Back to home

Your information

Privacy Policy

This notice explains how Gorilla Forms handles personal information under the UK GDPR and Data Protection Act 2018.

Effective 1 September 2026 · Last updated 12 September 2026

1. Who we are and how to contact us

Gorilla Forms operates gorillaforms.uk and is the controller of personal information used to provide and secure customer accounts, administer the Service and communicate with customers.

For privacy questions or to exercise your rights, email privacy@gorillaforms.uk.

2. Form owners and respondents

A Gorilla Forms customer who creates a form normally decides why respondent information is collected and how it will be used. That form owner is normally the controller of the answers submitted to their form, while Gorilla Forms stores and processes those answers on the form owner’s behalf.

Respondents should read any privacy notice supplied by the form owner and contact that owner first about the content of a form, the reason information was requested, or use of an individual response. Gorilla Forms remains responsible for operating and securing the platform.

3. Information we collect

Depending on how you use the Service, we may handle:

  • Account and profile information: email address, password hash, name, company, website, postal address, account role and account dates.
  • WordPress connections: the connected website address, an identifier, approved permissions, connection and last-use dates, and a one-way hash of the revocable access token. The encrypted token itself is stored by the connected WordPress website.
  • Forms and responses: form titles, questions, settings, uploaded images, response dates and answers supplied by respondents. For each submitted response, we also record the respondent’s IP address, browser and operating-system user-agent information, and the referring page where the browser supplies one. This may include contact details, signatures, vehicle registration numbers and associated public vehicle details, or other personal information chosen by the form owner.
  • Saved form drafts: when a respondent chooses Save & Continue Later, we store the email address they provide and the incomplete answers needed to restore their progress, and use the email address to deliver the requested secure return link.
  • Form interaction analytics: a randomly generated visit identifier, whether a form was started or completed, and the furthest question reached. These analytics do not separately store the visitor’s IP address, browser details or answer contents.
  • Tracked QR Code analytics: when a tracked QR Code is scanned, we record the scan time, IP address, browser and operating-system information, device category and available referrer. This information is shown privately to the QR Code owner for analytics, security and fraud prevention.
  • Email automations: conditional rules, message content, intended recipient source and delivery status. When a rule emails a respondent, the address supplied in that response is used to deliver the message selected by the form owner.
  • Gorilla AI information: the purpose, intended audience and approximate question count entered for AI generation, the generated draft, usage time and the form created from it. When a form owner requests AI response insights, we also process a limited, privacy-filtered sample of selected answers and store the resulting insight report.
  • Security and technical information: essential session identifiers, login-attempt information, a one-way hash derived from login or registration details and IP address for rate limiting, and server security logs.
  • Payment information: where payment features are enabled, transaction references, status and related records received from payment providers. Full card details are handled directly by the payment provider and are not intended to be stored by Gorilla Forms.
  • Communications: information you include when contacting us or requesting support.

Form owners decide which questions to ask. They should avoid collecting more information than necessary and must have an additional UK GDPR condition before collecting special-category information such as health, biometric, religious or political information.

4. How and why we use information

We use personal information only where we have a lawful basis:

  • Contract: to create and manage accounts, provide the form builder, store forms and responses, generate requested AI drafts, provide exports and deliver paid features.
  • Legitimate interests: to secure the Service, prevent misuse and fraud, investigate suspicious or duplicate submissions, provide response provenance to form owners, diagnose faults, provide support, understand essential service usage and improve reliability. Our interests are operating a safe, effective form service and protecting customers and respondents.
  • Legal obligation: to comply with tax, accounting, regulatory, court and law-enforcement requirements that apply to us.
  • Consent: where we specifically ask for optional permission, such as certain marketing or non-essential cookies. You can withdraw consent at any time.

When Gorilla Forms processes form answers and submission metadata on a form owner’s behalf, the form owner is responsible for identifying and explaining the lawful basis for that collection.

5. Gorilla AI

Gorilla AI uses a third-party AI service provider to turn a customer’s description into an editable form draft. The description, intended audience, requested question count and necessary generation instructions are sent securely to that provider. We do not intentionally send account profile details unless a customer includes that information in the description.

