Privacy Policy

Last updated 30 September 2026

Submitly Form Builder (“the app”) lets Shopify merchants build forms and show them on their online store. This policy explains what data the app handles, why, and what rights you have. “Merchant” means the store owner who installs the app. “Visitor” means a person who fills in a form on a merchant’s store.

Who is responsible for the data

For the answers a visitor submits, the merchant decides why and how they are used, so the merchant is the data controller and we act as their processor. For merchant account data, we are the controller.

What we collect from merchants

• Store details from Shopify: the store domain, the store owner’s name and email address, and the access permissions granted to the app.
• The forms, templates, settings and integration connections the merchant creates, and the notes, tags, lead stages, follow-up dates and owner names a merchant adds to submissions.
• Contact records, built from the name, email address and phone number on a visitor’s submissions, so that all of one person’s submissions can be seen together.
• Plan and billing status, which Shopify manages. We never see payment card details.
• Usage counts, such as submissions received and emails sent, to apply plan limits.

What we collect from visitors

• Everything the visitor types or uploads into a form, such as name, email address, phone number, messages and files.
• The visitor’s IP address and browser type, recorded with each submission for spam protection.
• If the visitor is logged in to the store, their Shopify customer ID.

We do not set cookies or use advertising trackers, and we do not sell personal data. A form keeps the page a visitor arrived on, and a password-unlock token for protected forms, in the browser’s session storage until the tab is closed.

How we use data

• To show the forms and save submissions in the merchant’s inbox.
• To email submission notifications and automatic replies the merchant has set up.
• To send submissions to the services a merchant chooses to connect.
• To detect spam, apply plan limits, provide support and keep the app secure.

Who we share data with

We share data only as needed to run the app:

• Shopify, which hosts the store and the app’s installation.
• Our hosting provider, where the app and its database run.
• An email delivery service, which sends notification and reply emails.
• An AI provider, used only when a merchant asks the app to draft a form. It receives the description the merchant types, not visitor submissions.
• Services the merchant connects, such as Klaviyo, Mailchimp, Omnisend, HubSpot, Google Sheets, Google Calendar, Slack and Shopify Flow. Submission data is sent to them only after the merchant turns the connection on, and their own privacy policies then apply.

Retention

Merchant data and submissions are kept while the app is installed. When a merchant uninstalls the app, Shopify sends us a request to erase the store’s data, and we delete its forms and account records. Merchants can also delete individual submissions and forms at any time.

Your rights

Depending on where you live, including under the GDPR and the CCPA, you can ask to see, correct, export or delete your personal data. The app supports Shopify’s customer data request and customer erasure requests, which merchants receive from Shopify. If you are a visitor, please contact the store you submitted the form to first. You may also contact us through the contact address on our Shopify App Store listing, and we will help or pass your request to the right store.

Security

Data is sent over encrypted connections, access to the app is limited to the merchant’s own store, and integration credentials are stored encrypted. No system is perfectly secure, but we work to protect the data we hold.

International transfers

Data may be processed in countries other than your own. Where required, we rely on appropriate safeguards for such transfers.

Children

The app is for merchants and is not directed at children under 16.

Changes

We may update this policy. The date at the top shows the latest version, and we will notify merchants of material changes.

Contact

Questions about this policy can be sent through the contact address on our Shopify App Store listing.