Privacy policy -- Lamofel
Effective: 2026-10-05
Lamofel is run by Piyush Bhatia, an individual based in India ("we", "us"). Questions or requests: support@lamofel.com.
Two kinds of people
- Account holders: people who create forms with Lamofel.
- Visitors: people who fill in a form on an account holder's website. The account holder decides what the form asks for and what happens to the messages; we store and deliver those messages on the account holder's behalf.
What we collect, why, and for how long
| What | Why | How long |
|---|---|---|
| Your email address | your account, sign-in, and service emails | while your account exists |
| A one-way scrambled copy (hash) of your API key -- never the key itself | to check requests from the API and dashboard | while your account exists |
| Your plan and how many messages each form delivered each month | to apply your plan's limits | while your account exists |
| Your form settings: form name, the address that receives messages, the website allowed to use the form, the page to show after sending | to deliver messages where you asked | while your account exists |
| Proof that the receiving address agreed to receive messages | no message is ever emailed to an address that has not confirmed | the confirmation link works for 7 days; the fact that an address confirmed is kept while your account exists |
| The messages visitors send through your forms -- whatever your form asks for (often a name, an email address and a message). We remove the hidden anti-spam field and do not accept file uploads | to email them to you and make them available through the API and connected AI assistants | deleted automatically 30 days after we receive them |
| A one-way hash of each visitor's IP address (for IPv6, of its /64 network), made with a secret key and stored with the message -- never the IP address itself. We still treat it as personal data | to stop abuse and floods | deleted with the message after 30 days |
| Delivery details for each message: time received, whether it was flagged as spam, and whether it was sent, held or bounced. Spam-flagged messages, and messages to an address that has not confirmed yet, are stored but never emailed | your delivery log and spam handling | 30 days |
| Short-term counters that stop floods on forms, sign-up and the waitlist: a count per one-way IP hash (for IPv6, of its /64 network) per minute or hour -- never the IP address itself | abuse protection | deleted within about a day |
| Sign-in protection: when you sign in -- also from ChatGPT or another AI assistant -- we keep counters keyed by a one-way hash of your IP address (for IPv6, of its /64 network) or of your email address (never the address itself), a scrambled one-time code, and sign-in tokens. We store only scrambled copies (hashes) of codes and tokens | to keep sign-in safe and keep a connected assistant signed in | counters: within about a day; one-time code: 10 minutes; sign-in tokens: up to 30 days |
| Waitlist: your email and the plan you chose, if you join a paid plan's waitlist | to tell you when paid checkout opens | 365 days, or earlier if you ask us to remove it |
| Visit counts by day and page, with the link code (?ref=) you followed and the name of the website that linked to us -- no IP address, no cookie, nothing that identifies you | to see which pages and links bring visitors | 400 days |
| The link code (?ref=) you arrived with when you claimed your first form | to see which pages bring customers | while your account exists |
| Paid plans: your subscription number and its status (active, cancelled, end date), sent to us by Paddle | to know which plan you paid for and until when | while your account exists |
We do not collect payment card or bank details: Paddle, our payment provider, collects them (see below). We do not use tracking or advertising cookies, analytics trackers, or advertising.
Who handles data for us
- Cloudflare (hosting and database): every request to Lamofel passes through Cloudflare, including IP addresses, and our database is stored with Cloudflare.
- Resend (email): receives every email we send -- sign-in codes, confirmation links, and each delivered message with all its fields. Resend keeps sent-email data for 30 days.
- Paddle (payments): Paddle is the merchant of record for our paid plans. At checkout Paddle collects your name, email, payment details, billing address and tax information under its own privacy notice; it sends us only your subscription number and status.
- An AI assistant you connect: if you connect Lamofel to ChatGPT or another AI assistant, the messages you ask it to show are sent to that assistant's provider under your agreement with that provider. Before they leave us, each value is cut to 500 characters and long numbers (such as card numbers) are masked.
- App reviewers: when we submit Lamofel to an app directory, the reviewer uses a demo account with sample data only.
We do not sell personal data.
Your choices and rights
- See your data: your forms and their messages are available through the API and connected AI assistants; email us for a full copy.
- Correct: change your form settings yourself; for anything else, email us.
- Delete: email support@lamofel.com to delete your account, your forms and their stored messages; we do it within 30 days. Messages delete themselves 30 days after we receive them in any case.
- Visitors: if you sent a message through a form, contact the website that runs the form. You can also email us and we will help.
- Waitlist removal: email us and we remove your address.
- Complain: if we do not resolve a concern about your personal data, you can complain to the Data Protection Board of India.
Security
API keys, sign-in codes and sign-in tokens are stored only as one-way hashes. All traffic uses HTTPS. Messages are emailed only to addresses that confirmed they want them. Stored messages are deleted after 30 days.
Children
Lamofel is a tool for running websites, not a service aimed at children. If you are under 18, use it only with your parent's or guardian's permission; if a parent believes their child gave us personal data without that permission, contact us and we delete it.
AI
Lamofel is built and run with the help of AI systems. If you ask whether you are dealing with an AI, we will tell you the truth.
Changes
We post changes on this page with a new effective date. If a change matters for how we use your data, we email account holders at least 14 days before it applies.
Contact
Questions about how we process your personal data are answered by the person who runs Lamofel: support@lamofel.com