Privacy Policy

Effective Date: February 11, 2026 | Last Updated: October 8, 2026

QuikForms, LLC ("QuikForms," "we," "us," or "our") is an Oregon limited liability company. This Privacy Policy describes how we collect, use, disclose, and protect personal information in connection with our website at www.sfquikforms.com (the "Website"), our Salesforce managed package distributed through the Salesforce AppExchange, the QuikForms AI features, and our related services (together, the "Service").

This Privacy Policy applies to four groups of people:

Website Visitors: people who visit the Website;
Customers: the organizations that install or subscribe to QuikForms, and their Salesforce administrators, billing contacts, and other users who interact with us ("Customer Contacts");
End-Users: people who view or submit forms, surveys, or chat forms that a Customer publishes with QuikForms; and
Correspondents: anyone who emails us.

If you submitted a form built with QuikForms, the organization that published the form decides what it collects and what it does with your information. Please read that organization's privacy notice and send your questions and requests to it (see Section 9).

1. Definitions and Roles

For the purposes of this Privacy Policy:

Personal Data (or "Personal Information") means information that relates to an identified or identifiable natural person, as defined by applicable data protection law, including the EU General Data Protection Regulation ("GDPR"), the UK GDPR, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), and other U.S. state privacy laws.
Controller (or "business") means the party that decides why and how Personal Data is processed.
Processor (or "service provider") means a party that processes Personal Data on behalf of a controller and on its instructions.

Our Roles

Context	QuikForms' Role	Explanation
The Website, Customer accounts, licensing, billing, AI usage records, and our correspondence	Controller	We decide why and how this information is processed. Sections 2.1 to 2.6 describe it.
Form submissions and other data the managed package handles in a Customer's Salesforce org, and the content of AI requests	Processor	We process this data only on behalf of the Customer, under our Data Processing Agreement. The Customer is the controller. Section 2.7 describes it.

Customers are the controllers of all data collected through the forms, surveys, and chat forms they publish. Customers are responsible for giving End-Users their own privacy notices, obtaining any consent the law requires, and complying with the privacy laws that apply to them. Our End-User Notice Templates are a starting point for those notices.

2. Information We Collect

2.1 Website Visitors

a. Website Analytics (Cloudflare Web Analytics)

The Website uses Cloudflare Web Analytics to count page views and visits. A small script on each page reports the page address (without its query string), the referring page, the browser, operating system, and device type, the visitor's country as derived from the request, and page-load timing. It sets no cookies and uses no local storage, and it does not track individual visitors across pages, sites, or time: a visit is counted when a page is reached from another site. Cloudflare's handling of this data is governed by the Cloudflare Privacy Policy. The Website sets no analytics, advertising, or tracking cookies. Our Cookie Policy has the details.

b. Google Fonts

The Website loads typefaces from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). When your browser requests these fonts, Google receives your IP address and standard HTTP request headers. Google's handling of this data is governed by the Google Privacy Policy. Forms built with QuikForms load no fonts from Google or any other third party: their fonts are served from the Customer's own Salesforce org.

c. Web Server Logs

The Website is hosted on Cloudflare, which records standard request information: IP address, date and time, the page requested, the HTTP status code, the referring URL, and the browser's user agent string. These logs are used for security monitoring, performance, and troubleshooting.

2.2 Licensing and Installation Data

When a Customer installs the QuikForms managed package, Salesforce's License Management App records the installation in our own Salesforce org and gives us: the Customer's Salesforce organization ID, the organization's name and Salesforce edition, the name and email address of the user who installed the package (recorded as a lead), the license status, and its expiry date. We use this to manage the Customer's license and to send plan and feature settings to the Customer's org.

2.3 Billing Data

Subscriptions are purchased through Salesforce's AppExchange Checkout, which processes payments through Stripe, Inc. We receive the billing contact's name and email address, the Customer organization, the plan, billing frequency, and subscription status, and invoice and payment status. Payment card details are collected and processed by Stripe; we do not receive or store full payment card numbers.

