1. Who we are and our two roles
Contact (“Contact”, “we”, “us”) is a form-backend service operated by Kiran Dhakal in Nepal and available at https://form.kirandhakal.me. This policy applies to the Contact website, dashboard, API, and the forms our customers embed on their own websites.
We act in two distinct roles:
- Controller of account data. We decide how account, workspace, and service data are used. For that data we are the data controller.
- Processor of visitor submissions. When a visitor submits a form on a customer’s website, the customer (the “form owner”) decides what to collect and why. We process that data only to provide the service on the form owner’s instructions. The form owner is the controller and must inform their own visitors about what they collect, why, and for how long.
If you submitted a form and want to exercise your rights, please contact the form owner first. We will assist them in responding.
2. Data we collect
- Account details: workspace name, email address, a hashed password, optional phone number, and role.
- Session cookie: an HTTP-only cookie used to keep you signed in.
- Form settings: form names, field schema, allowed origins, success messages, honeypot settings, and delivery/integration configuration.
- Submissions: the field values a visitor enters, together with metadata such as status, source origin, and timestamps.
- Uploaded files: files submitted through a form that has uploads enabled. Files are stored in object storage.
- IP address and log data: used for spam prevention, rate limiting, and security. Where used for rate limiting, IP addresses are stored in hashed form.
- Bot verification: Cloudflare Turnstile is used at signup and on our public contact page to distinguish humans from bots.
- Contact-page messages: messages you send through our own contact page. These are visible only to service administrators.
Please avoid submitting passwords, payment card details, government identifiers, or other sensitive information through a form unless it is genuinely necessary.
3. Why we use data
- To create and manage your account and workspace.
- To receive, store, display, and deliver form submissions to the destinations the form owner configures.
- To send transactional email such as verification codes and password resets.
- To prevent spam and abuse, enforce rate limits, and keep the service secure.
- To respond to messages sent through our contact page.
- To comply with legal obligations.
4. Legal bases
We process personal data in line with Nepal’s Privacy Act, 2075 and other applicable law. Account data is processed to perform our contract with you. Security, spam prevention, and service integrity are processed for our legitimate interests in operating a safe service. Where consent is required, we rely on your consent, which you may withdraw at any time.
6. How we protect data
- Integration credentials (SMTP passwords, SMS tokens, webhook URLs and secrets) are encrypted at rest.
- Access is scoped to the workspace: workspace members can only see their own data.
- Session cookies are HTTP-only and SameSite-restricted.
- Traffic is encrypted in transit using HTTPS.
No online service can guarantee absolute security. See section 13 for our breach notification commitment.
8. Retention and deletion
- Submissions are retained for the form owner’s configured retention period (default 90 days) and are then automatically deleted, including attached files.
- Uploaded files that are never attached to a submission are purged after a short window (default 1 hour).
- Account data is retained while your workspace is active. When you delete your workspace or account, we delete or anonymize associated data, subject to legal and backup requirements.
- Contact-page messages are retained until a service administrator deletes them.
- Form owners can delete submissions and files manually from the dashboard.
9. Backups
We keep periodic backups so we can recover from failures. Backups are protected with the same access controls as live data and are deleted on a rolling schedule. Data you delete may persist in backups for a limited period before those backups are overwritten.
10. International transfers
We and our infrastructure providers may process data on servers located outside Nepal. Where data is transferred internationally, we take reasonable steps to ensure it continues to be protected.
11. Your rights
You may request access to, correction of, or deletion of your personal data. Workspace owners can update account details and delete data directly from the dashboard. To make a request, email us at the address in section 15; we may need to verify your identity before acting. If you are a form visitor, please contact the form owner first, and we will assist them.
12. Children
The service is not directed to children, and we do not knowingly collect data from children. Form owners are responsible for providing age-appropriate notices on their forms.
13. Breach notification
We apply reasonable technical and organizational security measures. If we confirm a breach that affects your personal data, we will notify affected users within a reasonable time, describing the nature of the breach and the steps we are taking to address it.
14. Changes to this policy
We may update this policy from time to time. When we make material changes we will update the version number and “Last updated” date above and, where required, ask you to re-accept the policy on your next sign-in.
15. Contact
For questions or requests about this policy or your data, email privacy@kirandhakal.me or use our contact page. Contact is operated by Kiran Dhakal (dhakalkiran.com.np).