Privacy notice

The short version

• The site's own code sets no cookies and loads no analytics, tracking or advertising scripts. Our web host may set a short-lived security cookie if it checks whether a visit is automated.
• The two forms collect an email address. The enterprise form also takes your organization's name if you give it. Nothing else is collected through the forms. If a form opens an email draft instead, the email you send us also carries whatever your mail app adds, such as your name.
• We use these details only for what the form says: NymForm launch and alpha emails, or contact about NymForm for teams. We also keep a record of what you agreed to.
• Signups pass through our web host (Cloudflare) and our automation (n8n, hosted on Railway). They are stored in a database run by Supabase in the United States.
• We keep signups until 12 months after NymForm's public launch, or 2 years after you signed up if that comes first, then delete them. If you've become a customer by then, we keep your entry with your customer records instead.
• The home page shows our product video as a still image. Nothing is sent to Vimeo until you press play; then the video loads from Vimeo, which receives some data and may set cookies.
• To withdraw, see, correct or delete your details, email jorge@skyspanmarketing.com.

Who runs this site

The NymForm website (nymform.com) and its signup lists are run by Jorge Garcia, doing business as Sky Span Marketing. In this notice, "we" means Jorge Garcia, doing business as Sky Span Marketing.

Jorge Garcia DBA Sky Span Marketing, 3050 Madera Way, Marina, CA 93933, USA

Contact: jorge@skyspanmarketing.com

This notice covers the website and its forms. It does not cover the NymForm Excel add-in, which has no NymForm server. For the add-in, see Security & data flow.

What the forms collect

You can use the site, the docs and the video without filling in a form. The forms need your email address, because that is how we reach you. Without it we can't add you to a list. The organization name is optional.

Early access

• Your email address.

Enterprise interest

• Your work email.
• Your company or organization name, if you enter one (up to 120 characters).

Stored with each signup

• Which list you joined: early access or enterprise.
• For signups made through the form: the exact consent wording shown under the form, and its version.
• For signups we add by hand from your email: a note that you asked by email, and the date of your email.
• Whether you're subscribed or unsubscribed.
• The date and time your entry was added.

One address can appear at most once on each list. If you submit the same address again, nothing changes. The page shows the same message either way, so nobody can use the form to find out who is on the list.

Each form also has a hidden field that people don't see. It is there to catch spam bots. If that field is filled in, nothing is stored.

What the signup record doesn't include

The signup record has no field for your name, IP address, browser details or the page you came from. The form sends no cookies. The part of the site that receives the form (the relay) passes on only the fields listed above. It does not pass on your IP address or browser details, and our database has no place to store them.

Our web host, Cloudflare, handles your IP address and browser details, as every web host must, to deliver the site. It also uses your IP address to limit how often the forms can be used in a short time, which stops floods of automated signups. See Where your details go.

When a form opens an email draft instead

When the online forms are not connected, the page says: "Preview mode: this prepares an email draft. Nothing is submitted automatically." In that mode the page sends nothing. It opens a draft in your own mail app, addressed to jorge@skyspanmarketing.com, with your email address in the body. For the enterprise form, your organization is in the body too.

We receive it only if you send it yourself. It then arrives in our mailbox as an ordinary email, with whatever your mail app includes, such as your name.

The same applies to the Contact link in the footer (the forms point to it if a submission fails), the "Tell us" links on the docs pages, and the "Email Jorge" links shown when JavaScript is off. Those emails go to our mailbox. Nothing adds them to a signup list automatically.

If your email asks to be added to a list, we add your address to that list by hand. The prepared drafts and the "Email Jorge" links count as asking. Your email is then our record of what you asked for. We use any other email only to answer it and to follow up on what you asked us.

Why we use your details

• Early access: to send you NymForm launch and alpha emails. The form says: "Requesting access asks for NymForm launch and alpha emails from Jorge Garcia / Sky Span Marketing. You can unsubscribe or withdraw your request by email."
• Enterprise interest: only to contact you about NymForm for teams. The form says: "We use your work email and organization only to contact you about NymForm for teams. You can withdraw your request by email."
• The consent wording and version, or the note that you asked by email: to keep a record of what you asked for.