When a form owner chooses to generate response insights, a limited sample of selected answers is sent securely to the same type of provider. We exclude fields that are clearly intended for contact details and attempt to remove obvious email addresses, telephone numbers and links before sending the sample. This filtering cannot guarantee that every piece of personal information will be removed, so form owners must not use AI response insights for forms collecting confidential, special-category or other sensitive personal information.

AI output may be inaccurate and must be reviewed. Gorilla AI creates suggested content and broad response insights; it must not be used to make decisions about people that produce legal or similarly significant effects.

6. Who receives information

We share information only as needed with:

  • the form owner and authorised people using that account;
  • a WordPress website and its authorised administrators when the form owner expressly connects the Gorilla Forms plugin;
  • hosting, database, storage, security and technical service providers;
  • our third-party AI service provider when Gorilla AI is used;
  • Stripe, PayPal or another payment provider when the relevant payment option is used;
  • professional advisers, insurers, auditors or a purchaser of the business where necessary and subject to appropriate confidentiality;
  • courts, regulators, law-enforcement bodies or other authorities where disclosure is legally required or necessary to protect legal rights.

We do not sell personal information.

Slack integrations

When an account connects Slack and enables a form automation, the selected message and any included answers are sent to the authorised Slack channel. Channel members and the connected workspace may access and retain those messages under their own settings and policies. We store workspace and channel identifiers, an encrypted webhook credential, automation settings and delivery status. Sharing is optional; form owners must ensure recipients are authorised to receive the information. Disconnecting stops future messages but does not delete messages already delivered to Slack.

7. International transfers

Some technology providers may process information outside the United Kingdom. Where UK personal information is transferred internationally, we use an applicable UK adequacy regulation or appropriate safeguards such as the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses, or another lawful transfer mechanism. You can contact us for more information about the safeguards relevant to your information.

8. How long we keep information

We keep account, form and response information while it is needed to provide the Service and until it is deleted by the customer, the account is closed, or the information is removed under our inactivity rules. Saved but unsubmitted form drafts contain the respondent's email address and the answers entered so far. Their secure return links expire after 30 days, and the draft is removed when the form is successfully submitted or after expiry.

Under the Terms of Service, forms and associated responses may be removed after a continuous six-month period in which the account holder has neither logged in nor received a response on the relevant form.

We retain security, support, acceptance and transaction records for as long as reasonably necessary to prevent abuse, meet legal and accounting obligations, resolve disputes and establish or defend legal claims. When information is no longer required, we delete it or anonymise it. Backup copies may remain for a limited period until securely overwritten.

9. Cookies

Gorilla Forms currently uses an essential session cookie named gorillaforms_session. It keeps users signed in, protects forms against cross-site request forgery and supports form confirmation screens. It is secured with Secure, HttpOnly and SameSite=Lax settings and normally expires when the browser session ends.

We do not currently use advertising or analytics cookies. If non-essential cookies are introduced, we will provide appropriate information and obtain consent where required.

10. Your data-protection rights

Depending on the circumstances, you may have rights to:

  • be informed about use of your information;
  • request access to it and receive a copy;
  • correct inaccurate or incomplete information;
  • request deletion or restriction;
  • object to processing based on legitimate interests or to direct marketing;
  • receive information you supplied in a portable format where the right applies;
  • withdraw consent without affecting earlier lawful processing;
  • challenge qualifying solely automated decisions.

These rights are not absolute and exemptions may apply. We may request enough information to confirm your identity. We normally respond within one month. Respondents asking about an answer should contact the relevant form owner first; we will assist that owner where required.

11. Security

We use measures designed to protect information, including encrypted HTTPS connections, password hashing, secure session cookies, access controls, rate limiting, CSRF protection and restricted private configuration. No internet service can guarantee absolute security. Customers must protect their passwords and control who can access their accounts and exported responses.

12. Children

Gorilla Forms is not designed for children to open and manage their own customer accounts. A form owner collecting information about or from a child is responsible for using age-appropriate wording, identifying an appropriate lawful basis and applying the additional protections required by law.

13. Complaints

Please contact us first so we can try to resolve your concern. You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk.

14. Changes to this policy

We may update this policy when the Service, our suppliers or the law changes. The latest version will be published here with a revised update date. We will take reasonable steps to highlight material changes to account holders.