2.4 QuikForms AI Entitlement and Usage Data

Every plan includes QuikForms AI with a monthly allowance. For each Customer, our own Salesforce org keeps an AI entitlement record with the Customer's Salesforce organization ID, plan and trial status, the AI allowance, the running usage total and cost for the current billing period, and identifiers for the Customer's AI gateway access. If the Customer gives us an email address for allowance notices, we keep it and send a notice to it when 80% of the monthly AI allowance has been used. These records contain usage totals only, not the content of any AI request.

2.5 QuikForms AI Gateway Data

Requests that use the AI included in a Customer's plan pass through the QuikForms AI gateway, a service we operate on Cloudflare's network. It holds the content of a request and its response in memory only while the request is in transit, and never stores or logs that content. Section 8.4 lists the operational records it keeps.

2.6 Correspondence and Support

When you email us, we receive your name, email address, the content of your message, and anything you attach, such as screenshots or log excerpts. We use it to answer you and keep it as a record of the conversation.

2.7 Data the Managed Package Handles for Customers (as Processor)

The QuikForms managed package runs inside the Customer's Salesforce org. The managed package sends no usage information about a Customer's forms or users to QuikForms, and we have no standing access to Customers' Salesforce orgs. If a Customer grants us login access to its org through Salesforce for a support request, our personnel may see data in that org while the access lasts, solely to provide the support requested. When End-Users interact with a Customer's form, the following may be processed:

a. Form Field Values

Data End-Users submit through forms (such as names, email addresses, phone numbers, and any other fields the Customer configures) is stored in the Customer's Salesforce org. QuikForms does not receive, transmit, or store it on its own systems. The Customer decides which fields each form collects.

b. File Uploads

Files End-Users upload through forms are stored as Salesforce files or attachments in the Customer's Salesforce org. QuikForms does not keep copies.

c. Cloudflare Turnstile CAPTCHA

A Customer may protect its forms with Cloudflare Turnstile, using Turnstile keys from its own Cloudflare account. Turnstile runs in the End-User's browser, where Cloudflare collects information such as the IP address and browser characteristics to tell people from bots, and the Customer's org sends the resulting token to Cloudflare for verification. Cloudflare's handling of this data is governed by the Cloudflare Privacy Policy.

d. Form Analytics

To give Customers form performance figures, the managed package records the following in the Customer's Salesforce org (a view count on every plan, and the detailed daily figures on the Professional plan):

Visitor key: a keyed hash (HMAC-SHA256) of the End-User's IP address and the date, made with a secret key held in the Customer's org, stored once per form per day to count unique visitors. The raw IP address is not stored for analytics, and because the date is part of the hashed value, the same visitor's key differs from one day to the next.
Device category: desktop, mobile, or tablet.
Browser type: Chrome, Safari, Firefox, Edge, or other.
Referrer domain: the hostname of the referring website only, without its path or query string.
Engagement counts: views, starts, submissions, abandonments, and timing, kept as daily totals per form and, where the Customer turns on field analytics for a form, as daily totals per field.

No submitted values are stored in analytics records.

e. Optional: IP Address and User Agent on Records

A Customer may turn on "Log User Browser Info" for a form. It is off by default. When it is on, the End-User's IP address and browser user agent string are written to the record the submission creates, and the IP address is included in the Platform Events described in item g. The Customer is responsible for telling End-Users before turning it on.

f. Exception Logs

When an error occurs, the managed package may write an exception log in the Customer's Salesforce org. A log can contain the visitor's IP address, user agent, and page address, and its message can quote a value someone entered. Passwords, tokens, keys, and similar values in structured data are redacted before a log is written. Logs are visible only to the Customer's authorized administrators and are deleted automatically after the retention period the Customer sets.

