Privacy Policy

Last updated 16 October 2026

Formhub (formhub.me) is an online forms service run by Business Forms (ABN 71 660 552 223) ("we", "us"). This policy explains what personal information we handle, why, and how we look after it. We follow the Australian Privacy Principles in the Privacy Act 1988.

1. Two kinds of information

About our clients. When a business uses Formhub, we hold information about the business and the people who log in. We are responsible for that information.

In forms. When you fill in a form on Formhub, your answers go to the business that made the form. That business decides what to ask and what to do with your answers, so its own privacy policy applies to them. We store and handle the answers only on that business's behalf.

2. If you filled in a form

• To see, correct or delete your answers, please contact the business whose form it was. If you can't reach them, email us and we'll pass your request on.
• We don't use your answers for our own purposes. We don't sell them, use them for advertising, or use them to train AI.
• Our staff look at answers only when the business asks us to help, or when we must check a form reported for misuse.
• If a form looks like a scam, please use the "Report this form" link at the bottom of it.

3. What we hold about our clients

• Account details: your name, business name, email address and login. Passwords are stored scrambled so that no one can read them, and two-factor login is available for every login.
• Billing: your package, payments and invoices. Card details are handled by Stripe; we never see or store full card numbers.
• Technical details: your IP address, browser and the pages you open, kept in our server logs to protect your account and Formhub.
• Messages: emails you send us.

We use this information to run your account, take payments, keep Formhub secure, help you when you ask, and tell you about important changes to the service. We won't send you marketing emails unless you agree to them, and we never sell your information.

4. Where information is kept

Formhub's server, the database, uploaded files and our nightly backups are all in Sydney, Australia. Files and backups are stored with Amazon Web Services in its Sydney region, and are encrypted.

5. Services we use

We use a few trusted providers to run Formhub. Each gets only what it needs to do its job:

• Amazon Web Services (Sydney): stores files and backups, and sends Formhub's emails.
• Laravel Forge: manages our Sydney server.
• Stripe: handles card payments for packages, and card payments in forms where a business uses them. Stripe may process information outside Australia, including in the United States.
• Cloudflare Turnstile: checks that a real person, not a robot, is sending a form or signing up. It sees your IP address and browser details, and may process them outside Australia.
• Google: suggests Australian addresses as you type in an address box. Only the address text you type is sent, and it may be processed outside Australia.
• Anthropic: when a business chooses to copy an existing form from a PDF, Word file or photo, the file is sent to Anthropic's AI to read and is deleted from Formhub afterwards. When someone using Formhub asks Yasmene, our in-app helper, for help, their question, the names of their forms and companies, what's on the page they're on and the design of the form they're working on are sent to Anthropic to answer it; Formhub doesn't keep the questions. Responses to forms are never sent. Anthropic doesn't use any of it to train its AI, and may process it outside Australia, including in the United States.
• Department of Home Affairs: when a business that is registered with Home Affairs checks a job applicant's work rights, Formhub sends that person's name, date of birth, passport number and passport country to Home Affairs, using the business's own Home Affairs key (a machine credential the business sets up with Home Affairs). This only happens when the business's staff press "Check work rights" and confirm the person agreed. The answer is kept with the response.
• GoDaddy: hosts our own email mailboxes, such as admin@formhub.me.

6. Cookies

Formhub uses only the cookies it needs to work, such as the one that keeps you logged in and a security cookie that stops forged requests. We don't use advertising or tracking cookies. Cloudflare Turnstile may set its own cookie for its robot check.

7. Keeping information safe

• Every page and form is sent over an encrypted connection.
• Two-factor login is available for every Formhub login, a business can ask us to require it for all its logins, and our own staff always use it.
• Uploaded files are kept in private storage and encrypted, and are only shown to logged-in users of the business that owns them.
• We back up every night, and the backups are encrypted.
• Only the people who run Formhub can reach the server, and only when needed.

8. How long we keep information

• Form answers are kept until the business deletes them. When a business closes its account, we keep its data for 90 days and then may delete it.
• Billing records are kept for as long as Australian tax law requires, usually 7 years.
• Deleted information can stay in our nightly backups for up to 30 days.

9. Seeing or correcting your information

Clients can update some of their details, such as their password, in Formhub. For anything else we hold about you, or to ask us to correct it, email admin@formhub.me. For form answers, please contact the business whose form it was (see section 2).

10. If something goes wrong

If there is a data breach that is likely to cause serious harm, we will tell the businesses affected and, where the law requires, the Office of the Australian Information Commissioner (OAIC) and the people affected.

11. Questions and complaints

Email admin@formhub.me and we'll reply within 30 days. If you're not happy with our answer, you can complain to the OAIC at oaic.gov.au.

12. Changes to this policy

If we change this policy, we'll update the date at the top. If a change is important, we'll email our clients first.