Is Google Forms safe enough for customer data?

For names, phone numbers and addresses, it works. What needs more care than the tool itself is who can reach the data: whose account the response sheet sits in, who it has been shared with, and whether people who have left can still open it. Sensitive data such as passwords, card numbers or ID card photos shouldn't be collected through Google Forms at all.

Can I use my logo or my own domain on Google Forms?

You can add your logo. Google Forms lets you change the theme colour and background colour and add your own header image. But the link still starts with docs.google.com or forms.gle, and the layout, buttons and footer notice still belong to Google. If you want customers to see your shop's name right in the link, the most direct route is a form on your own website.

How do I get notified every time someone fills in my Google Form?

Open the form, go to the Responses tab, click the three-dot menu and choose "Get email notifications for new responses". The email goes to whoever switched it on, so if several people need to know at once, have it switched on from the shop's shared email account. The old trick of sending responses into a LINE group through LINE Notify no longer works, because that service ended on 31 March 2025.

A staff member who built our form has left. Who owns the responses?

In Google's system, the form and sheet belong to the account that created them. If that was the staff member's personal Gmail, they have to transfer ownership, and the new owner has to accept. Worth knowing: Google doesn't allow transfers from a personal account to a work or school account, so if your shop uses Google Workspace you may need them to download the old responses and then rebuild the form in the company account. The best fix is to create forms from a company account from day one.

When should I move from Google Forms to a form on my website?

I look at what the form is doing. If it has become the main door new customers use to order or book, if customers attach slips or documents, if you run ads on several channels and want to know which one works, or if several staff handle the responses, that is when moving pays off. Internal work and one-off surveys can happily stay on Google Forms.

If I move to a website form, can the answers still go into my existing Google Sheet?

Yes. A website form can be set up to keep writing responses into Google Sheets and email the team at the same time, so the team keeps working with the same table as before. My suggestion is to make sure that sheet lives in a company account and to add a column for the customer's source, so you can see which channel each order came from.

Google Forms vs a Website Form: When to Switch

Picture a small shop that has just opened. The owner hasn't had order slips printed yet, so they pick up a free order pad from the stationery shop down the road and start using that. Every page has the stationery shop's name printed large across the top, and the owner writes their own shop name in pen in the bottom corner. The pad works well. It is quick, it costs nothing, and customers understand exactly what to write.

A year later, the shop is serving customers it has never met before. Three staff take turns writing orders. Then one day the person who kept the main pad resigns, and the pad goes home in their bag.

For a lot of Thai businesses today, that order pad is called Google Forms. It takes orders, bookings, job applications and event registrations. The link goes out on LINE or sits under a Facebook post, and the answers flow into a spreadsheet. In this article I want to look honestly at what this free pad does well, when it starts carrying costs you can't see, and what the minimum version of a form on your own website actually looks like.

Check your own form in five minutes

Before you read on, open the form you use for orders right now. You don't need anything else, just your phone.

First, look at the link you send customers. If it starts with docs.google.com/forms or forms.gle, that is Google's address, and your shop's name is nowhere in it. Second, open Google Drive and look at the owner column for the form and its response sheet. Is it a company account, or someone's personal Gmail? Third, think about the last order that came in. Who on the team saw it first, and how long after the customer pressed submit? Last, scroll through the ten most recent responses and ask yourself whether you can tell which post, which ad, or which referral each one came from.

If you can answer all four comfortably, your form is in good hands. If any of them made you pause, the rest of this article should help.

Google Forms does a lot of things well, and I want to say that first

Google Forms is a genuinely good tool. I'm not arguing that at all. You can build a form in ten minutes, it costs nothing, and the answers land in Google Sheets as a table straight away. Most customers have filled one in before, so it feels familiar. For a shop that has only just started selling, or an event that happens once, Google Forms often gets the job done better than investing in something bigger than you need.

It is also a great fit for internal work. Staff leave requests, post-training feedback surveys, a quick poll on who is coming to the New Year party. For all of those, I would tell you to keep using Google Forms.

So the question I want you to think about is a different one. Once this form becomes the main door that new customers use to send you money and personal details, the free tool that used to fit perfectly starts to carry some costs that were invisible on day one.

Where a free form starts to cost you

A docs.google.com link and the trust of a customer who just met you

A regular customer who has chatted with you on LINE for a year will tap a Google Forms link and fill it in without a second thought, because they already trust you. The person who has to think harder is the customer who saw your ad for the first time today.

Google is well aware of this. Google Forms carries the notice "Never submit passwords through Google Forms." at the bottom, and the Google Docs Editors abuse program policies, which cover Forms, state plainly that the product must not be used for phishing, including soliciting sensitive data such as passwords and financial details (I checked both on 29 September 2026). A warning like that tells you Google itself is watching for people who use forms that look exactly like yours to trick others out of their information.