g. Platform Events

On the Professional plan, the managed package publishes Salesforce Platform Events inside the Customer's org when a form is submitted or fails validation, for the Customer's own automations. These events carry the submitted values. They carry the visitor's IP address only when the Customer has turned on "Log User Browser Info" for the form (item e); otherwise their IP address field is blank. The events stay within the Customer's Salesforce environment.

h. Session Resume in the Visitor's Browser

So that a visitor who reloads a page does not lose their answers, forms keep the values typed so far in the browser's session storage for that tab. They never include files, signatures, or masked fields, are deleted when the tab closes or the form is submitted, and are never sent to QuikForms. A Customer can turn this off for a form.

i. QuikForms AI Requests

Where a Customer uses QuikForms AI, an AI request is sent only when one of the Customer's administrators takes an action, never when an End-User views or submits a form. A request can contain form configuration and the field library, the field names and types of the form's target object, the administrator's messages and the conversation so far, descriptions entered in the pattern helper, aggregate analytics counts, and exception log records the administrator selects. It does not contain form submission values, created records, file uploads, survey answers, chat data, IP addresses, or credentials, except that an exception log's text can quote a value someone entered. The AI conversation history is stored in the Customer's org. Section 6 explains where requests go.

3. How We Use Information

3.1 Information We Control

Providing and administering the Service: managing licenses, sending plan and feature settings to Customers' orgs, activating QuikForms AI, and metering AI use against the allowance.
Billing: processing subscriptions, invoices, payments, refunds, and tax obligations.
Communications: answering questions and support requests, and sending service, security, legal, and allowance notices.
Website operation and improvement: learning which pages are read and how visitors find the Website, using cookieless counts of page views and visits.
Security and fraud prevention: protecting the Website, the AI gateway, and our accounts from abuse.
Legal compliance: meeting our legal, tax, and accounting obligations, enforcing our agreements, and responding to lawful requests.

We do not use Personal Data for advertising, we do not build profiles of individuals, and we do not use Customer data, End-User data, or the content of AI requests to train artificial intelligence models.

3.2 Data We Process for Customers

As a processor, we process form data and the content of AI requests only on behalf of and on the documented instructions of our Customers, as set out in the Data Processing Agreement. We do not use it for our own marketing, advertising, profiling, or any purpose other than providing the Service.

4. Legal Bases for Processing (GDPR)

For individuals in the European Economic Area ("EEA"), the United Kingdom, and Switzerland, we rely on the following legal bases for the processing we control:

Processing Activity	Legal Basis
Website analytics (Cloudflare Web Analytics)	Legitimate interests (Art. 6(1)(f)): to learn which pages are read and improve the Website, using a cookieless service that does not identify or track visitors.
Web server logs	Legitimate interests (Art. 6(1)(f)): to keep the Website secure and working.
Google Fonts requests	Legitimate interests (Art. 6(1)(f)): to display the Website in its typefaces.
Licensing and installation data	Performance of a contract (Art. 6(1)(b)) with the Customer, and our legitimate interests (Art. 6(1)(f)) in administering licenses where the Customer Contact is not personally a party to the contract.
Billing data	Performance of a contract (Art. 6(1)(b)) and compliance with legal obligations (Art. 6(1)(c)), such as tax and accounting record-keeping.
AI entitlement, usage, and allowance notices	Performance of a contract (Art. 6(1)(b)) and our legitimate interests (Art. 6(1)(f)) in metering and securing the AI features.
AI gateway operational records	Legitimate interests (Art. 6(1)(f)): to authenticate Customers' orgs, meter use, and keep the gateway secure.
Correspondence and support	Legitimate interests (Art. 6(1)(f)) in answering the people who contact us, and performance of a contract (Art. 6(1)(b)) where the request concerns a Customer's subscription.
Data we process for Customers (form data, analytics, CAPTCHA, AI request content)	We process it as a processor; the Customer, as controller, determines and is responsible for the legal basis.

