This Privacy Policy explains how Sycamore Software LLC ("we", "us") collects, uses and shares information when you use Contact Form Sniper, including contactformsniper.com, the web app, the API and the MCP connector (the "Service"). It also explains how we handle information about website owners whose public contact forms are used through the Service.
1. Information we collect
Account information. When you sign up, we collect your email address. If you sign in with Google, we receive your name, email address and profile picture from Google. We don't receive your Google password.
Payment information. Payments are handled by Stripe. We receive your email, the amount and a record of what you bought, but we never see or store your full card number.
Campaign information. The website lists you upload, the products or offers you describe, the AI drafts, your edits and approvals, submission results (and confirmation screenshots where available), and any replies sent back to your reply address.
Usage and device information. IP address, browser and device type, pages viewed, actions taken in the app, and logs our servers create when you use the Service.
Communications. Emails or messages you send us, such as support or refund requests.
2. Information about website owners
When a customer adds a website to a campaign, the Service visits that site's public pages (such as the homepage and contact page) to find the contact form and to give the AI context for a relevant message. We store the site's domain, the form we found, the message sent and the result.
We do not build profiles of website owners or sell lists of businesses. If a site owner opts out through our opt-out page or by replying STOP, we store the domain on a permanent do-not-contact list so it is never contacted through the Service again.
3. How we use information
- To run the Service: sign you in, find forms, draft and send approved messages, track results and show your dashboard.
- To process payments, credits, refunds and affiliate commissions.
- To keep the Service safe: prevent abuse, enforce opt-outs and our Terms, and handle complaints and disputes.
- To support you and send service emails (such as sign-in links, receipts and important changes).
- To understand how the Service is used and improve it.
- To comply with the law.
We don't sell your personal information, and we don't share it for cross-context behavioral advertising.
4. Legal bases (EEA and UK)
Where GDPR or UK GDPR applies, we rely on: contract (to provide the Service you signed up for); legitimate interests (security, abuse prevention, improving the Service, and honoring opt-outs); legal obligation (tax and accounting records, responding to lawful requests); and consent where we ask for it.
5. Your role and ours
For the lists and messages in your campaigns, you decide who is contacted and what is sent, so you are the controller of that outreach data and responsible for having a lawful basis to use it. We process it on your behalf to run the Service. For your account, billing and usage data, we are the controller.
6. Who we share information with
We share information only with service providers that help us run the Service, under contracts that limit how they can use it:
| Provider | Purpose |
|---|---|
| Supabase | Database and sign-in |
| Vercel | Website and app hosting |
| Railway | Servers that find forms and submit messages |
| xAI | AI drafting of messages |
| Stripe | Payments |
| Sign in with Google | |
| Sanity | Blog content |
| Email and notification providers | Sign-in links, receipts and reply forwarding |
When you approve a message, it is submitted to the website you chose, so that website receives the message content and contact details you included. We are not responsible for how that website handles it.
We may also share information if required by law, to protect our rights, users or the public, or as part of a merger, acquisition or sale of assets.
7. Google user data
If you sign in with Google, we only request your basic profile (name, email and profile picture) to create and sign in to your account. We use this data only to provide sign-in and account features. We do not access your Gmail, contacts, files or calendar, we do not sell Google user data, and we do not use it for advertising or to train AI models.
Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. You can remove our access any time from your Google Account's security settings.
8. AI processing
Drafts are generated by sending the target website's public page content and your product description to our AI provider. We don't send your payment information or account password, and we don't use your campaign data to train our own AI models.
9. Cookies
We use essential cookies to keep you signed in and secure. We don't currently use advertising cookies. If we add analytics or advertising tools that use cookies, we'll update this policy and ask for consent where required.
10. How long we keep information
- Account data: while your account is open, and up to 90 days after you close it.
- Campaign and submission records: while your account is open and up to 12 months after a submission, so we can handle disputes and complaints.
- Opt-out list: permanently, so opted-out sites are never contacted again.
- Payment and tax records: as long as the law requires (usually up to 7 years).
11. Security
We use encryption in transit, access controls and reputable infrastructure providers to protect information. No system is perfectly secure. If a breach affects your personal information, we'll notify you and the relevant authorities as the law requires.
12. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict some processing, and to withdraw consent. California residents also have the right to know what we collect and not to be discriminated against for using these rights.
To make a request, email support@contactformsniper.com from your account email. We'll respond within the time the law requires. You can also complain to your local data protection authority.
13. International transfers
We're based in the United States and our providers may process information in the US and other countries. Where required, we rely on safeguards such as standard contractual clauses.
14. Children
The Service is for businesses and is not intended for anyone under 18. We don't knowingly collect information from children.
15. Changes
We may update this policy. If a change is significant, we'll notify you by email or in the app before it takes effect. The date at the top shows when it was last updated.
16. Contact
Sycamore Software LLC Email: support@contactformsniper.com Opt out a website: contactformsniper.com/optout
© 2026 Sycamore Software LLC. All rights reserved.