We don't use your details for anything else. We don't use them to make automated decisions about you. Signups are kept in their own table, apart from Sky Span Marketing's sales leads, so the automation that drafts replies to sales leads never sees them.

Submitting the form signs you up. There is no checkbox and no confirmation step. We don't send an automatic confirmation or welcome email.

If EU or UK data protection law applies to you, our legal basis for the signup lists is your consent. You give it when you submit the form after seeing the wording under it, or when you email us asking to be added. You can withdraw it at any time. Withdrawing doesn't affect what we did before.

For everything else, our legal basis is our legitimate interest in respecting your choices, answering you and running the site. That covers keeping your unsubscribed entry after you withdraw (only so we don't sign you up again), answering your emails, and running the site securely, including the product video.

Where your details go

Some details about how each step handles your data:

• The relay keeps nothing. It writes a log line only when something goes wrong, and that line says only what failed, for example the error number our automation sent back. It never logs your email address or anything else you entered.
• The automation is set to keep no history of its runs. While a run is in progress, n8n writes a temporary record of it to its own database. That record includes everything you submitted: your address, and your organization if you gave one. That database is its own section (schema) of the same Supabase database that holds the list. When the run ends, n8n marks the record as deleted. Its regular cleanup runs every 15 minutes and then removes it, normally within half an hour.
• The database is locked. The public key that Supabase gives every project can't read or change the list. Only our private server key, or someone signed in as an admin of our Supabase project, can. Apart from our administrators, only our own systems hold that key: our automation, and our internal Slack bot, which has no feature that uses this list.
• Admin access: only our administrators and our own internal tools can access the database, n8n and Railway.

Apart from the Vimeo video once you press play, nothing on this site or in the signup process sends your details to an advertising, analytics or mailing service. We don't use a mailing service for these lists yet. If we start using one to send NymForm emails, we'll name it here. Every NymForm email we send you includes our postal address and tells you how to unsubscribe.

We don't sell the list, and we don't share it for advertising.

Your signup is stored in the United States (Northern California). Supabase is a Singapore company and the other services are US companies. If you live elsewhere, your details are transferred to the United States, where data protection law may differ from the law where you live, and the services may also handle them in other countries. Where EU or UK data protection law applies, these transfers are protected as follows:

• Cloudflare, Google and Railway are certified under the EU-U.S. Data Privacy Framework and its UK Extension. Cloudflare's and Google's data processing terms with us also include the EU Standard Contractual Clauses and the UK Addendum, in case that certification ever lapses.
• Supabase is not certified under the Data Privacy Framework. Its data processing terms with us include the EU Standard Contractual Clauses and the UK Addendum.
• Vimeo receives data from your browser directly, and only after you press play. It is certified under the EU-U.S. Data Privacy Framework and its UK Extension.

Ask us if you want more details or a copy of the relevant terms.

How long we keep it

• Signup lists: until 12 months after NymForm's public launch, or 2 years after you signed up if that comes first. Then we delete your entry, unless you have become a NymForm customer by then, meaning you have bought NymForm or signed a contract with us for it. A customer's entry is kept with their customer records instead. We do this by hand; nothing is deleted automatically. When NymForm launches publicly, we'll add the launch date to this notice.
• Withdrawn signups: we mark your entry as unsubscribed, unless you ask us to delete it. An unsubscribed entry keeps your address, the list, your organization if you gave one, the consent record and the date it was added, so a later form submission with the same address doesn't sign you up again. Unsubscribed entries are deleted on the same schedule: 12 months after launch, or 2 years after the entry was added if that comes first. See Withdraw, correct or delete.
• The automation's temporary run records: removed by n8n's cleanup after each run, normally within half an hour (see above).
• Emails you send us through this site (email drafts, the Contact and "Tell us" links, and requests about your details): we delete them, and our replies, 12 months after launch or 2 years after we received them, whichever comes first, unless we still need one for a request that is still open or you've become a customer. A deleted email can stay in the mailbox's trash, and in Google's systems, for a while before Google removes it.
• Database backups: anything deleted from the database, including a removed entry, may stay in Supabase's backups until those backups are replaced by newer ones and deleted.
• Hosting logs: Cloudflare, Railway and Supabase keep their own operational and security logs, which can include IP addresses, under their own terms. We don't use them to build profiles of visitors.