Where we rely on legitimate interests, we have concluded that those interests are not overridden by the rights and freedoms of the people concerned, given the limited data involved. You may object to that processing as described in Section 9.

We do not sell Personal Data, and we do not share it for cross-context behavioral advertising or targeted advertising. We disclose it only as follows:

5.1 Service Providers

We use the service providers listed in Section 6 to host, operate, and bill for the Service. They may use Personal Data only to provide their services to us.

5.2 Legal Requirements

We may disclose information if required by law, or in the good-faith belief that disclosure is necessary to comply with a legal obligation, subpoena, or court order, to protect the rights, property, or safety of QuikForms, our Customers, or others, to detect or prevent fraud or security problems, or to enforce our agreements.

5.3 Business Transfers

If we are involved in a merger, acquisition, reorganization, or sale of assets, Personal Data may be transferred as part of the transaction. We will give notice before Personal Data becomes subject to a different privacy policy.

5.4 At a Customer's Direction or With Consent

We may share information when a Customer directs us to as controller, or with the consent of the person concerned.

6. Third-Party Service Providers

Cloudflare, Inc.

Website: hosts www.sfquikforms.com, keeps its request logs, and provides cookieless page-view and visit counts through Cloudflare Web Analytics (see Section 2.1(a)).
AI gateway: we operate the QuikForms AI gateway (ai-gateway.sfquikforms.com) on Cloudflare's Workers platform. When a Customer uses the AI included in its plan (the default), each AI request passes from the Customer's Salesforce org through the gateway, which authenticates the org, checks the Customer's allowance, and forwards the request to Anthropic. The gateway is not used where a Customer uses its own Anthropic API key or has switched AI off. The content of AI requests and responses is held in memory only while a request is in transit and is never stored or logged. See Section 8.4.
Turnstile: Customers who protect their forms with Cloudflare Turnstile use their own Cloudflare accounts (see Section 2.7(c)).
Privacy Policy: https://www.cloudflare.com/privacypolicy/

Anthropic PBC

Purpose: provides the language model behind QuikForms AI. Engaged only when a Customer's administrator takes an AI action, never during form rendering or submission.
How requests reach Anthropic: when a Customer uses the AI included in its plan, through the QuikForms AI gateway, under QuikForms' Anthropic account, in a workspace that also serves other QuikForms customers with the same kind of subscription (trial or paid). The gateway authenticates, meters, and limits each Customer separately, by its own access token. When a Customer uses its own Anthropic API key, its Salesforce org calls Anthropic directly under the Customer's own Anthropic account; the gateway and QuikForms are not involved, and Anthropic's terms with the Customer govern those requests.
Data shared: the content listed in Section 2.7(i).
Model training: data sent through Anthropic's commercial API is not used to train Anthropic's models.
Retention: Anthropic retains and deletes request content under its commercial terms and data retention policies.
Location: United States.
Privacy Policy: https://www.anthropic.com/legal/privacy

Salesforce, Inc.

Platform: the managed package runs on the Salesforce platform, and Customers' form data stays in their own Salesforce orgs under their own agreements with Salesforce.
Our own records: we use Salesforce, including the License Management App and the AppExchange Checkout management app, in our own Salesforce org to hold licensing, billing, and AI entitlement records (Sections 2.2 to 2.4), and Salesforce provides AppExchange Checkout.
Privacy Policy: https://www.salesforce.com/company/privacy/

Stripe, Inc.

Purpose: processes subscription payments made through AppExchange Checkout (see Section 2.3).
Privacy Policy: https://stripe.com/privacy

Google LLC

Purpose: serves the Website's typefaces through Google Fonts.
Privacy Policy: https://policies.google.com/privacy

We also use an email service to send and receive email, including allowance notices.

7. Data Storage, Location, and Security

7.1 Where Data Is Kept

The Website and the AI gateway run on Cloudflare's global network. Our licensing, billing, and AI entitlement records are kept in our Salesforce org. Form data stays in each Customer's own Salesforce org, whose location is determined by the Customer's Salesforce instance. QuikForms does not operate its own servers, databases, or data stores for form data. The AI gateway is the one service we operate in the path of Customer data, and it does not store or log the content of AI requests. Forms, submissions, file uploads, and analytics do not use it.

