File Upload for Google Forms™ – No Sign-in ("the add-on") is made by AddonNordic ApS, CVR 46495985, Denmark ("we"). Contact: [email protected].
The add-on has two kinds of users: the form owner, who installs it, and people who send files through the owner's upload page. For the files and answers, the form owner is the controller and we are their processor. For the owner's account and plan, we are the controller.
1. What data we access and why
| Data | Whose | Why |
|---|---|---|
| Your email address (Google sign-in: userinfo.email, openid) | Form owner | Know whose form and plan it is, and stop anyone acting on someone else's form. |
| The open form: its ID, title and the “Uploaded files” question (forms.currentonly) | Form owner | Add the question, read which response a set of files belongs to, and use the answer you pick (Pro) as the folder name. Other answers are read inside Google and are not sent to us. |
| Files and folders the add-on creates in your Drive (drive.file) | Form owner | Create the upload folder and a folder per response, and start each upload into it. We cannot see any other file in your Drive. |
| A Drive refresh token for drive.file | Form owner | Lets our server start uploads while you are away. Stored encrypted (AES-256-GCM). |
| File name, size and Drive ID of each uploaded file | Sender's file, your data | Count uploads against your plan, show the latest files in the panel, list them in your email. |
| The content of the files | Sender's file, your data | Never stored or seen by us. The sender's browser sends it directly to Google Drive. |
| The sender's IP address | Sender | Held in memory for up to one hour to stop abuse. Not stored. |
| Sending email (script.send_mail) | Form owner | Email you, and only you, when files arrive. Sent from your own Google account. |
2. How we use it
Only to provide the add-on as described above. We do not sell data, show ads, build profiles or use data to train AI models. Error reports from the add-on contain the add-on name, version, where it failed and a short error text, with email addresses and file IDs removed.
3. Sharing and sub-processors
- Google LLC (Google Drive™, Google Forms™, Google sign-in): the files are stored in your own Drive; the form and responses stay in Google.
- Railway Corporation, EU West (Netherlands): hosts our server and its database (email, encrypted Drive token, form ID and title, file names and sizes).
- Stripe Payments Europe Ltd. (Managed Payments), EU/Ireland: payments for Pro and Business, as reseller.
No other party receives the data.
4. How we protect it
HTTPS everywhere. The Drive token is encrypted at rest. Each upload page carries a signed ticket that expires after 48 hours. Uploads are checked for type and size before they start; program files and Office files with macros are always refused; every address and form has a rate limit. Google Drive scans files for viruses when they are opened or shared. We do not scan file content, because we never receive it.
5. Retention and deletion
- File names, sizes and Drive IDs are kept while the form is connected, so the links in your responses sheet keep working.
- Turn off for this form in the panel deletes the form and all its file records from our server at once. When it was your last form, we also revoke and delete your Drive token.
- Unfinished uploads are removed after 24 hours.
- Your email and trial start date are kept so a reinstall does not start a new trial. Write to us to have them deleted.
- The files themselves are in your Drive: delete them there. You can also remove access at myaccount.google.com/permissions.
6. Google API Services User Data Policy — Limited Use
The add-on's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the features described here, do not transfer it except as described in section 3, do not use it for advertising, and do not let humans read it except with your permission, for security reasons, to comply with law, or when it is aggregated and anonymised.
7. Data processing agreement
Business customers can sign our data processing agreement under GDPR Art. 28. Write to [email protected].
8. Your rights
You can ask for access, correction, deletion or a copy of your data at [email protected]. You can complain to Datatilsynet, the Danish Data Protection Agency (datatilsynet.dk).
Google Forms™ and Google Drive™ are trademarks of Google LLC.