Privacy Policy

MINOR
FIRST SEEN 2026-08-13 · VERSION 20260813_rev01 · COMPARED WITH 20260201_rev01

What changed, in plain language

Jotform rewrote one paragraph in the Australia section describing what personal information it collects. The old wording said Jotform does not actively collect information from Australian residents and only receives "unsolicited" information through its customers' forms. The new wording is more specific and admits two ways Jotform does collect data directly: when an Australian resident signs up for an account, and when a form owner asks for sensitive information, in which case Jotform may demand extra personal details to verify who they are and prove they have a good reason to collect it. Nothing else in the policy changed.

Changes that may affect you

Jotform may ask you for extra personal details and IDMINOR
DATA COLLECTION

If your form collects sensitive information, Jotform can now ask you for additional personal information to confirm your identity. This is a new type of collection that the old policy did not describe. It is limited to accounts running sensitive forms, and it is a common anti-abuse step, so the impact is small.

“we may ask the user to provide additional personal information to verify their identity and to demonstrate a legitimate need for collecting such information”

What you can do — If you run forms in Australia that collect sensitive data (health, ID numbers, and similar), expect to be asked for ID and a written reason before those forms work normally.

You may have to justify why you collect sensitive dataMINOR
USER OBLIGATIONS

Beyond proving who you are, you may have to show Jotform a "legitimate need" for collecting sensitive information. The policy does not say what counts as legitimate or what happens if Jotform is not satisfied, so a form could be held up while you sort it out.

“to demonstrate a legitimate need for collecting such information”

What you can do — Write down a short, clear reason for each sensitive field on your form so you can respond quickly if Jotform asks.

Changelog

  1. ± CHANGEDClearer wording about what Jotform collects from Australians

    The old text said Jotform does not actively collect personal information from Australians and only picks up "unsolicited" information while running its service. The new text says Jotform does not collect information from people who fill out someone else's form, but it does ask for personal details when an Australian signs up for an account.

    Jotform does not actively collect personal information from Australian residents directly (solicited information). We may collect personal unsolicited information in the course of our service provision to our Australian customers.

    Jotform does not directly collect personal information from Australian residents who complete forms our users post on our website. The user may ask for such information through their forms, and it is the form responder's choice whether to provide that to the user. Of course, when an Australian resident signs up for an account, we will ask for some personal information to identify the person and to help us communicate with them.

  2. + ADDEDNew ID check for form owners who ask for sensitive information

    Jotform now says that if your form asks people for sensitive information, it may require you to hand over extra personal details to prove who you are and to show you have a legitimate reason to collect that information. This was not mentioned before.

    in cases where the user's forms ask for sensitive personal information, we may ask the user to provide additional personal information to verify their identity and to demonstrate a legitimate need for collecting such information

  3. − REMOVEDDropped the note about customers listing data types in their own policy

    The old text explained that the kinds of personal information collected vary by customer and that each customer should list them in its own privacy policy. That sentence is gone. It was guidance, not a promise, so it does not change anyone's rights.

    The types of personal information collected by our customers varies, and they should provide a detailed list in their own privacy policy.

Full text changes — 20260201_rev01 to 20260813_rev01

COLOUR MARKS THE SEVERITY OF A FLAGGED CLAUSE · + AND − MARK ADDED AND REMOVED

158158#### Scope
159159
160160This policy relates to the requirements of the Australian Privacy Principles (APP) contained in the Australian Privacy Act 1988 (the Act). This policy applies to the collection of Australian residents' personal information by customers of Jotform utilising our service provision in the Australian region. In circumstances where it is construed as an APP Entity, Jotform complies with the APP and has implemented suitable controls and measures to ensure that personal information is collected, held and disclosed in a manner that is secure
161161
162162#### Collection of Personal Information
163163
164Jotform does not actively collect personal information from Australian residents directly (solicited information). We may collect personal unsolicited information in the course of our service provision to our Australian customers. Our Australian customers use the Jotform platform and software as a service provision within their business operations to improve business practices. This may include the use of our forms and tables, and other services we offer, in the process of collecting personal information of end users. The types of personal information collected by our customers varies, and they should provide a detailed list in their own privacy policy.
164Jotform does not directly collect personal information from Australian residents who complete forms our users post on our website. The user may ask for such information through their forms, and it is the form responder's choice whether to provide that to the user. Of course, when an Australian resident signs up for an account, we will ask for some personal information to identify the person and to help us communicate with them. Also, in cases where the user's forms ask for sensitive personal information, we may ask the user to provide additional personal information to verify their identity and to demonstrate a legitimate need for collecting such information.
165165
166166#### Disclosure (Data Sharing)
167167
168168Information that is collected by our customers may be disclosed to and stored on our servers (and backups) which are provided by Google Cloud Platform (GCP) and by Amazon Web Services (AWS). This may include overseas disclosures and Australian resident personal information may be transferred to cloud providers based in the United States of America. We work closely with our service providers to ensure a high standard of security is maintained to ensure that personal information is protected from unauthorized access. Our cloud service providers also have certifications including ISO27001 and SOC 2 which evidence high standards of information security management.
169169
170170#### Individual Rights