7.2 Security

We use administrative, technical, and organizational measures appropriate to the data we hold, including access limited to personnel who need it, encryption in transit, storing only a hash of each Customer's AI gateway token, and keeping AI request content out of storage and logs. The managed package's own protections, such as IP hashing, rate limiting, CAPTCHA, honeypot fields, referrer validation, and enforcement of Salesforce permissions, are described on our Security & Trust page. No method of transmission or storage is completely secure.

7.3 Security Incidents

If we become aware of a security incident affecting Personal Data we hold, we will investigate it, take steps to contain it, and notify affected Customers, individuals, and authorities as applicable law requires. For data we process for Customers, we notify the Customer without undue delay and within seventy-two (72) hours, as set out in the Data Processing Agreement.

8. Data Retention

8.1 Website Data

Web server logs: kept by Cloudflare for no more than seven (7) days and then automatically deleted.
Website analytics: kept by Cloudflare as aggregate page-view and visit counts, which identify no visitor.

8.2 Data We Control

Licensing and installation data: for as long as the Customer's license exists, and afterwards for as long as needed for our records, legal claims, and legal obligations.
Billing data: for as long as tax and accounting law requires.
AI entitlement and usage data: for as long as the Customer's subscription is active, and afterwards for as long as needed for billing records and legal obligations.
Correspondence: for as long as needed to deal with the matter and keep a record of it.

8.3 Data in Customers' Salesforce Orgs

Form submission data and files: kept in the Customer's org for as long as the Customer decides. QuikForms does not delete them.
Analytics records: deleted automatically after 365 days by default; the Customer may set a different period.
Exception logs: deleted automatically after 30 days by default; the Customer may set a different period.
AI conversation history: deleted automatically after 90 days by default; the Customer may set a different period.
Session resume values: kept in the visitor's browser tab only, until the tab closes or the form is submitted.
CAPTCHA tokens: used once for verification and not stored by the managed package.

Uninstalling the managed package deletes the data held in its own objects, as described in our Terms of Service.

8.4 QuikForms AI Gateway Data

The QuikForms AI gateway holds the content of an AI request and its response in memory only while the request is in transit, and never stores or logs it. Its logs contain only operational metadata, such as the time, tenant identifier, event, response status, token counts, outcome, and duration, and the Customer's Salesforce organization ID for activation events; Cloudflare retains them for seven (7) days. For each Customer, the gateway stores a tenant identifier, the identifier of the Anthropic workspace that serves the Customer, the subscription tier, a SHA-256 hash of the Customer's access token, allowance settings and usage counters for the current period, and the times of registration, collection, usage, and any revocation. During the one-time AI activation step it also holds the access token awaiting collection, which is deleted when collected or after 12 hours, and counts of failed attempts keyed by a keyed hash of the requesting IP address, from which the address cannot be recovered. The gateway stores no form data, no names or email addresses, and no records from the Customer's Salesforce org.

9. Your Privacy Rights

Depending on where you live and the law that applies, you may have some or all of the following rights:

Access: to confirm whether we process your Personal Data and obtain a copy.
Correction: to have inaccurate Personal Data corrected.
Deletion: to have your Personal Data deleted, subject to legal exceptions.
Restriction: to have our processing limited.
Portability: to receive your Personal Data in a structured, machine-readable format.
Objection: to object to processing based on legitimate interests.
Withdrawal of consent: where we rely on consent, to withdraw it at any time without affecting earlier processing.
Opting out: of the sale of Personal Data, its sharing for cross-context behavioral advertising, targeted advertising, and profiling. We do none of these.
Non-discrimination: not to be treated differently for exercising your rights.

