Document AIM-P1 · v0 · private beta
Privacy policy
Controller
Biomag S.L.U., Vitoria-Gasteiz (Spain), as the owner of the AIM FORM service.
What data we process
For accounts: email and password (stored only as a hash, never in plain text). For published forms: the answers submitted by the people who fill them in; the creator of each form is jointly responsible for the content it requests. In a team, the other people in it see your email and your role; an invitation keeps the invited email until it is accepted, cancelled or expires (7 days), and only a fingerprint of its link.
Why
To provide the service: storing your forms, collecting their answers and showing them to you. We do not sell data and we do not use it for advertising.
Measurement and experiments
To know where people come from and what works, we count, in aggregate and per day, without cookies or anything that identifies anyone, how many times a page or a form's badge is seen and how many accounts are created. Sometimes we show two versions of a text to learn which one works better: one is picked at random on each visit and we only count how many times each one is seen and what happens next. Right now we are testing: the text of the home page's main button (“Create my first form” or “Create my free account”); the text of the badge at the foot of forms (“Made with AIM FORM” or “Make yours free with AIM FORM”).
Where the data is
On servers in the European Union (Railway, europe-west4 region, the Netherlands).
Artificial intelligence
Only when a user asks for it: the text written to create a form with AI, and the answers of a form when its creator asks for an AI analysis, are sent to an AI model provider through OpenRouter, which may process them outside the EU under its own policies. When the questions are requested without an account, the draft the AI suggests (not the text written) is kept for 48 hours so it can be kept when creating an account, and is then deleted.
Abuse prevention
To limit abuse such as repeated voting, we count each connection's submissions for a while using a fingerprint of the IP address (a hash, not the address), which is deleted within two days at most and is not stored with the answers. We do not store the IP address or the browser identifier.
Retention and control
Data is kept for as long as the account exists. A form's creator can export and delete its answers. You can download all your data and delete your account completely, yourself and right away, from My account: there is no one to ask.
Your rights
Access, rectification, erasure, objection, restriction and portability, by writing to the controller from the contact page or to privacidad@aim-form.ai. You may also lodge a complaint with the Spanish supervisory authority (AEPD).