The result is that customers who have been warned about fake links again and again, by the news or by their bank, may hesitate when they see a form asking for their name, phone number, address and a transfer slip on a page whose link carries no shop name. I don't have a figure for how many hesitate, and I'd rather not guess one. But if a customer has ever messaged you to ask "is this link really yours?", that is the same signal.

Your brand only fits in the header

Google Forms lets you change the theme colour, choose a background colour and add a header image. Most shops put their logo there, and it does help. But the page layout, the buttons, the fonts, the footer notice and the link all still belong to Google. After the customer presses submit, the thank-you page is a plain screen that can't take them much further.

A form on your own website is different because the thank-you page is yours. It can tell the customer how many hours until your team calls back, suggest products people often buy together, or offer a button to add your shop on LINE.

You can't tell which post sent this customer

This is the part owners tend to regret most. You might run two Facebook ad campaigns, post on TikTok and share the link in your old customers' group, with every channel pointing at the same Google Forms link. When an order comes in, the sheet can only tell you that someone filled it in. It can't tell you where they came from.

A form on your own website can keep the source alongside each answer, both from the parameters carried in the link from each post (known as UTM tags, which we explain in our guide to UTM parameters for small business) and from the measurement tools installed on your site. At the end of the month you can see which ad brought people who actually filled in the form and which one only brought likes.

Whose account holds the form and the sheet?

In many shops, the admin who handles orders is the one who builds the form, and they build it from the personal Gmail that is already logged in on their phone. Everything works fine, right up until the day they resign.

According to Google's help page on making someone else the owner of a file, you can only transfer ownership to someone the file is already shared with. For personal accounts, the new owner has to accept the request first, and until they do, the original owner stays the owner. The part many people don't know is that Google says you can't transfer a file from a personal Google account to someone with a work or school account. So if your company runs on Google Workspace and the form was built in a staff member's personal Gmail, the simplest route on their last day is often to build a new form and move the old data across by hand.

I don't think any staff member does this on purpose. They simply got the job done with the account closest to hand. But if the hundreds of customer records in that sheet are a business asset, they belong in an account the business holds from day one.

File uploads that make customers sign in

Shops that ask customers to attach a transfer slip, a photo of a custom order, or a CV for a job application will run into this one. Google's help page on question types says that to answer a file upload question, responders need to sign in to a Google Account, and that uploaded files are stored in a new folder in the form owner's Google Drive.

Those two sentences matter more than they seem. A customer using a family member's phone, or who isn't signed in to Google in their browser, hits a sign-in page halfway through, and some of them simply close it. Meanwhile every slip and document piles up in the Drive of whoever created the form, which takes you straight back to the ownership question above. Limiting responses to one per person works the same way: Google's help says responders must sign in to their Google Account for that limit to apply.

An order came in. When does the team find out?

Google Forms can email you when a new response arrives. It's in the Responses tab, under the three-dot menu, as "Get email notifications for new responses". But that email goes to the person who switched it on. In shops where the team mostly talks on LINE, it is common for an order to arrive in the morning and for someone to notice it in the afternoon.

One more thing worth knowing. Many people used to send form responses into a team LINE group through LINE Notify. That service ended on 31 March 2025, and LINE recommends moving to the Messaging API instead. If you find an older tutorial on connecting Google Forms to LINE, check whether it relies on LINE Notify before you follow it.

The PDPA notice that often gets forgotten

A form that collects a customer's name, phone number and address is collecting personal data, whether it is built in Google Forms or on your website. Google Forms doesn't require you to add a privacy notice, so many shops never do. A form on your own website makes it natural to link to a privacy policy on the same domain. For what that notice should say and how to ask for consent, I've written it up in our article on PDPA and your business website's contact form.

"Our customers are used to Google Forms. Why change?"

I hear this a lot, and it's a fair question. Customers really are used to it, the form really does work, and past sales really did come through it.

What I'd ask you to consider is that the familiarity belongs to existing customers who already trust you. They will fill in any form you send, because they trust you before they see the link. They will find a form on your website just as easy. And the same form also helps new customers who don't know you yet: they see your shop's name in the link, your product pages and your contact details before they decide to hand over their information.

You also don't need to give up Google Forms altogether. Internal work, surveys and one-off events can stay exactly where they are. The only forms I'd suggest moving are the ones acting as the door for payments and new customers.

Why starting early compounds

You can't collect customer source data retroactively. An order that arrives this month through a form with no channel data will stay an order from nowhere forever. Start collecting today, and in six months you'll have enough to compare which season, and which kind of post, brought the most customers who actually bought.

Ownership works the same way. A sheet touched by two people is easier to move than one touched by ten. A link sent to customers a few hundred times is easier to replace than one buried in hundreds of old posts.

The longer you wait, the more there is to move.