How to Exercise Your Rights

Website Visitors, Customer Contacts, and Correspondents: email privacy@sfquikforms.com. We will verify your request in a way appropriate to it, usually by confirming your email address, and respond within the time the applicable law requires. You may use an authorized agent where the law allows; we may ask the agent for proof of authority and ask you to confirm your identity.

End-Users (form submitters): the organization whose form you submitted controls your data. Please send your request to that organization. If you contact us instead, we will forward your request to the organization where we can identify it, or tell you that we cannot.

Customers: you have direct access to and control over all data in your Salesforce org and can access, correct, export, and delete it with Salesforce's tools. We assist with requests about that data as described in the Data Processing Agreement.

Appeals: if we decline your request, you may appeal by replying to our decision or by emailing privacy@sfquikforms.com with "Appeal" in the subject line. We will respond to an appeal in writing within the time the applicable law requires. If you are not satisfied with the outcome, you may contact your state attorney general or your data protection authority.

10.1 Controller Contact

The controller of the data described in Sections 2.1 to 2.6 is QuikForms, LLC, which can be contacted at privacy@sfquikforms.com.

10.2 Data Processing Agreement

Our Data Processing Agreement, which meets the requirements of Article 28 of the GDPR and includes the Standard Contractual Clauses and the UK Addendum, applies automatically to every Customer as part of our Terms of Service. A countersigned copy is available on request to privacy@sfquikforms.com.

10.3 Data Protection Officer

Given the nature and scale of our processing, QuikForms has not appointed a Data Protection Officer. Privacy questions may be sent to privacy@sfquikforms.com.

10.4 Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work. EEA authorities are listed at edpb.europa.eu; in the UK, the authority is the Information Commissioner's Office; in Switzerland, it is the Federal Data Protection and Information Commissioner.

10.5 Automated Decision-Making

QuikForms does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning individuals or similarly significantly affect them.

10.6 Providing Data

Providing licensing and billing information is necessary to subscribe to the Service; without it we cannot provide a subscription. Contacting us is voluntary.

11. Additional Information for California Residents

This section applies to California residents to the extent the CCPA applies to QuikForms, and supplements the rest of this Privacy Policy.

11.1 Categories of Personal Information

In the preceding twelve (12) months, we have collected the following categories of Personal Information, for the business purposes described in Section 3.1, from the sources described in Section 2:

Category	Examples	Disclosed for a business purpose to
Identifiers	Name, email address, IP address, Salesforce organization ID	Cloudflare, Salesforce, Stripe, Google (IP address only), our email provider
Commercial information	Plan, subscription and payment status, invoices, AI usage totals	Salesforce, Stripe
Internet or other electronic network activity	Pages viewed, referring page, browser and device type, AI gateway operational logs	Cloudflare
Professional or employment-related information	The organization a Customer Contact works for, as shown in installation and billing records	Salesforce

We keep each category for the periods described in Section 8. We do not collect sensitive personal information for the purpose of inferring characteristics about anyone; payment card details are collected by Stripe, not by us.

11.2 Sale and Sharing

QuikForms does not sell Personal Information and does not share it for cross-context behavioral advertising, and has not done so in the preceding twelve (12) months. We have no actual knowledge of selling or sharing the Personal Information of consumers under 16 years of age.

11.3 Your California Rights

California residents may request to know the categories and specific pieces of Personal Information we have collected, its sources, our purposes, and the categories of recipients; to delete it; to correct it; and to opt out of its sale or sharing (although we do neither). We will not discriminate against you for exercising these rights. To make a request, email privacy@sfquikforms.com. We will confirm receipt within ten (10) business days and respond within forty-five (45) days, or up to ninety (90) days with notice where reasonably necessary.

11.4 End-User Data

For data collected through a Customer's forms, the Customer is the business and QuikForms is its service provider. Please send requests about that data to the Customer.

