Start for freeLogin

Mokaform Privacy Policy

Last updated: July 8, 2026

This Privacy Policy explains how Mokaform SAS ("Mokaform", "we", "us", or "our") collects, uses, stores, shares, and protects personal data when you use www.mokaform.com, the Mokaform application, forms hosted through Mokaform, and related services (together, the "Services").

Mokaform SAS is a French company located at:

61 RUE de Lyon
75012 Paris
France

1. Quick summary

  • Mokaform provides tools to create, publish, manage, and analyze online forms.
  • We do not sell personal data.
  • We do not use form responses or uploaded files for targeted advertising.
  • For customer form responses and uploaded files, the customer who created the form is generally the controller, and Mokaform is generally the processor.
  • Mokaform stores form responses and uploaded files in AWS regions located in the EU.
  • Mokaform hosts the application in Render regions located in the EU.
  • Mokaform may use GeoLite2 data locally to determine a respondent's country from their IP address. We do not share the IP address with MaxMind for this lookup, and we do not derive city, precise location, or individual-level inferences from GeoLite2 data.
  • Optional media search for GIFs, videos, and photos is handled server-side through media providers. Those providers do not receive respondent IP addresses, browser metadata, or form submissions from the respondent's browser.
  • Some providers we use are located in the US. Where required, we use appropriate transfer safeguards.
  • You can contact us about privacy requests at security@mokaform.com.

2. Who this policy applies to

This policy applies to personal data we process about:

  • visitors to the Mokaform website;
  • people who create or manage a Mokaform account;
  • workspace members invited by a Mokaform customer;
  • people who contact us for support, sales, security, legal, or privacy matters;
  • people who receive emails from Mokaform; and
  • respondents who submit data through forms hosted by Mokaform.

If you submit a response to a form created by a Mokaform customer, that customer is usually responsible for telling you what they collect, why they collect it, how long they keep it, and how you can exercise your rights. Mokaform processes that response data to provide the Services to the customer.

3. Our role

Mokaform acts in different roles depending on the context.

3.1 Mokaform as controller

Mokaform is generally the controller for personal data we process to manage our own business and service relationship, including:

  • account registration and authentication;
  • workspace administration;
  • billing and subscriptions;
  • product usage, analytics, and website data;
  • support, sales, security, and privacy communications;
  • service monitoring, fraud prevention, and abuse prevention; and
  • legal, tax, accounting, and compliance obligations.

3.2 Mokaform as processor

For form questions, form responses, uploaded files, signatures, hidden fields, respondent metadata, respondent country metadata, notification content, and integration payloads submitted through a customer's form, the customer is generally the controller and Mokaform is generally the processor.

In that context, Mokaform processes personal data on the customer's instructions, including through the customer's account settings, form configuration, integrations, support requests, the Mokaform Terms, and the Mokaform Data Processing Agreement.

Customers are responsible for their own forms, privacy notices, lawful bases, consent flows, retention choices, exports, integrations, and responses to respondent requests.

4. Personal data we collect

The personal data we collect depends on how you use Mokaform.

4.1 Account and authentication data

We may process your name, email address, login identifiers, workspace membership, role, account settings, authentication events, session data, device data, IP address, and security logs.

Authentication is provided through Mokaform's EU-hosted Logto tenant.

4.2 Billing and payment data

If you subscribe to a paid plan or use paid features, we may process your plan, billing contact details, invoices, VAT or tax information, payment status, transaction metadata, and related subscription records.

Payment method details are processed by Stripe. Mokaform does not store full card numbers.

4.3 Product usage and technical data

We may process information about how the Services are used, such as forms created, features used, submission counts, settings, workspace activity, browser and device information, IP address, country-level location signals, log data, performance data, error reports, and security events.

We use this data to operate, secure, troubleshoot, monitor, and improve Mokaform.

4.4 Support and communication data

If you contact us, we may process your contact details, message content, attachments, diagnostic information, and support history.

We may also process your communication preferences and unsubscribe choices.

4.5 Website, cookies, and marketing data

When you browse the website, we may process cookie identifiers, consent choices, analytics identifiers, campaign source information, pages viewed, and similar usage data.

You can manage optional cookies through the cookie banner where available. More information is available in the Cookie Policy.

4.6 Form content, responses, and uploaded files

Customers choose what their forms ask for. Depending on the customer's form configuration, Mokaform may process:

  • form questions and form design;
  • form answers and submissions;
  • hidden fields and respondent metadata;
  • respondent country derived locally from IP address where this feature is used;
  • uploaded files;
  • signatures;
  • payment-related form data when payment features are used;
  • form notification content; and
  • data sent to integrations chosen by the customer.

Customers should avoid collecting unnecessary personal data, sensitive personal data, or regulated data unless they have a valid lawful basis and appropriate safeguards.