The minimum version of a form on your own website

A website form doesn't have to be big. The minimum I think is worth having is short, and every item on it is our team's recommendation from experience, not a requirement from Google or any other platform.

First, the form lives on your own domain, for example at /order or /booking, so customers see your shop's name in the link. Second, it asks only what you actually use: if your Google Form had eight fields, start with the same eight. Third, every response goes to a shared company email address and is saved to a sheet or database owned by the company account, not by any one person. If the team wants alerts in LINE, those can go through your shop's LINE Official Account. Fourth, the form saves the customer's source with every response. Fifth, it has a privacy notice and a thank-you page that clearly explains what happens next. If you need file uploads, design them so customers can attach files without signing in to any account.

A form like this is one of the building blocks every business website should have anyway. For the bigger picture of what else a site needs, have a look at 10 essential website components every business needs. If you'd like to see which of our website packages include an order form like this, the details are on the TumWebSME website packages page.

And if your orders have grown to the point where a single sheet can't keep up, and you're tracking who has paid and who has been shipped, you've moved past the form stage into back-office systems. I've described the warning signs in has your business outgrown Excel and LINE?

Real examples you can look at yourself

The closest example is your own form. Scroll to the bottom of the Google Form you use now and you'll see "Never submit passwords through Google Forms." (in Thai, "ห้ามส่งรหัสผ่านใน Google ฟอร์ม"). Google puts that line there. Look at it through the eyes of a customer who saw your ad for the first time today, and ask yourself how they feel about it just as they're about to attach a transfer slip.

The second example is the contact page of a larger business you buy from regularly, whether it's a furniture store, a hotel or a clinic. Check which domain their booking form sits on and where it takes you after you press submit, then compare that with what your own customers experience on your form. The difference you feel as a customer is the same difference your new customers feel.

The third example is the tools themselves changing. LINE Notify, once a popular way to push form responses into a LINE group, has been shut down. Shops that built their daily routine on a single free service had to find a new route when its owner decided to change it. Shops whose forms live on their own website can choose for themselves which channel their alerts go through next.

A real story from our own team

Here's one from TumWebSME itself. When we rebuilt our own website in 2026, we found that our old GA4 property was one nobody on the current team could access. In the end we created our own property under the company's own Analytics account and started counting from zero. The data sitting in that old property never came back to us.

That is the same story as a Google Forms response sheet sitting in a former employee's Gmail. Only the tool's name is different.

Another one: our sales team asks every customer who calls or messages us on LINE "where did you find us, and what did you search for?" and writes it down every time, because LINE chats are a channel our measurement tools can't see. We do this because we know that once a customer's source is lost, it's lost for good. A website form that records the source automatically means the team doesn't have to rely on someone's memory alone.

If you want to see why credibility is the bigger picture behind all this, our piece on how SME websites build credibility and growth covers it.

A five-step plan to move your order form onto your website

List every form you run. Separate the ones that take payments or new customers from the ones used internally, and move only the first group.
Bring ownership of the existing form and sheet into a company account first. If a direct transfer isn't possible, download the old responses and keep them as a file.
Build the website form with the same fields, adding only source tracking, a privacy notice and a thank-you page.
Send responses to a shared company email and a company-owned sheet, and alert the team through the channel they actually check.
Update the links in your LINE OA, Facebook and Instagram profiles to point at the website form. Leave the old form open for a while with a note pointing to the new one.

How to tell whether the move paid off

Start by testing it yourself on the live site. Fill in the form from a phone that isn't signed in to anything, then check that the email arrives, the sheet gets a new row, and the team really receives the alert. I stress this because it happened to us. After TumWebSME's new website launched, the code that measured contacts from our ads went live with the site, but it sat in the wrong place and wasn't actually running on the live site for about a week. During that time people were clicking the ads, yet contacts read zero. The lesson: always check on the site your customers actually use.

After that, watch three simple numbers at the end of every month: the number of responses compared with the month before you moved, the share of responses with a known source, and the time from a customer pressing submit to the team's first reply. If the last two improve and the first doesn't drop, the move is starting to pay for itself.

Back to that order pad

The free pad from the stationery shop never did anything wrong. It let the shop open on day one and recorded hundreds, even thousands, of orders. While the shop is small and the customers are friends, that pad still fits.

But once new customers start walking in more often, and several staff share the writing, having order slips printed with your own shop's name and kept in your own drawer becomes worth doing. A form on your website is that order book. If you'd like to tell us how your shop takes orders now, how many fields your form has and where the answers go, get in touch with our team. We'll help you work out what the right minimum looks like for your shop.

Follow TumWebSME

Facebook: TumWebSME Business Website Development
Instagram: @tumwebsme
TikTok: @tumwebsme
YouTube: TumWebSME

Contact Us and Inquire About Services

088-983-9386 (Ploy)
099-856-3198 (Saennan)