12. Additional Information for Residents of Other U.S. States

Residents of other U.S. states with consumer privacy laws, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, may have the rights described in Section 9, where those laws apply to QuikForms. Many of these laws apply only to businesses above certain thresholds, and several exempt information about people acting in a business or employment capacity. We do not sell Personal Data, process it for targeted advertising, or use it for profiling in furtherance of decisions that produce legal or similarly significant effects. To make a request or an appeal, follow Section 9.

13. Children's Privacy

The Website and the Service are directed to businesses and are not directed to children. We do not knowingly collect Personal Data from children under 16. If you believe a child has provided Personal Data to us, contact privacy@sfquikforms.com and we will delete it. Customers are responsible for ensuring that any forms they publish comply with the Children's Online Privacy Protection Act and other laws on collecting data from minors.

14. International Data Transfers

14.1 Data We Control

QuikForms is based in the United States, and the data we control is processed in the United States and in other countries where our service providers operate. Where we transfer Personal Data from the EEA, the UK, or Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (with the UK International Data Transfer Addendum and the Swiss amendments where applicable), on our service providers' own transfer mechanisms, or, where those do not apply, on the transfer being necessary to perform a contract with you or at your request.

14.2 Data We Process for Customers

Form data stays in the Customer's Salesforce org, whose location is determined by the Customer's Salesforce instance; QuikForms does not move it across borders. Where a Customer uses QuikForms AI, the content described in Section 2.7(i) is sent to Anthropic in the United States, through the QuikForms AI gateway on Cloudflare's global network when the Customer uses the AI included in its plan. Those transfers are covered by the Standard Contractual Clauses and UK Addendum in our Data Processing Agreement.

15. Do Not Track and Global Privacy Control

The Website sets no cookies, does not track visitors across sites, and does not sell or share Personal Data, so there is no tracking for a Do Not Track or Global Privacy Control signal to turn off, and the Website behaves the same whether or not your browser sends one. If we ever sell or share Personal Data, or use it for targeted advertising, we will treat a Global Privacy Control signal as a valid request to opt out where the law requires.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last Updated" date above. For material changes, we will also post a notice on the Website and, where we have their email address, notify Customers by email before the change takes effect.

17. Contact Us

If you have any questions, concerns, or requests about this Privacy Policy or our data practices, please contact us:

QuikForms, LLC
Privacy: privacy@sfquikforms.com
General: info@sfquikforms.com
Website: www.sfquikforms.com

Appendix A: Data Processing Summary for Customers

Data Element	Stored Where	By Default	Retention
Form field values	Customer's Salesforce org	Yes	Per Customer policy
File uploads	Customer's Salesforce org	Yes (when used)	Per Customer policy
Visitor key (keyed hash of IP address and date)	Customer's Salesforce org	Yes	365 days (configurable)
Device category, browser type, and referrer domain counts	Customer's Salesforce org	Yes	365 days (configurable)
Per-field engagement counts	Customer's Salesforce org	No (opt-in per form)	365 days (configurable)
IP address and user agent on the created record	Customer's Salesforce org	No (opt-in per form)	Per Customer policy
Exception logs (may include IP address, user agent, and page address)	Customer's Salesforce org	Yes (on error)	30 days (configurable)
Session resume values	Visitor's browser tab (session storage)	Yes (can be turned off per form)	Until the tab closes or the form is submitted
Cloudflare Turnstile token	Sent to Cloudflare for verification	When the Customer configures Turnstile	Not stored
AI conversation history	Customer's Salesforce org	Yes (when AI is used)	90 days (configurable)
AI request content (AI included in the plan)	Sent through the QuikForms AI gateway to Anthropic; not stored by the gateway	When an administrator uses an AI feature	In transit only
AI request content (Customer's own Anthropic key)	Sent directly to Anthropic under the Customer's account	When an administrator uses an AI feature	Per the Customer's agreement with Anthropic

Customers should disclose to their End-Users the elements above that apply to their forms. The End-User Notice Templates can help.

QuikForms Legal