Privacy Policy

1. Who is responsible for your information

FormHeartbeat is operated by Wei as an independent sole operator trading as FormHeartbeat. Wei is the controller for website enquiries and the direct business relationship. Questions, identity details needed for a contract, and privacy requests can be sent to founder@formheartbeat.com.

2. Information this website handles

This website does not currently create user accounts, run advertising trackers or add requesters to an automated sales sequence. If you request a free compatibility check, ask to join the pilot or contact the founder, the public form URL (if supplied), your work email, agency or studio name and message are sent through our hosting and email providers to the founder's business inbox. These requests are not stored in a separate FormHeartbeat customer database.

Our hosting provider may process ordinary technical logs such as IP address, browser type, requested page, timestamp and security events to deliver and protect the site. Edge rate limiting is applied before form requests reach the application. Anonymous daily operational counters record events such as successful delivery, blocked abuse and delivery failure; they do not contain the submitted URL, email address, agency name or message.

3. Information handled during a pilot

If you request or purchase a managed pilot, we may handle your name, work email, agency details, billing records, client form URLs, agreed test-field values, test schedules, delivery evidence, screenshots and support messages.

Do not provide sensitive personal data, passwords, payment-card data, health information or information from private/authenticated forms unless a separate written agreement explicitly allows it.

4. Why we use information

We use information to answer enquiries, assess compatibility, configure and operate agreed checks, detect failures, provide reports, handle payment and refunds, protect the service, and meet legal obligations.

5. Relevant one-to-one business outreach

FormHeartbeat may use a small amount of business contact information published on an agency's own website, such as a role-based work email address, agency name, country and the care-plan page that made the agency relevant. We may also use an official company register to confirm that a UK recipient is a corporate body. We do not buy lists, guess private addresses, use email-enrichment services, or add open-tracking pixels.

For carefully selected UK corporate contacts, we may rely on legitimate interests to send a relevant, one-to-one introduction to FormHeartbeat. Our interest is finding agencies whose existing website-care work could benefit from end-to-end form checks. We limit the impact by using public business details, sending at low volume, explaining why the message is relevant, providing this privacy notice, and offering a free and immediate way to object. Other jurisdictions are contacted only where consent or another documented rule permits it.

6. Service providers and international processing

Current providers are Vercel for hosting and edge security, Zoho Mail for business email, GitHub Actions for authorised monitor execution and short-lived evidence artifacts, Upstash for anonymous counters and payment-event idempotency, and Creem for payment when checkout is enabled. These providers process information under their own terms and may operate in countries different from yours. We limit sharing to what is needed to provide the requested service and will provide a current processor list or data-processing addendum for an agreed pilot on request.

7. Retention

Free-audit requests and related correspondence are normally deleted within 90 days after the last substantive contact unless a pilot begins or a longer period is needed for a dispute or legal obligation. Individual monitor-run artifacts are configured to expire after 30 days. Final pilot evidence and support records are normally deleted or anonymised within 60 days after the pilot ends unless another period is agreed. Anonymous operational counters and processed Creem event identifiers expire after 90 days. Billing and tax records may be retained for the period required by applicable law.

If you object to outreach, we keep only the minimum email address or domain, objection date and reason needed to prevent future contact. A suppression record is not used for any other purpose and is retained while needed to honour the objection.

8. Your choices and rights

You may ask to access, correct or delete information we hold about you, object to direct marketing, or ask us not to contact you again. The right to object to direct marketing is honoured without charge. Reply to the message or email founder@formheartbeat.com; we will suppress the address immediately and will not send a follow-up.

9. Cookies and analytics

FormHeartbeat does not currently use non-essential cookies, behavioural analytics or email open-tracking pixels. Anonymous operational event totals are used to verify that enquiry delivery and abuse controls work; they are not used to profile visitors. If behavioural analytics or non-essential storage is introduced, this policy and any required consent controls will be updated before those tools are enabled.

10. Changes

This policy may change as the pilot becomes a product. Material changes will be posted here with a new effective date.