The Vimeo video

The home page shows our product video as a still image served from our own site, with a play button. Until you press play, your browser doesn't contact Vimeo at all. When you press play, the page loads Vimeo's player from player.vimeo.com, and the player may then load more files from other Vimeo servers. From then on Vimeo receives your IP address, your browser details and our site's address, nymform.com. It does not receive the full address of the page. If JavaScript is off, the page shows a link to watch the video on vimeo.com instead.

We embed the video with Vimeo's "do not track" setting. According to Vimeo, this turns off its tracking cookies and session tracking, and these plays are not counted in its viewing stats. Vimeo may still set cookies it treats as essential, for example for security. If you already have vimeo.com cookies, for example because you're logged in to Vimeo, your browser may send them to the player, depending on its third-party cookie settings.

Once you press play, the video runs in its own frame. We don't load any Vimeo script on our pages. Only the home page has the video.

Vimeo's own privacy policy: vimeo.com/privacy (opens external site).

Cookies and analytics

• The site's own code sets no cookies. It stores nothing in your browser: no local storage and no session storage.
• The site runs no analytics scripts. Its code includes no tracking pixels, advertising scripts, remote fonts or third-party scripts. Its security policy blocks scripts from other sites. If our web host adds its own analytics tag to a page, that policy blocks it, so it doesn't run.
• Our web host's dashboard may show us overall traffic numbers from its logs, such as the number of visits. We don't use them to track individual visitors.
• The forms send no cookies.
• Our web host, Cloudflare, may show a security check to traffic that looks automated. That check can set a short-lived security cookie.
• Once you press play, Vimeo may set its own cookies inside the video frame (see The Vimeo video).

Withdraw, correct or delete

Email jorge@skyspanmarketing.com from the address you signed up with, and tell us which list: early access or enterprise. Before we send a copy of your details, or change or delete them, we may reply to the signed-up address to check that the request came from you. This helps make sure nobody can read, change or withdraw someone else's entry.

You can ask us to:

• send you a copy of the details we hold about you;
• correct them;
• delete them;
• withdraw your consent, so we send you no more NymForm emails;
• stop using your details in a way you object to;
• if EU or UK law applies to you, limit how we use your details while a request is being checked;
• if EU or UK law applies to you, send your details to you in a common file format you can reuse.

We handle each request by hand and answer within 30 days.

To withdraw, we mark your entry as unsubscribed. If you ask us to delete your entry, we delete it instead.

If your entry is unsubscribed and you later submit the form again with the same address, the page still shows its usual message, such as "You’re on the early-access list", but your entry stays unsubscribed and we won't email you. To be added back, email us. If we deleted your entry instead, submitting the form again adds you to the list again.

If EU or UK data protection law applies to you, you can also complain to the data protection authority where you live or work.

If you're a California resident: we don't sell your personal information, and we don't share it with anyone for advertising, including targeted advertising. The services listed under Where your details go receive it only as described there.

Children

The site and its forms are not meant for children under 16. We don't knowingly collect their details. If you think a child has signed up, email us and we'll delete the entry.

Changes to this notice

If we change this notice, we'll update the date on this page. If a change affects how we use existing signups, we'll email the people on the list before it applies, or ask for their consent again where the law requires it.

If we change how we use new signups, we'll also change the consent wording under the form. For signups made through the form, each wording has a version number, and that version is stored with your signup, so we know which wording you saw.

Last updated 2026-09-28.