Your forms.
Your data, explained.

1. Who operates Forms Flow+?

Forms Flow+ is operated by Nordin Nikaj, an individual developer using the Nikaj Systems brand, at Tuzi bb, Podgorica 81206, Montenegro. Nikaj Systems is not a separate incorporated legal entity.

For privacy questions or requests, contact contact@nikaj.dev. For product support, contact support@nikaj.dev.

This is the application-specific privacy policy for forms-flow.nikaj.dev, including its website, Trello Power-Up, public forms, and optional Google Forms integration. Separate Nikaj account and billing services are described in the Nikaj Systems Privacy Policy.

2. Form owners and respondents

The person or organization sharing a form decides what questions to ask, why to collect answers, who on its team can access them, and whether to send them to Trello. For those purposes, the form owner is responsible for providing appropriate notices and handling respondents’ information lawfully. We process the form content to provide the requested service.

If you are filling in a form, your answers are shared with its owner and authorized board users. Ask the form owner about its use of your answers. We handle service access, security, and support information for operating Forms Flow+.

3. Information we access and store

Trello connection and configuration

We store board and member identifiers, installation records, and workspace identifiers where available. We read board access permissions and the board metadata needed to configure delivery, such as lists, labels, members, and Custom Fields.

Saved mappings can include destination list IDs, label and member IDs, Custom Field IDs, a card-title template, and the questions selected for the card description or due date. We store created card IDs and delivery status, attempt counts, timestamps, and error codes. Forms Flow+ is not a general backup of every card on your board.

Forms and submitted answers

We store form titles, introductions, questions, help text, options, settings, drafts, and published versions. We store submitted answers, submission references and timestamps, and records used to prevent duplicate processing. Answers may include names, email addresses, or other personal information requested by a form owner.

Published native-form questions are accessible through the public form link. Responses are not displayed on that public page; they are available through authorized board access and any configured destination in Trello.

Authorization information

Temporary service sessions are held in server memory and expire after 15 minutes. To perform background card delivery, we store encrypted Trello authorization credentials associated with the delivery account. Connecting Google also stores encrypted Google refresh credentials and related authorization and synchronization records.

Optional Google Forms data

When you connect Google, Google Picker lets you explicitly select the Google Form you want to connect. Picker supplies the selected form's identifier and display name or file metadata. Forms Flow+ validates access to that identifier through the Google Forms API; it does not list or access unrelated Google Drive documents and does not modify Google Forms.

For the selected form, Forms Flow+ may access and store its identifier, title, supported questions, question labels, question types, answer options, and responder URL where Google supplies one. It may also access and store Google Form responses, response identifiers, response creation and submission timestamps, answer values, and a collected email address only when Google exposes it for that selected form. Imported question structure and responses are stored in Forms Flow+ with synchronization and duplicate-prevention records.

How Google data is used

Forms Flow+ uses Google data only to display and validate the selected form; import its supported question structure; preview and import existing responses when the user requests this; synchronize future responses; display response history to authorized board users; map response information into the form owner's configured Trello workflow; prevent duplicate imports; and maintain synchronization state. It is not used for unrelated purposes.

Google API Limited Use. Forms Flow+'s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Trello privacy notifications

We check the Trello compliance API daily. When Trello notifies us that an account was deleted, access was revoked, or a token expired, we remove the affected user's stored connections and credentials, user-owned forms and their responses, and member references in shared form mappings. We do not delete cards already created in Trello or the original Google Forms. Public form responses are not linked to Trello identities; contact us for a verified respondent deletion request.

Technical and support information

Servers process connection information, including IP addresses, to deliver the service and limit abusive requests. The application disables routine request logging and redacts authorization headers, cookies, and request bodies from configured application logs. Operational errors and support communications may still be retained to investigate problems. Please do not send passwords, access tokens, or unnecessary response content to support.

4. Why we use this information

• Check board permissions and provide authorized access to forms.
• Publish forms, accept answers, and display response history.
• Create Trello cards according to the form owner’s published mapping.
• Import responses from connected Google Forms.
• Track delivery, prevent duplicates, retry failures, and protect the service from abuse.
• Respond to support and privacy requests.

Data sales and advertising

Forms Flow+ does not sell raw, derived, aggregated, or anonymized Google Workspace user data. It does not use that data for targeted advertising and does not transfer it to advertising networks, data brokers, or other information resellers.

AI and machine learning

Forms Flow+ does not integrate with third-party AI or machine-learning services, model aggregators, gateways, upstream model endpoints, or self-hosted or offline AI models. It does not send Google Forms or other Google Workspace data to an AI provider. Raw, aggregated, anonymized, and derived Google Workspace API data is not used to create, train, improve, or develop foundational or generalized artificial-intelligence or machine-learning models, and is not transferred or sold for those purposes.

