Privacy Policy

Goup Apps Inc. ("we," "us," or "our," incorporated in the Province of British Columbia, Canada) operates the GenForm form management platform. This Privacy Policy explains how we collect, use, disclose, and protect your personal information, and applies to all personal information you provide through our website and services.

We process your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and the British Columbia Personal Information Protection Act (PIPA). By using our services, you consent to the data practices described in this policy.

1. Data Controller

The data controller for your personal information is:

2. Information We Collect

2.1 Information You Provide

• Account information: email address, display name
• Third-party login information: basic profile data obtained when you sign in with Google
• Form content: form structures, field configurations, and settings you create
• Submission data: data collected from third parties through forms you publish
• Uploaded files: PDF templates and other documents you upload
• Communications: correspondence with our support team

2.2 Information Collected Automatically

• Device information: browser type, operating system, screen resolution
• Log information: IP address, access time, pages viewed
• Usage data: feature usage frequency, performance metrics, error reports
• Cookie data: see Section 8 for details

3. Purpose of Use

In accordance with PIPEDA Principle 2 (Identifying Purposes), we use your personal information only for the following specified purposes:

• Service delivery — Operating core features including form building, data collection, and PDF export
• Account management — Authentication, access control, and permissions management
• Service notifications — Sending important notices related to your account (security alerts, feature changes)
• Security — Detecting fraud, preventing abuse, and addressing security threats
• Service improvement — Analyzing usage patterns to enhance the product experience
• Legal compliance — Meeting requirements under applicable laws and regulations

We will not use your personal information for purposes other than those stated above without first obtaining your consent.

4. Consent

In accordance with PIPEDA Principle 3 (Consent), we obtain your informed consent when collecting, using, or disclosing your personal information.

• Express consent — By registering an account and using our services, you expressly consent to the data practices described in this policy
• Implied consent — For data processing essential to service operations (such as security logging), we process data based on reasonable expectations
• Withdrawal of consent — You may withdraw your consent at any time, though this may affect our ability to provide services. To withdraw consent, please contact privacy@genform.app

5. Data Disclosure and Sharing

We do not sell your personal information. We disclose data only in the following circumstances:

• Service providers — Third parties that assist us in operating our services (see Section 7), with whom we have data protection agreements in place
• With your consent — When you have given explicit authorization
• Legal requirements — When required by Canadian law, court order, or governmental authority
• Security protection — When reasonably necessary to protect our users, the public, or our legitimate interests
• Business transfers — In connection with a merger, acquisition, or sale of assets, in which case we will provide advance notice

6. Cross-Border Data Transfers

Your data is stored on Google Cloud Platform (Firebase) data centers located in the United States. This means your personal information is transferred from Canada to the United States for processing and storage.

In compliance with PIPEDA's cross-border transfer requirements, we protect your data through the following measures:

• Entering into industry-standard data protection agreements with data processors
• Ensuring data processors provide a level of protection comparable to Canadian standards
• Implementing technical and organizational security measures (see Section 9)

Please note that privacy laws in the United States may differ from those in Canada. Data stored in the United States may be subject to U.S. laws, including potential government access requests.

7. Third-Party Service Providers

We use the following third-party services to operate GenForm. Each provider has its own privacy policy:

8. Cookies and Similar Technologies

We use cookies and similar technologies for the following purposes:

You may manage or disable cookies through your browser settings. Disabling essential cookies may prevent the service from functioning properly.

9. Data Security

In accordance with PIPEDA Principle 7 (Safeguards), we employ the following measures to protect your personal information:

• Encryption in transit: all data transmissions use TLS/SSL encryption
• Encryption at rest: data is encrypted using AES-256 (provided by Google Cloud)
• Access controls: multi-tenant data isolation with role-based access permissions
• Authentication: Firebase Authentication with App Check application verification
• Rate limiting: API call frequency limits to prevent abuse
• Audit logging: sensitive operations are recorded in audit logs with automatic redaction of sensitive fields

While we take reasonable measures to protect data security, no method of internet transmission or electronic storage is 100% secure.

10. Data Retention

In accordance with PIPEDA Principle 5 (Limiting Use, Disclosure, and Retention), we retain data according to the following schedule:

11. Your Rights

Under PIPEDA and BC PIPA, you have the following rights:

• Right of access — Request a copy of the personal information we hold about you
• Right of correction — Request correction of inaccurate or incomplete personal information
• Right of deletion — Request deletion of your personal information and account
• Data portability — Export your data in common formats (Excel/PDF)
• Withdrawal of consent — Withdraw previously given consent to data processing at any time
• Right to challenge compliance — Challenge our privacy practices

To exercise any of these rights, please email privacy@genform.app. We will respond to your request within 30 days.

12. Data Breach Notification

In the event of a security breach involving your personal information that creates a real risk of significant harm, we will:

• Notify affected individuals as soon as feasible
• Report the breach to the Office of the Privacy Commissioner of Canada (OPC)
• Maintain detailed records of the breach
• Implement remedial measures to prevent similar incidents

13. Children's Privacy

Our services are intended for business users and are not directed at individuals under the age of 16. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact privacy@genform.app immediately, and we will promptly delete the relevant data.

14. Policy Updates

We may update this Privacy Policy from time to time. The updated policy will be posted on this page with a revised effective date. For material changes, we will notify you in advance by email or through an in-service notification. Continued use of our services constitutes acceptance of the updated policy.

15. Contact Us and Complaints

If you have any questions or complaints about this Privacy Policy or our data practices: