ConfiForms plugin uses and follows Confluence permissions model.

You can restrict ConfiForms controls (such as fields and edit controls) to certain user groups and users, usually a comma separated list is expected (could be mixed of groups and users)

In ConfiForms:

• each form has an administrator(s) - a user(s) who can do all the operations with stored data 
• form administrator is the one who has EDIT permissions on the page where form is configured or ConfiForms Form macro has explicitly set this person (or a group) as form administrator
• each stored entry has an owner, a user who has created this entry.
• an owner could change entry data (unless edit functionality is disabled, but only in the fields which are not restricted to this user)
• an administrator could change any entry (including "delete"), he has also permissions to export stored data in XML, CSV, JSON and EXCEL formats
• entry owner is a mutable field and could be changed by a form administrator. This means that the original creator of the entry will loose his edit rights to the entry
• stored data is visible to a user if he has access to the page where form is configured (page VIEW permission)

Important:

• When you use "file" fields in ConfiForms to upload files - the files are stored as attachments on the same page where the form is configured. Attachments in Confluence are accessible for all users who have VIEW rights on this page. (please also note that in order for this field type to work you must enable add/delete attachments permission)

Related:

Why do I see an extra button with + sign on my form