Privacy notice

Who we are

NumoForms is published by NOISSIME LTD, a company registered in England and Wales under company number 17160439, with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. Questions about this notice, or any request about your personal data, go to Ashley Gallagher at admin@noissime.com. We have not appointed a Data Protection Officer; we are not required to, and we would rather say that than imply a role that does not exist.

Controller or processor — which applies to you

If you use the platform to build surveys

We are the controller for your account: your name, email address, organisation membership, sign-in activity and any correspondence with us. We decide what is needed to run the service and how long to keep it.

If you answer somebody's survey

The organisation running that survey is the controller. They chose the questions, they decide how long the answers are kept and who may see them, and their own privacy notice governs what happens to your answers. We are their processor: we hold the data on their instructions and do not use it for our own purposes. Requests about those answers should go to them first — the UK GDPR page explains what to do if you cannot tell who is running a survey you received.

What we collect

Account data

Email address and any name you provide, the organisations you belong to and your role in each (owner, admin or member), and authentication records such as sign-in link requests.

If you choose to sign in with Google or Apple, we receive only your name and email address from that provider, and we use them solely to create and sign you in to your NumoForms account. We do not receive your password, we request no other Google or Apple data, and we do not use this information for advertising or share it with third parties for their own purposes. You can instead sign in with an email and password.

Survey content and responses

The questions our customers write, the answers respondents give, files uploaded through a file upload question, partially completed responses held for save and continue, and any hidden fields the survey owner declared and passed in the query string. Hidden fields are stored with the response, so survey owners should describe them in their own privacy notice.

Correspondence

Anything you send us by email, including whatever personal data you choose to include in it.

Technical data

Standard server and application logs — connection data of the sort every web server records. This site does not run advertising or analytics trackers; the cookie notice sets out exactly what is stored in a browser and why.

Why we process it, and our lawful basis

Who we share information with

We do not sell personal data and we do not share it for advertising. We use a small number of service providers to run the platform — for hosting and storage, and for sending email. These providers act only on our instructions and may not use the information for their own purposes. Each is bound by a written data processing agreement.

Some of these providers are based in the United States. Where information is transferred outside the UK, we rely on the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, and we assess each provider's security before using them. Our current list of providers, with what each processes and where, is on the sub-processor page. We publish changes to that list before a new sub-processor begins processing.

Automated analysis of written answers

Automated summarisation of free-text answers is a planned feature. It is not available in the product today, and no response content is sent to an analysis provider. The provider is nevertheless listed in advance on the sub-processor page so that nobody is surprised later.

When it does ship, it will work like this: where the survey owner has enabled it, written answers are summarised automatically to identify common themes; answers are sent without names, email addresses or other identifying fields attached; the result is a summary for the survey owner only. No decision about any individual is made on the basis of this analysis, so Article 22 UK GDPR does not apply, and the content is not used to train the provider's models.

Where your data is stored

Survey content, responses, partial answers and uploaded files are held in Supabase, on Amazon Web Services in the London region (eu-west-2). In ordinary use, survey data does not leave the United Kingdom. Transactional email is the exception, and leaves under the safeguards described above. The security page describes the controls in detail — TLS in transit, AES-256 at rest, row-level security throughout, organisation isolation resolved on the server, and uploads in a private bucket readable only through signed URLs that expire after 300 seconds.

How long we keep it

Survey responses are retained until the survey owner deletes them; they decide the retention period, not us. Deleting test responses also removes the associated uploads and partial responses. Account data is kept while the account is open and for a reasonable period afterwards to handle disputes and meet accounting obligations. Correspondence is kept while it is useful for support and record-keeping.

Your rights

Under UK GDPR you have the right to be informed, and rights of access, rectification, erasure, restriction, portability and objection, as well as rights relating to automated decision-making. Where we are the controller, exercise them by emailing hello@noissime.com. We respond within the statutory period and will tell you if we need to verify your identity first.

Where we are a processor — that is, for answers you gave to somebody else's survey — we will pass your request to the controller and support them in answering it. We cannot delete a customer's responses on your instruction without theirs, because they are not ours to delete.

You may complain to the Information Commissioner's Office. We would rather hear from you first, but it is your right and this notice is not the place to discourage it.

Changes to this notice

This version is dated 22 July 2026. It will be reviewed by a solicitor before it stops being marked as a draft, and materially changed again when the automated analysis feature ships. When a sub-processor changes, the sub-processor page changes first. See also our terms of service and cookie notice, both of which carry the same pending-review caveat.