The agreement, in words you can check.

01 Who you are agreeing with

Flora is a product of Serendipiware Ltd, a company registered in England & Wales, company number 17232380, registered office Unit A, 82 James Carter Road, Mildenhall, Suffolk, IP28 7DE, United Kingdom. In these terms we and us mean that company, and you means whoever holds the account.

Everything reaches us at [email protected]. A person reads it. There is no ticket queue and no bot in front of it.

You agree to these terms by creating an account. If you are agreeing on behalf of a company, you are confirming that you are allowed to.

02 What Flora does

Flora receives HTTP form posts at an address we give you, stores what arrives, and shows it to you in a dashboard that only your account can read. When a submission lands we email you one sentence saying so.

That email never contains the contents of the submission. Not the field names, not the values, not a preview. There is no setting that adds them, on any plan, because the absence is the product rather than a limitation of it.

Submissions are kept until you delete them. Nothing expires on a schedule, on any plan.

03 Your account

An account is one email address. There is no password, so signing in means receiving a six digit code at that address. That makes your mailbox the key to your account: anyone who can read it can sign in as you, and there is nothing we can check that would tell the difference. Keeping it secure is yours to do.

Tell us straight away if you think someone else has got in. We can end every active session for you.

You need to be at least 16 to hold an account.

04 Your forms are yours, and so is what they collect

What arrives through your forms belongs to you. We claim no rights over it. We do not read it, analyse it, sell it, or train anything on it, and we hold it only to give it back to you.

The other side of that is that you decide what your forms ask for, and so you carry the responsibility for it. In data protection terms you are the controller of every submission and Flora is your processor. You need your own privacy notice, and a lawful basis for whatever you collect. The data processing agreement sets out what we owe you in that arrangement, and it applies to every account on every plan.

Two kinds of data need more care than a form backend gives them. Payment card numbers should never pass through a form: we are not PCI compliant and storing them here would put you in breach whatever we said. Special category data under Article 9, health information in particular, is not forbidden, but it is on you to have the safeguards that go with it. Write to us before you build that form and we will tell you honestly whether Flora is the right place for it.

05 What you may not use it for

• Anything unlawful, or anything that infringes someone else’s rights.
• Using a form as a relay to send mail to people who did not ask for it.
• Collecting payment card numbers. Flora is not PCI compliant and a card number should never reach a form backend.
• Deliberately working around the limits above, whether by spreading load across forms or accounts or by any other means.
• Probing, scanning or load testing the service without asking us first. Ask and we will usually say yes and tell you when.
• Reselling raw access to the endpoint as if it were your own infrastructure. Building a product on top of it is fine, and encouraged.

This is a short list on purpose. It is not a way of reserving the right to object to anything later.

06 Plans and limits

The month is a calendar month in UTC, and the count resets when it turns. Passing your allowance happens in three stages:

• Up to your monthly allowance, a submission is stored and you get the notification email.
• Past your allowance, the submission is still stored and still readable in your dashboard. Only the email stops, until the month turns.
• At twice your allowance, posts to that form are refused with a 403 and not stored at all. We email you the first time it happens to a form, and at most once a day after that, so a form that has started losing submissions does not look like a form nobody is filling in.

We do not charge overage. There is no bill waiting for you at the end of a busy month, which is the other reason the hard stop exists.

Separately from the monthly allowance, every request has to fit inside these:

These are the numbers in the docs, and the docs are generated from the same limits the endpoint applies. If we raise them, nothing of yours breaks. If we ever need to lower one, section 10 says how much notice you get.

07 Paying

Paid plans are billed monthly in advance, in euro, through Stripe. We never see or hold your card details. The subscription renews each month until you cancel it.

The price on the pricing page is the whole price. We are not VAT registered, so no VAT is added at checkout and none appears on your receipt. €12 means €12. If that changes, you will hear it from us before it changes what you pay, under section 10.

If a payment fails, Stripe retries it over the following days. If it keeps failing, your account returns to the Free plan rather than being locked. Your forms keep receiving, your submissions stay readable, and the Free allowance applies until you fix the card. An expired card is not a reason for anyone’s contact form to go dark.

08 Cancelling, and refunds

Cancel whenever you like, from the billing page in your dashboard. It takes two clicks and needs no conversation with anyone. The plan you paid for runs to the end of the month you paid for, and then the account returns to Free. Nothing is deleted by cancelling.

