Privacy Policy

The short version

SmartForm stores the product forms you build, an email address if you create an account, and basic operational logs. It holds no patient data — the product is for medical-device product information, and our Terms prohibit entering patient information. We don't sell your data, and we don't run third-party advertising or tracking.

1. What we collect

• Form data — the product data you enter or upload: catalog numbers, descriptions, pricing, column names, and the spreadsheets you import. Stored so your form works at its link.
• Account data — if you sign up: your email address and name, handled by our authentication provider (Clerk). Anonymous use requires no account.
• Device-local data — your browser keeps a local list of forms you've opened (localStorage), so you can find them again. It stays on your device; clearing your browser clears it.
• Operational logs — basic events needed to run and secure the Service (e.g. form created, lookup succeeded/failed, rate-limit and access-denial events, error reports). Rate-limiting uses your IP address.

2. What we don't collect

• No patient information or health records — prohibited by design and by our Terms.
• No third-party advertising, ad pixels, or cross-site tracking.
• No sale or rental of your data to anyone, ever.

3. How your data is used

To operate the Service: storing your forms, running FDA lookups on the catalog numbers you provide, generating your exports, keeping you signed in, preventing abuse, and fixing problems. Aggregated, de-identified usage data (e.g. auto-fill match rates) may be used to improve the product.

4. Who processes data on our behalf

• Cloudflare — hosting, storage, and delivery. Data is encrypted in transit (TLS) and at rest.
• Clerk — account authentication (email, sign-in).

Catalog numbers you look up are sent to public FDA databases (openFDA / AccessGUDID) to retrieve device records — catalog numbers only, never your pricing or custom fields.

5. Form links

Forms are accessible to anyone who has their unique link — that is the sharing model. We don't publish or index form links, but you control who you share them with.

6. Cookies

We use only the cookies needed for sign-in sessions (set by Clerk). No advertising or analytics cookies.

7. Retention and deletion

Forms persist until deleted. You can delete any anonymous form from its page or your forms list; account-owned forms can be deleted by their owner. To delete your account and its data, contact us at the address below and we'll handle it promptly.

8. Children

The Service is a business tool and isn't directed at children under 16; we don't knowingly collect their information.

9. Changes

We'll update this policy as the product evolves and reflect material changes in the date above.

10. Contact

Privacy questions or deletion requests: support@vacstatus.com.