4.7 Local country lookup

Mokaform may use GeoLite2 data created by MaxMind to determine a respondent's country from their IP address. This lookup is performed locally by Mokaform. We do not share the respondent's IP address with MaxMind or another third-party geolocation provider for this purpose.

We use this data for country-level form metadata and related service functionality. We do not use GeoLite2 data to derive city, precise location, or individual-level inferences.

GeoLite2 data is used under the GeoLite2 End User License Agreement, and the required attribution is available on our Attributions page.

4.8 Media search and selection data

When a customer searches for or selects GIFs, videos, or photos in Mokaform's media library, we may process search terms, selected media identifiers, media URLs, provider attribution, and related technical API data.

Mokaform handles these media searches server-side. We do not intentionally share respondent IP addresses, browser metadata, or form submissions with Klipy, Pexels, or Unsplash as part of those media search features.

5. How we collect personal data

We collect personal data:

  • directly from you when you create an account, configure forms, submit forms, pay for Services, or contact us;
  • automatically when you use the website, app, forms, cookies, logs, and similar technologies;
  • from customers who invite you to a workspace or create forms that you submit;
  • from service providers that help us operate the Services, such as authentication, payment, analytics, monitoring, and email providers; and
  • from media content providers when customers use optional GIF, video, or photo search; and
  • from integrations or destinations configured by customers.

6. Why we use personal data

We process personal data only when we have a purpose and a lawful basis.

6.1 Providing the Services

We use account data, authentication data, customer content, form responses, uploaded files, technical data, and related records to provide, maintain, and support Mokaform.

Legal bases may include performance of a contract, customer instructions, and legitimate interests in operating the Services.

6.2 Security and abuse prevention

We use limited data to detect, prevent, investigate, and respond to fraud, spam, misuse, unauthorized access, security incidents, service abuse, and violations of our terms.

Legal bases may include legitimate interests, legal obligations, and performance of a contract.

6.3 Billing and accounting

We use billing and payment data to process subscriptions, invoices, taxes, refunds, disputes, and accounting records.

Legal bases may include performance of a contract and legal obligations.

6.4 Support and service communications

We use contact, support, diagnostic, and account data to respond to requests, troubleshoot issues, send transactional messages, and notify customers about account, billing, security, product, or legal changes.

Legal bases may include performance of a contract and legitimate interests.

6.5 Analytics and product improvement

We use website analytics, product usage data, logs, and aggregated or de-identified information to understand usage, improve reliability, measure performance, prioritize product work, and make Mokaform easier to use.

Legal bases may include consent where required and legitimate interests where permitted by law.

6.6 Marketing

We may send product updates, newsletters, or similar communications where permitted by law. You can opt out of non-essential marketing emails by using the unsubscribe link or contacting us.

Legal bases may include consent or legitimate interests, depending on the communication and applicable law.

6.7 Legal requirements

We may use or disclose personal data where necessary to comply with applicable law, respond to lawful requests, protect rights and safety, enforce agreements, resolve disputes, or support a merger, acquisition, financing, restructuring, or sale of assets.

6.8 Media search

We use media search and selection data to provide optional GIF, video, and photo search in the form builder, return selected media, keep provider attribution, and troubleshoot media features.

Legal bases may include performance of a contract and legitimate interests in providing and improving product functionality.

7. Form respondents and customer data

Mokaform does not own the responses submitted through customer forms. The customer who created the form controls the form's purpose, questions, audience, retention, exports, integrations, and follow-up.

As a processor, Mokaform may access customer form data only where needed to:

  • provide, maintain, and secure the Services;
  • process customer-configured form submissions, uploads, notifications, exports, and integrations;
  • troubleshoot or support the customer;
  • investigate abuse, fraud, or security issues;
  • comply with legal obligations; or
  • follow documented customer instructions.

If you are a respondent and want to access, correct, delete, or object to processing of a form response, you should contact the form creator first. If you contact Mokaform directly, we may direct you to the relevant customer or help the customer respond where appropriate.

8. Sharing personal data

We do not sell personal data.

For respondent country lookup, Mokaform uses GeoLite2 data locally. We do not share respondent IP addresses with MaxMind or another third-party geolocation provider for that lookup.

We may share personal data with:

  • service providers and subprocessors that help us provide, secure, monitor, support, and improve Mokaform;
  • payment providers for subscriptions and payment-enabled forms;
  • email providers for transactional emails and optional form notifications;
  • analytics and diagnostics providers for website, product, and reliability insights;
  • media content providers for optional server-side GIF, video, and photo search;
  • integrations or destinations configured by customers;
  • professional advisers, auditors, insurers, and legal advisers where necessary;
  • public authorities or third parties where required by law or necessary to protect rights, safety, and security; and
  • successor entities in connection with a merger, acquisition, financing, restructuring, or sale of assets.

