Privacy Policy

1. Who operates Lugatu

Lugatu is a web service for creating and sharing forms and surveys, receiving submissions in a workspace Inbox, and connecting website forms to Lugatu. The service also includes team and agency workspaces, developer integrations, notifications and related tools.

Lugatu is the name of the service described in this policy. For privacy and support requests, contact support@lugatu.com. The service operator’s legal identity and postal address should be added once confirmed.

2. Scope and roles

This policy covers information processed through Lugatu websites, accounts, workspaces, forms, surveys, Inbox, attachments, developer interfaces and related service features.

A business or organization that creates a form decides what questions to ask, what respondent information to collect, and why it needs that information. Lugatu provides the service that stores and presents that information to the customer. The business should provide its own notices and handle respondent requests about the purpose of its form. Lugatu separately uses account, service-usage and security information to operate and protect the platform. The legal allocation of controller and processor duties depends on the parties, jurisdiction and applicable agreement; this page does not replace a data-processing agreement.

3. Information we process

The information involved depends on which Lugatu features you use. Account information can include your email address, display name, password credential stored as a password hash, email-verification state, workspace memberships, roles and preferences such as language and appearance.

Form and survey information is chosen by the customer who creates the form. It may include text, contact details, answers, uploaded files, status and workflow notes. Do not submit sensitive information unless the form owner has explained why it is needed and how it will be used.

Service-use and security information can include page paths and titles, referring-page URLs, a first-party visitor identifier, a session identifier, browser language, coarse device class, browser and operating-system category, request timing, and signals used for rate limits, abuse prevention and file security. If a signed-in browser sends a page-visit event, the event may be associated with the account email. The public analytics event endpoint receives the connecting IP address and user-agent; the current analytics visit record stores user-agent-derived categories but does not include the IP field.

• Account and workspace administration information.
• Customer-selected form and survey responses, including optional attachments.
• Page-visit, attribution, browser/device and security information needed to provide and protect the service.

4. Google Sign-In

Google Sign-In is available as an optional authentication and account connection method when enabled on the service. Accounts may also be created and accessed using a Lugatu email address and password with email verification.

When you choose to sign in or connect using Google Identity Services (GIS), the authentication flow receives your Google account’s stable subject identifier (sub), verified email address, and basic profile details (display name and avatar picture). Lugatu uses this information solely to verify your identity, create or link your account, confirm email control for eligible accounts, and maintain security audit events (external_auth_audit_events).

Only the Google subject identifier and provider association are stored in our database. Lugatu never requests, accesses, or stores Google account passwords, raw OAuth access tokens, or refresh tokens. Nonces are cryptographically random, single-use, and expire within 5 minutes. Google account data is never sold, never shared with third parties, and never used for advertising targeting, profiling, or tracking.

Users with an established password can link or disconnect Google Sign-In at any time in Account Settings. Disconnecting Google requires an active password so that you always maintain uninterrupted access to your account.

5. Customer-owned form and survey data

Customers control the questions and fields they configure and the responses submitted to those forms or surveys. Lugatu processes that information to receive, store, display, export and route it according to the customer’s use of the service and applicable settings.

Customers are responsible for deciding whether their collection is lawful, providing respondents with appropriate notices, obtaining any required permissions, limiting fields to what they need, choosing authorized team members and responding to requests about their own collection. Respondents should normally contact the business or organization named on the form first. We may assist with a request that concerns Lugatu’s own service or a customer’s instructions, subject to identity and authority checks.

6. Why information is used

Lugatu uses information to create and secure accounts; provide forms, surveys, workspaces, Inbox, exports and integrations; deliver customer-configured notifications; answer support requests; diagnose failures; prevent spam, malicious files and unauthorized access; enforce service limits; and meet legal obligations.

Depending on the processing and the law that applies, information may be processed to provide a requested service, meet legal obligations, protect the service and users, or with consent where consent is required. The applicable basis depends on the specific activity and your location.

7. How information is shared

Lugatu does not sell form or survey responses or use respondent answers to target advertising. Information is available to the customer and workspace members whom that customer authorizes. Lugatu may use providers for infrastructure, database hosting, private file storage, malware scanning, email delivery or security checks when those services are configured. The providers and processing locations depend on the live service configuration and should be confirmed in the applicable service terms or privacy information.

