we tell you and the authority as the law requires.
Children
InksForm is not meant for people under 18, and we don't knowingly collect their data.
Changes
We tell you about material changes in the app and by email before they take effect. Every version and what changed is listed in this page's history.