Service providers may process personal data only for the services they provide to Mokaform and under appropriate contractual obligations.

9. Providers and regions

Our main providers and simplified regions are:

Provider Purpose Region Link
Render Services, Inc. Application and website hosting, deployment, networking, and runtime logs EU Learn more
Amazon Web Services, Inc. and affiliates Storage, backups, file uploads, transactional email, and related infrastructure services EU Learn more
Logto, Inc. Authentication and account access for Mokaform's EU tenant EU Learn more
Stripe, Inc. and affiliates Payment processing for paid plans and payment-enabled forms US Learn more
Segment.io, Inc. Product and website analytics routing US Learn more
Sentry.io Error tracking, monitoring, performance diagnostics, and crash reporting US Learn more
Google Analytics Website analytics US Learn more
Kikliko, Inc. (Klipy) Optional GIF search and media library content, requested server-side by Mokaform US Learn more
Pexels, a Canva Germany GmbH brand Optional video search and media library content, requested server-side by Mokaform EU Learn more
Unsplash Inc. Optional photo search and media library content, requested server-side by Mokaform US Learn more

The current subprocessor and GDPR information page is available at GDPR & Mokaform.

MaxMind GeoLite2 is used as a local country lookup database, not as a request-based geolocation provider. Mokaform does not send respondent IP addresses to MaxMind for country detection.

10. International transfers

Mokaform is based in FR and uses infrastructure in the EU for hosting, storage, file uploads, and email.

Some providers are located in the US or may process personal data from outside the EU. Where applicable law requires transfer safeguards, we rely on appropriate mechanisms such as adequacy decisions, the European Commission Standard Contractual Clauses, data processing agreements, and supplementary measures where appropriate.

The local GeoLite2 country lookup does not involve sending respondent IP addresses to MaxMind.

11. Retention

We keep personal data only for as long as needed for the purposes described in this policy, unless a longer period is required or permitted by law.

Typical retention practices include:

  • account data is kept while the account is active and then deleted or anonymized according to our account closure and deletion processes;
  • form responses and uploaded files are controlled by the customer and deleted from active systems when the customer deletes them, subject to backup rotation and legal/security exceptions;
  • billing, tax, invoice, and accounting records are kept for the periods required by applicable law;
  • support messages are kept as long as needed to handle the request, maintain support history, and protect legal rights;
  • security logs are kept for a limited period needed for security, fraud prevention, investigation, and service reliability; and
  • cookie and analytics data are kept according to cookie settings, consent choices, and provider retention settings.

If data cannot be deleted immediately because it is stored in backups, archives, or logs, we continue to protect it and delete or overwrite it according to the applicable lifecycle.

12. Security

Mokaform uses technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, loss, or destruction.

These measures include:

  • HTTPS/TLS encryption in transit;
  • encryption at rest where supported by infrastructure providers;
  • authentication and session controls;
  • role-based and least-privilege access where appropriate;
  • environment separation and restricted production access;
  • logging, monitoring, and incident response processes;
  • backup and recovery processes;
  • vendor review for providers that may process personal data; and
  • confidentiality obligations for personnel and service providers.

No internet service is completely risk-free. Customers are responsible for configuring their forms, workspace access, exports, notifications, and integrations appropriately.

13. Your privacy rights

Depending on your location and the type of data involved, you may have the right to:

  • access your personal data;
  • receive a copy of your personal data;
  • correct inaccurate or incomplete data;
  • request deletion;
  • restrict processing;
  • object to processing;
  • request data portability;
  • withdraw consent where processing is based on consent;
  • object to direct marketing;
  • opt out of certain sale, sharing, or targeted advertising practices where applicable; and
  • file a complaint with a data protection authority.

Mokaform does not sell personal data and does not use form responses for targeted advertising.

To exercise your rights, contact security@mokaform.com. We may need to verify your identity before acting on a request.

If your request concerns a response submitted to a customer form, we may direct you to the form creator because the form creator generally controls that response data.

14. Complaints

If you are in the EU, you may contact your local data protection authority.

Mokaform is based in FR. The French supervisory authority is the CNIL:

15. Children

The Services are not directed to children. Customers are responsible for deciding whether their forms are appropriate for their audience and for obtaining any notices, consents, or safeguards required when collecting data from minors.

If you believe a child has provided account data to Mokaform without appropriate authorization, contact us at security@mokaform.com.

16. Automated decisions

Mokaform does not use personal data to make decisions based solely on automated processing that produce legal effects or similarly significant effects about individuals, unless we explain otherwise in a specific notice or are permitted by applicable law.

17. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update this page and may notify customers through the Services or by email where appropriate.

18. Contact us

For privacy requests or questions, contact:

Mokaform SAS
Attn: Privacy Team
61 RUE de Lyon
75012 Paris
France

Email: security@mokaform.com