Our use of raw and derived information received from Google Workspace APIs adheres to the Google Workspace API User Data and Developer Policy and the Google API Services User Data Policy, including the Limited Use requirements.

5. Who receives data

• Forms Flow+ application and database infrastructure: selected form structure, imported responses, synchronization records, and encrypted credentials are processed and stored as needed to provide the service.
• Form owners and authorized board users: access to form management and response history follows board-scoped permission checks in the Power-Up.
• Atlassian / Trello: receives only the mapped response information and card settings chosen by the form owner when Trello card mapping is enabled. Unmapped response information is not included in the configured Trello card delivery.
• Google: is the authentication, Picker, and Google Forms API provider and the source of the selected Google Form data.
• Contabo: provides the server and database infrastructure hosting Forms Flow+.
• Support and legal disclosures: communications and the minimum necessary technical information may be processed to support the service, investigate security issues, or comply with applicable law. Do not send response content or credentials in a support request unless specifically requested through a verified process.

Google Workspace data is not transferred to advertising networks, data brokers, or third-party AI services. Providers and the developer may process information in countries other than your own. Contact us if you need information about hosting location or data-processing arrangements before using Forms Flow+ for your organization.

6. Cookies and browser storage

The Power-Up stores display preferences, such as compact cards and dashboard visibility, in your browser’s local storage. Trello manages its own authorization flow and provider-side storage. Google connection uses a short-lived security cookie to protect the authorization flow.

The native public-form client does not save answers to browser local storage. It temporarily holds entered answers and a pending submission in page memory, including when a request needs a safe retry. The Forms Flow+ interface does not currently embed advertising trackers.

7. Retention, deletion, and disconnection

Imported forms and responses do not currently have a scheduled automatic expiry. They remain in the service database until an authorized user deletes the form or a verified deletion request is completed. Pausing or archiving a form does not delete its records.

Disconnect and delete are different actions. Disconnecting stops access or future processing; it does not automatically erase previously imported data.

• Delete a form: removes that form and its associated questions, versions, imported responses, mapping, synchronization record, and delivery history from the active Forms Flow+ application database.
• Disconnect your account: removes your Forms Flow+ sessions and delivery credentials and initiates revocation of your Google connections. Shared forms, responses, and installation identifiers remain. An in-flight request may finish.
• Disconnect Google: stops future synchronization for that connection and attempts to revoke its Google grant. If revocation fails, the interface may require another attempt. Previously imported responses and queued Trello deliveries remain until the relevant form is deleted or a verified deletion request is completed.
• Data held by Google and Trello: disconnecting or deleting in Forms Flow+ does not delete the original Google Form or responses from Google and does not delete existing Trello cards. Manage those records with Google or Trello.

Deleting active records is not a promise of immediate removal from any retained operational backups or records required for security or legal reasons. No fixed backup-erasure period is stated here; contact us for the applicable deletion scope before submitting information that requires a specific retention guarantee.

8. Security

Forms Flow+ uses HTTPS, short-lived Forms Flow+ application sessions, and board-scoped permission checks. Google authorization uses PKCE, one-use OAuth state, and a short-lived HttpOnly, Secure, SameSite cookie. Stored Google refresh credentials and background delivery credentials are protected with AES-256-GCM authenticated encryption using a fresh initialization vector and context-bound authenticated data. OAuth client secrets, stored refresh credentials, and encryption keys remain server-side. Public submissions are validated and rate-limited.

Google Picker receives a short-lived browser access token directly from Google and public Picker configuration; it does not receive the stored server refresh credential or server secrets. No system can guarantee absolute security.

Use only the questions you need. Do not request passwords, payment-card details, or highly sensitive information through a general-purpose intake form.

9. Your privacy choices, revocation, and requests

You can stop future Google access by using Disconnect Google inside Forms Flow+, or by reviewing Forms Flow+ in your Google Account permissions and removing its access. Google explains how to review and remove third-party access in its Google Account linked-app help. Revoking access stops future access but does not itself delete data already imported into Forms Flow+.

To request deletion of data held by Forms Flow+, email contact@nikaj.dev with “Forms Flow+ privacy request,” the form link or response reference, and the request. We may need to verify identity or authority before releasing or deleting data. Do not include credentials.

Depending on the law that applies to you, you may have rights to access, correct, delete, or obtain a copy of personal information, or to object to or restrict certain processing. You may also have the right to complain to a relevant data-protection authority. Respondents should first contact the form owner, which determines the purpose of collecting their answers. We aim to respond within 30 days, subject to applicable legal requirements.

10. Changes to this policy

We will update this page when the service’s data practices change and revise the date above. Review it before enabling new integrations or collecting new types of information.