Privacy Notice
How Mokaform collects, uses, protects, and shares personal data for account holders, form creators, visitors, and respondents.
Last updated: July 8, 2026
This page explains Mokaform's privacy practices in a practical format. The formal legal policy is available at Mokaform Privacy Policy.
2-minute summary
Mokaform SAS is a French company located at 61 RUE de Lyon, 75012 Paris, France. We provide a form builder for creating, publishing, and managing online forms.
What you should know:
- You remain in control of the forms you create and the responses you collect.
- We do not sell personal data.
- We do not use form responses or uploaded files for targeted advertising.
- Mokaform stores response data and uploaded files in AWS regions located in the European Union.
- Mokaform hosts the application in EU Render regions.
- Mokaform may use GeoLite2 data locally to determine a respondent's country from their IP address. We do not share the IP address with MaxMind for this lookup, and we do not derive city, precise location, or individual-level inferences from GeoLite2 data.
- We use service providers only to operate, secure, support, and improve Mokaform.
- Optional media search for GIFs, videos, and photos is handled server-side through media providers. Those providers do not receive respondent IP addresses, browser metadata, or form submissions from the respondent's browser.
- You can request access, correction, deletion, restriction, portability, or objection by contacting security@mokaform.com.
- If you create forms, you are generally responsible for telling respondents what you collect and why.
Article 1 - General
Mokaform SAS ("Mokaform", "we", "us", or "our") operates www.mokaform.com and provides services for building dynamic, multi-step web forms, collecting responses, managing submissions, sending notifications, and connecting form data to other tools.
This Privacy Notice applies to:
- visitors to the Mokaform website;
- people who create or manage a Mokaform account;
- workspace members invited by a Mokaform customer;
- people who contact Mokaform for support, sales, security, or privacy matters; and
- respondents whose personal data is submitted through forms hosted by Mokaform.
For customer form responses, the form creator is generally the controller and Mokaform is generally the processor. More detail is available in GDPR & Mokaform and the Data Processing Agreement.
Article 2 - What personal data Mokaform collects
Mokaform may collect and process the following categories of personal data.
| Category | Examples | Context |
|---|---|---|
| Account and identity data | Name, email address, login identifiers, workspace membership, role, account settings | When you create an account, log in, join a workspace, or manage your profile |
| Authentication data | Authentication events, session data, tenant identifiers, security logs | When you access Mokaform through our Logto EU tenant |
| Billing data | Subscription plan, invoices, billing contact details, VAT or tax information, payment status | When you subscribe to a paid plan or use paid features |
| Payment data | Payment method details and transaction metadata handled by Stripe | When you pay for a subscription or collect payments through a form |
| Product usage data | Features used, forms created, submission counts, workspace activity, settings, device data, browser data, IP address, country-level location signals, logs | When you use the website, dashboard, editor, forms, or related services |
| Support data | Messages, attachments, diagnostic information, contact details | When you contact support, security, sales, or privacy teams |
| Form content and responses | Form questions, hidden fields, uploaded files, signatures, answers, respondent metadata, respondent country metadata, and integrations configured by the form creator | When a customer creates a form or a respondent submits a form |
| Local country lookup data | IP address processed locally to derive respondent country only; no city, precise location, or individual-level inference | When a respondent submits a form where country detection is used |
| Media search and selection data | Search terms, selected media identifiers, media URLs, provider attribution, and related technical API data | When a customer searches for or selects GIFs, videos, or photos from Mokaform's media library |
| Cookie and marketing preference data | Cookie consent choices, analytics identifiers, campaign source, unsubscribe status | When you browse the site or interact with marketing communications |
We ask customers not to collect unnecessary sensitive personal data through Mokaform unless they have a valid legal basis and appropriate safeguards.
Article 3 - Legal bases and purposes
We process personal data only when we have a lawful basis and a defined purpose.
3.1 Providing Mokaform
| Data | Legal basis | Purpose |
|---|---|---|
| Account and identity data | Contract | Create and manage accounts, workspaces, authentication, access permissions, and user settings |
| Form content and response data | Customer instructions; contract; legitimate interest in service operation | Host forms, collect responses, store submissions, process file uploads, show dashboards, export data, and run integrations |
| Billing and payment data | Contract; legal obligation | Process subscriptions, invoices, taxes, payment disputes, refunds, and accounting records |
| Product usage and log data | Legitimate interest; contract | Operate, monitor, troubleshoot, secure, and improve the service |
| Support data | Contract; legitimate interest | Respond to requests, diagnose issues, investigate abuse, and improve support |
| Local country lookup data | Customer instructions; contract; legitimate interest in service operation | Determine respondent country at country level only, without sharing the respondent's IP address with MaxMind or another third-party geolocation provider |
| Media search and selection data | Contract; legitimate interest | Provide optional GIF, video, and photo search in the form builder, return selected media, keep provider attribution, and troubleshoot media features |
3.2 Security and abuse prevention
We process limited data to protect Mokaform, customers, respondents, and the public from fraud, spam, misuse, unauthorized access, security incidents, and violations of our terms.