If you are a consumer in the EU, the EEA or the UK, you have 14 days from subscribing to change your mind, and we will refund you in full. By subscribing you are asking us to start the service straight away, which normally reduces that refund to the part you have not used. We do not apply that reduction. You get all of it back.

Outside those 14 days we do not refund part months by default. We are also not interested in keeping money someone did not mean to spend, so if you forgot to cancel, or the month went badly, or you paid for a plan you never used, write to us and say so. We would rather give it back than argue about it.

09 Availability, honestly

We do not offer an uptime guarantee, and we would rather say so plainly than print a number with no credit note behind it. What we can tell you is how it is built to fail: if the endpoint cannot store a submission it answers 503 and stores nothing, so a retry is always safe and never duplicates.

The endpoint your forms post to is the part of Flora we treat as critical. The dashboard being briefly unavailable is an inconvenience; the endpoint being unavailable loses somebody a message, and that is the failure we design around.

If you need a written service level, that is one of the things the Custom plan is for. Write to us.

Flora is not a backup. It is where submissions land and wait for you. If a submission matters enough that losing it would hurt, export it or forward it somewhere you control, the way you would with any inbox.

10 Changes to the service, and to these terms

Flora will keep changing. Most of that is additions and fixes, and those just arrive.

For anything that takes something away, a limit lowered, a feature removed, a price raised, or a term here changed against your interest, we will email you at least 30 days before it takes effect. If you do not want to continue on the new terms, cancel before that date and we will refund the unused part of anything you have already paid. Carrying on past the date is how you accept them.

Your existing forms and the address they post to are the thing we are most careful with, because that address ends up in markup on sites we do not control. We will not change it.

11 Ending it

You, at any time, from your account page. Closing an account deletes your profile, every form and every submission in them, immediately and with no undo. Export anything you want to keep first. If you are on a plan without export, write to us and we will get you a copy before you close it.

Us, if you break section 5, or if an account goes two years with no sign in and no submission. Except where the content is unlawful or the damage is ongoing, we will email you first, say what the problem is, and give you 14 days to put it right. If we do end an account, we refund the unused part of what you paid.

If we ever shut Flora down, you get 90 days notice, an export of everything, and a refund of whatever you have paid for time you will not get.

12 What we are responsible for

We are responsible for running Flora with reasonable skill and care, for keeping your submissions where we say they are, and for the obligations in the data processing agreement.

Where the law lets us limit what we owe you, our total liability for everything arising in any twelve month period is capped at what you paid us in that period. On the Free plan that is nothing, which is worth knowing before you put something critical behind it.

We are not liable for lost profits, lost business, or the value of a submission that did not reach you, and we are not liable for what your forms collect or what you do with it once you have it.

Nothing here limits our liability for death or personal injury caused by our negligence, for fraud, or for anything else the law does not permit us to limit. If you are a consumer, nothing here affects your statutory rights, and the paragraphs above apply only as far as consumer law allows.

13 Data protection

The data processing agreement forms part of this agreement and applies to every account, free ones included. Article 28 of the GDPR requires a written agreement between a controller and a processor, and that is not something a pricing tier should decide.

What the Business plan buys is a copy signed by us, countersigned, returned to you and filed, plus a written record of where data sits that your own auditors can read. What the Custom plan buys is the chance to negotiate the terms in it. The protections themselves are the same on every plan.

How we handle your own account data, as opposed to your submissions, is in the privacy notice.

14 The law this runs under

This agreement is governed by the law of England and Wales, and its courts have jurisdiction.

If you are a consumer resident in the EU or the EEA, that does not take anything away from you: you keep the protection of the mandatory law of your own country, and you can bring proceedings there. The European Commission’s online dispute resolution platform is open to you, though writing to us first is faster and usually enough.

15 The rest

These terms, the privacy notice and the data processing agreement are the whole agreement between us, and they replace anything said before. If a court finds one part unenforceable, the rest stands.

We may transfer this agreement if the business is sold, and we will tell you before it happens. You may not transfer it without asking us, and we will not unreasonably refuse.

Not enforcing something once does not mean we have given it up. Notices to you go to the address on your account. Notices to us go to [email protected].