Privacy Policy

• The people whose data you fill into forms are your clients, not ours. We process that data on your instructions and never use it for anything else.
• Spreadsheet cell values never land in our database — files go to encrypted storage and are read row-by-row in memory while rendering.
• Generated files delete themselves on a plan-based clock; records you choose to save persist until you delete them; the instant-fill API stores nothing at all.
• Form-fill data is never sent to AI providers and never used to train models.
• We use session cookies only — no advertising or cross-site tracking.
• All customer data is processed and stored in the United States today.

To run your account we store:

• Identity — your name, email address, and avatar (from Google if you sign in with Google, or the email address and a salted password hash if you register directly).
• Billing — your plan and Stripe customer/subscription identifiers. Card details are entered on Stripe's forms and stored by Stripe; we never see the full number.
• Usage metering — per-period counters (PDFs exported, API calls) used for quotas and billing.
• API keys — the key name, a prefix, and a hash of the secret (we cannot recover a lost key).
• Audit log — consequential account actions (key created, data purged, sign-ins) as metadata: what happened and when, never form-fill values.

Fillall is built on a deliberate split between two kinds of storage, and the split is the privacy design:

The control plane holds what makes the service work: your account, plan, settings, and the shared form catalog. It contains no form-fill data.

The regional data plane holds everything you fill into forms — records, uploaded files, generated PDFs. It lives in the data region your account was pinned to at first sign-in, and nothing reads it without that region being specified. Within it, uploaded spreadsheets take a stricter path still: the file goes directly to encrypted object storage (it never passes through our application servers), and at fill time it is read one row at a time in memory — cell in, PDF out, value discarded. The SSNs and salaries in your sheet are never written to our database.

We use AI providers (Anthropic; optionally OpenAI) for exactly one job: understanding the structure of form documents — reading a form's layout to detect and name its fillable fields when a form is first set up, and picking which fields best label a record in a list (using only the field names themselves).

The data you fill into forms is never sent to an AI provider. Not your records, not your spreadsheet rows, not rendered PDFs. Rendering is fully deterministic code with no AI involved. What an AI provider may see is the form document itself when you upload one for setup — so if you upload a form for analysis, upload the blank form, not a filled copy.

Your data is never used to train models — ours or anyone else's.

We set cookies for exactly one purpose: keeping you signed in. That is a session cookie after you sign in, plus a short-lived cookie during the sign-in flow itself. Your light/dark theme preference is kept in your browser's local storage.

There are no advertising cookies, no analytics trackers, and no cross-site tracking of any kind — which is why there is no cookie banner.

We never sell personal data, and we never share your form data with anyone except the infrastructure vendors that run the service — each listed with its role on the Subprocessors page. We may disclose data where the law requires it; where legally permitted, we will tell you first.

All customer data is processed and stored in the United States — the database in AWS us-east-2 (Ohio) via Neon, and files in Cloudflare R2's US region. This is true regardless of where you sign up from: additional regions (Europe, Asia-Pacific) are planned but not yet live, so today every account's home region resolves to US infrastructure. If US residency is a problem for your compliance requirements, wait for your region to launch rather than working around it.

API clients can read this machine-readably: GET /api/v1/me returns a residency object with the region, jurisdiction, and datacenter.

Depending on where you live, you may have rights to access, correct, delete, and export personal data, and to object to or restrict processing. Most of these are self-serve in Fillall by design:

• Deletion — delete records or whole batches from the site or the API at any time; use purge now for immediate hard deletion that also removes every generated file. Account deletion can be requested from your account page.
• Access and correction — your records are visible and editable on the site and via the API.
• Everything else — email support@fillall.io and we will respond within the statutory window.

If you fill forms for your own clients, requests from those individuals should go to you as the controller; we will assist you as your processor (see the DPA).

Data is encrypted in transit (TLS) and at rest. Stored service credentials are additionally encrypted at the application layer (AES-256-GCM). Customer and staff authentication are two entirely separate systems on separate domains; staff access requires a password and a second factor. API keys are stored as hashes, can be IP-restricted, and consequential actions are recorded in an append-only audit log. Report security issues to support@fillall.io.

We will announce material changes to this policy on the site before they take effect; the version identifier at the top changes whenever the text does. Questions: support@fillall.io.