This may include IP addresses, device details, usage patterns, authentication events, technical logs, and form activity metadata.
3.3 Communications and marketing
We may send transactional emails about your account, security, billing, service changes, and forms.
We may also send product updates or marketing communications where permitted by law. You can opt out of non-essential marketing emails by using the unsubscribe link or contacting us.
3.4 Cookies and analytics
We use cookies and similar technologies to run the site, remember preferences, measure usage, understand performance, and improve Mokaform.
You can manage cookie preferences through the cookie banner where available. More detail is available in the Mokaform Cookie Policy linked from the website footer.
3.5 Legal requirements
We may process or disclose personal data where necessary to comply with legal obligations, respond to lawful requests, protect rights and safety, enforce our agreements, or support a business transaction such as a merger, acquisition, or asset transfer.
Article 4 - Service providers and subprocessors
We use service providers to operate Mokaform. They may process personal data only for the services they provide to us and under appropriate contractual obligations.
Our current subprocessor list is maintained on GDPR & Mokaform. It includes providers for hosting, storage, authentication, payments, email, analytics, monitoring, and diagnostics.
Mokaform also uses optional media content providers for GIF, video, and photo search. These requests are handled by Mokaform server-side. We do not intentionally share respondent IP addresses, browser metadata, or form submissions with Klipy, Pexels, or Unsplash as part of those media search features.
Mokaform may use GeoLite2 data created by MaxMind to determine a respondent's country from their IP address. This lookup is performed locally by Mokaform. We do not share respondent IP addresses with MaxMind or another third-party geolocation provider for this purpose, and we do not derive city, precise location, or individual-level inferences from GeoLite2 data. GeoLite2 attribution is available on our Attributions page.
We do not sell personal data.
Article 5 - Retention
We keep personal data only for as long as needed for the purposes described in this notice, unless a longer retention period is required or permitted by law.
Typical retention rules:
| Data | Retention approach |
|---|---|
| Account data | Kept while your account is active, then deleted or anonymized after account closure according to our deletion process |
| Form responses, respondent country metadata, and uploaded files | Controlled by the form creator; deleted from active systems when the customer deletes them, then removed from backups through normal backup rotation |
| Billing and accounting data | Kept as required for tax, accounting, payment, audit, and legal obligations |
| Support messages | Kept as long as needed to handle the request and maintain support history |
| Security logs | Kept for a limited period needed for security, fraud prevention, investigation, and service reliability |
| Cookie and analytics data | Kept according to cookie settings, consent choices, and provider retention settings |
If we cannot delete data immediately because it is stored in backups, archives, or logs, we continue to protect it and delete it according to the applicable lifecycle.
Article 6 - Your rights
Depending on your location and the type of data involved, you may have rights to:
- access your personal data;
- receive a copy of your personal data;
- correct inaccurate or incomplete data;
- request deletion;
- restrict processing;
- object to processing;
- request portability;
- withdraw consent where processing is based on consent;
- object to direct marketing; and
- file a complaint with a data protection authority.
To exercise your rights, contact security@mokaform.com.
If your request concerns a response submitted to a customer form, we may direct you to the form creator because the form creator controls that response data.
We may ask for information needed to verify your identity before acting on a request. If we cannot fulfill a request, for example because we must keep limited data for legal, security, or fraud-prevention reasons, we will explain where required by law.
Article 7 - How to contact us
For privacy requests, contact:
Mokaform SAS
Attn: Privacy Team
61 RUE de Lyon
75012 Paris
France
Email: security@mokaform.com
We may need to verify your identity before acting on a request.
Article 8 - Complaints
If you are in the European Union, you may file a complaint with your local data protection authority.
Mokaform is based in France. The French supervisory authority is the CNIL:
Article 9 - Security and confidentiality
Mokaform uses technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, loss, or destruction.
These measures include:
- HTTPS/TLS encryption in transit;
- encryption at rest where supported by infrastructure providers;
- account authentication and access controls;
- role-based and least-privilege access where appropriate;
- monitoring, logging, and incident response processes;
- vendor review for providers that may process personal data;
- backup and recovery processes; and
- confidentiality obligations for personnel and service providers.
No internet service is completely risk-free. Customers are responsible for configuring their forms, workspaces, exports, notifications, and integrations appropriately.
If a personal data breach occurs and notification is required by law, Mokaform will notify affected customers, individuals, or supervisory authorities as required.
Article 10 - International transfers
Some service providers are located outside the European Union or may process data outside the European Union.
Where required, Mokaform relies on appropriate safeguards such as adequacy decisions, Standard Contractual Clauses, data processing agreements, and supplementary measures.
The current provider list and regions are available in GDPR & Mokaform.
Article 11 - Updates
We may update this Privacy Notice from time to time. If we make material changes, we will update this page and may notify customers through the service or by email where appropriate.