Privacy notice
Last updated: [DATE]
Who we are
Intake is a form backend run by [STARSTORM LEGAL ENTITY NAME], a company registered in [England and Wales] (company number [NUMBER]), registered office [ADDRESS] ("Starstorm", "we", "us").
We are registered with the Information Commissioner's Office, registration number [ICO NUMBER].
Contact for anything in this notice: intake@starstorm.dev.
Two kinds of data, two roles
Intake handles two different kinds of personal data, and our responsibilities differ for each.
- Your account data: the details of people who sign up for and use Intake, such as names, email addresses and sign-in records. For this we are the controller, and this notice explains what we do with it.
- Form submissions: what visitors type into forms that our customers build with Intake, and, where a form uses anonymous follow-up, the messages a visitor and the customer exchange about it. For this, the customer who owns the form is the controller and we are their processor. We handle submissions only on the customer's instructions, under the data processing terms in our Terms of Service. If you filled in a form powered by Intake and have a question about your data, contact the organisation whose form it was. They decide what is collected and why, and they can ask us to help with your request.
Account data we collect and why
| What | Why | Lawful basis |
|---|---|---|
| Email address and password (stored only as an Argon2id hash) | To create your account and let you sign in | Contract |
| Your name or display name, where you give one, and the workspaces and roles you belong to | To run the service and show your team who did what | Contract |
| Two-factor and single sign-on identifiers, where you use them | To secure sign-in | Contract |
| Sign-in records: time and IP address, kept in your workspace's audit log | Security, and so workspace owners can review access | Legitimate interests (keeping accounts secure) |
| Server logs: IP address, time, page requested, response | Security, abuse prevention and fixing faults | Legitimate interests |
| Billing details: name, billing address and payment card. Stripe sells our subscriptions as merchant of record, so it collects these as a controller in its own right, under its own privacy policy; we see your name, billing country, the card brand and last four digits | To take payment, and to keep records of what you bought | Contract; legal obligation (tax records) |
| Emails we send you: verification, password reset, invitations, plan and usage alerts | To run the service | Contract |
| Messages you send us | To answer them | Legitimate interests |
We do not use your account data for advertising, we do not sell it, and we do not build profiles of you.
Cookies
The Intake dashboard uses only cookies that are strictly necessary for it to work. None are used for analytics or advertising, and none are set by third parties.
| Cookie | Purpose | Lasts |
|---|---|---|
intake_session | Keeps you signed in | Up to 30 days, or until you sign out |
intake_2fa | Holds a sign-in between your password and your two-factor code | A few minutes |
intake_oidc | Protects a single sign-on login while it is in progress | A few minutes |
theme | Remembers whether you chose the light or dark theme (only set if you use the switch) | 1 year, or until you choose "auto" |
flash | Shows a one-off message such as "Saved" after you submit a form | 60 seconds |
Hosted form pages and form endpoints set no cookies.
Our public website runs no analytics and loads nothing from third parties.
Encrypted forms keep an unlocked key in your browser's storage (IndexedDB) on devices where you choose to unlock the vault. It never leaves your browser. It is removed when the vault locks, when you choose "Lock now", or when you sign out.
Who we share it with
We use a small number of suppliers ("sub-processors") to run Intake, such as our hosting provider, Stripe for payments, and our email provider. Each processes data only for us, under a written contract. The current list, with what each does and where, is on our sub-processors page.
Some data leaves Intake only because a customer chooses it:
- reCAPTCHA: if a customer turns it on for a form, the visitor's browser talks to Google.
- Integrations: if a customer connects Slack, Microsoft Teams, Discord, Telegram, ntfy, n8n, a webhook, or their own mail server, submissions are sent there.
Those transfers happen on the customer's instruction, and the customer is responsible for them.
We may also share data:
- if the law requires it, for example a court order;
- to protect our rights, our users or the public, for example to investigate abuse;
- with a buyer, if Starstorm or Intake is sold, under the same protections.
International transfers
Your data is stored in the United Kingdom. Where a supplier processes it outside the UK, as Stripe does in the USA, we rely on one of two safeguards:
- UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework for certified US companies;
- the ICO's International Data Transfer Agreement or Addendum.
You can ask us for a copy of the relevant safeguard.
How long we keep it
| Data | Kept |
|---|---|
| Account data | While your account exists. After you delete your account or workspace, it is removed after a grace period of 30 days (so accidental deletions can be undone), then deleted from the live system. |
| Backups | Rolled over within [BACKUP RETENTION, e.g. 30 days] |
| Workspace audit log, including sign-in IP addresses | [AUDIT RETENTION, e.g. 2 years] |
| Server logs | [LOG RETENTION, e.g. 30 days] |
| Billing records | 6 years after the end of the financial year they relate to (HMRC requirement) |
| Form submissions | As the customer's plan or settings decide; see our Terms |
Security
Measures we take include:
- encrypted connections;
- passwords hashed with Argon2id;
- optional two-factor sign-in;
- integration credentials encrypted at rest;
- each workspace isolated in the database itself (row-level security);
- strict content security policies;
- an audit log;
- end-to-end encryption for forms that need it. With those, even we cannot read the submissions.
No system is perfectly secure. If a breach affects your data and is likely to put you at risk, we will tell you without undue delay.
Your rights
Under UK data protection law you can:
- ask for a copy of your data;
- ask us to correct it;
- ask us to delete it;
- ask us to restrict or object to how we use it;
- ask to receive it in a portable format. Intake's export does this for workspace data.
Where we rely on consent, you can withdraw it at any time.
To use any of these rights, email intake@starstorm.dev. We will reply within one month.
If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.
Children
Intake is a service for businesses and adults. It is not intended for anyone under 18, and we do not knowingly collect their account data.
Changes
If we change this notice in a way that matters, we will tell account holders by email or in the dashboard before the change takes effect. The date at the top shows the latest version.