This policy explains how Qolibris OÜ processes personal data on ApplyForm.
Who we are
We are Qolibris OÜ (registry code 16201692), based in Tallinn, Estonia. We're the data controller responsible for your information on ApplyForm. Questions about your data? Contact us at contact@applyform.app. Learn more: https://www.inforegister.ee/16201692-QOLIBRIS-OU/ We never sell your data.
Data we process
Applicants: email address, your answers to the creator's questions, payment status and identifiers from Stripe (we never see your card number), IP address and time of consent at checkout, and the response you receive. Creators: account email, display name, avatar, form content, and Stripe account identifiers; Stripe collects identity and payout details directly under its own privacy policy. Website visitors: usage data via Google Analytics (page views, events, approximate device and location), processed by Google on our instructions.
Why and on what basis
To deliver the application to the creator and the response to you (contract); to process payments and refunds and defend against fraud and disputes (contract, legitimate interest, legal obligation); to keep records of your consent at checkout (legal obligation); to operate and secure the platform (legitimate interest); to send transactional emails about your application (contract); to understand how the marketing site is used so we can improve it (legitimate interest). We do not sell personal data and we do not run advertising on applicant data.
Who sees your application
Only the creator you applied to and, for support or abuse handling, Qolibris OÜ staff. Creators are contractually prohibited from publishing your application without your consent; contact us if this happens.
Subscribers, clients, members and leads
If you subscribe to a creator's newsletter, book a session, join a community or fill in a free form, the creator holds your email address, name, answers, subscription and booking history and any notes they take, in their contacts list on ApplyForm. The creator is the controller of that list; we process it on their behalf. Newsletter delivery, open and click events are recorded per issue to show the creator aggregate statistics and to stop sending to addresses that bounce or complain. For communities we store the Discord or Telegram account identifier you link so access can be granted and revoked. For sessions we store the time, your timezone and, if the creator connected Google Calendar, an event is created in their calendar with your email as attendee.
Onboarding chat with the agent
When you use the "Get started" chat on our website before creating an account, we process what you type there (for example your social media profiles and what you tell us about your audience), the public profile information the agent looks up, and the plan it drafts, to create that plan for you. The conversation is kept for 7 days so you can pick it up again, then deleted unless you create an account from it. To improve the agent, we automatically review these conversations: direct identifiers such as email addresses, phone numbers, links and handles are removed first, the review is done by an AI model, and we keep only the resulting quality scores and paraphrased findings, not the conversation. The basis is our legitimate interest in providing and improving the service.
Processors
Stripe (payments, Connect payouts, subscriptions, billing portal), Google Firebase and Google Cloud (authentication, database, hosting, EU region), Google Analytics (website analytics), Resend (transactional mail and newsletters), Google Calendar, Discord and Telegram (only when a creator connects them, limited to the data needed to book sessions or grant community access), and OpenAI / Anthropic for the agent: the onboarding chat and its quality reviews (see above), and when the agent drafts text for a creator (the creator's brief, public posts and past issues; never applicant answers or subscriber lists).
Retention
Applications and responses are kept for 24 months after completion to handle disputes and legal claims, then deleted or anonymised. Contacts, subscriptions and bookings are kept while the creator's account exists and deleted with it. Unsubscribed addresses are kept in a suppression state so they are not emailed again. Payment records are kept as long as accounting law requires (typically 7 years in Estonia). Analytics data is retained according to our Google Analytics property settings. Onboarding chats are deleted after 7 days unless turned into an account; their de-identified quality reviews are kept for up to 24 months. Creator accounts are kept until deleted.
Your rights
You can request access, correction, deletion, restriction or portability, and object to processing based on legitimate interest, by emailing contact@applyform.app. You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local authority.