Information may also be disclosed if required by law, to protect the service and people from fraud or abuse, or as part of a business transfer subject to appropriate safeguards. We do not disclose private submission content to public AI tools or use it for automatic translation.

8. Cookies and browser storage

Lugatu uses first-party browser storage for service operation and preferences. Authentication and anti-forgery cookies support sign-in and protect state-changing requests. Authentication cookies are marked HttpOnly and SameSite=Lax; production configuration requires secure cookies. The application configures a 14-day sliding authentication lifetime. Temporary external-authentication and two-factor cookies are used only by their respective flows.

The site can store language and appearance choices, the selected workspace, and a visitor identifier in local browser storage. A session identifier is stored in sessionStorage and ordinarily lasts for the browser tab session. The language-preference cookie, when written, is set for up to one year.

Lugatu uses Google Tag (measurement ID G-8DH67PTTD4) to understand aggregate platform performance and usage. In accordance with European Economic Area (EEA), UK, and Swiss data protection standards (GDPR / ePrivacy Directive), Google Consent Mode v2 is implemented across all public pages with non-essential storage (ad_storage, analytics_storage, ad_user_data, and ad_personalization) set to denied by default prior to explicit user choice.

Lugatu is an ad-free SaaS platform. We do not engage in cross-site profiling, behavioural ad targeting, or sale of personal data; advertising-related permissions remain permanently denied. When analytics storage is affirmatively granted by the user, aggregated metrics with IP masking are recorded to help us maintain system reliability and usability. Users may review, update, or revoke their consent choices at any time using the Cookie Preferences control available in the site footer.

9. Security

The application uses authenticated sessions, email verification, workspace authorization, request protections, rate limits and abuse controls. File features are designed to use private object storage and malware scanning when enabled; the service can keep uploads unavailable when required storage or scanning controls are not ready.

These measures reduce risk but cannot guarantee that a service, network or device is completely secure. Security controls and available file features may vary by deployment. Lugatu does not claim a security certification unless it is separately identified and verified.

10. Retention and deletion

Lugatu keeps information for as long as needed to provide the service, maintain customer records, protect against abuse, resolve disputes and meet legal requirements. Customers can export form and survey records through available workspace tools. The application does not currently expose a self-service account-deletion endpoint.

Uploaded files are configured for retention of up to 90 days. After a file is deleted, a technical record may remain for up to seven additional days. The traffic analytics ledger keeps up to 2,000 recent visit records and has no time-based expiry in that service. Actual production settings, other database records and backup deletion periods depend on the deployment and must be confirmed by the service operator.

To request account closure or deletion, contact support@lugatu.com. We will verify the request and explain what can be deleted, what must be retained, and any applicable timing. Customer respondents should contact the form owner about information the owner collected.

11. International processing

Information may be processed in countries other than yours depending on the service providers and deployment locations. The applicable transfer arrangements depend on the countries and providers involved; consult the relevant service terms or contact the service operator for details.

12. Privacy choices and rights

Depending on your location, privacy law may give you rights to request access to, correction of, deletion of, restriction of, or objection to certain processing, and to withdraw consent where processing relies on consent. You may also have a right to complain to a privacy regulator.

For account information or Lugatu-controlled service data, write to support@lugatu.com with enough information for us to verify your request. For a response collected by a Lugatu customer, contact the business named on that form; Lugatu may forward or assist with a valid request where appropriate. Applicable deadlines and exceptions depend on local law.

13. Children

Lugatu is designed for businesses, organizations, designers and developers, not for children. Customers should not use forms to collect children’s information unless they have established the notices, permissions and safeguards required by the law that applies to them.

14. Changes to this policy

We may update this policy when the service, law or data practices change. We will publish the current version on this page and update the date above. For material changes, we will use an appropriate notice in the service or another reasonable channel.

15. Contact

For privacy questions or requests, contact support@lugatu.com. Include enough information for us to understand and verify your request. The service operator’s legal name and postal contact details should be added once confirmed.