Skip to content
LEGAL

Data processing agreement

How Formkit handles the personal data in your forms' responses on your behalf: what we process, who helps us, how we keep it safe and when it is deleted.

Last updated 17 October 2026

Who this is between

This agreement is between you, the Formkit customer who builds forms and collects responses (the controller), and Formkit (the processor). It forms part of the terms of service and applies whenever Formkit processes personal data in the responses your forms collect.

It is included with the Business plan. Customers on any plan may rely on it; if your organisation needs a countersigned copy, ask from Settings → Controls or at formkit.app/contact.

What we process, and why

Subject matter: the answers, files and contact details people give in your forms, and the account details of you and your team.
Purpose: to host your forms, collect and store responses, send the emails you switch on, and give you the exports and connections you set up.
Duration: for as long as you use Formkit, then as set out under deletion below.
People concerned: the people who answer your forms, and your team members.

We act only on your instructions

We process the data only to provide Formkit as you configure it. Your forms, settings, connections and exports are your instructions. We do not sell it, use it to advertise, or use your responses to train AI models. If we ever believe an instruction breaks data-protection law, we will tell you.

Confidentiality and staff access

Everyone at Formkit who can reach customer data is bound to confidentiality. Staff reach an account only to answer a ticket, look into a report or investigate abuse; that access is read-only in the product and is logged.

Security measures

Data is encrypted in transit (TLS) and at rest by our hosting providers.
Passwords are never stored in readable form; API keys are kept only as hashes.
Access to production systems is limited to the people who run Formkit.
Business accounts get an audit log of who did what, automatic deletion after a period you choose, and sign-in with your company’s Google Workspace.

Subprocessors

We use these companies to run Formkit. Each is bound to protect the data at least as well as this agreement requires:

Convex: database, file storage and back-end hosting.
Vercel: hosting for the website and the forms.
Resend: delivery of the emails Formkit sends.
Cloudflare (Turnstile): the spam check on forms with spam protection on. It sees the respondent's browser and connection, never their answers.
Sentry: reports of errors anywhere on Formkit, published forms included, with links stripped of tokens and without answers or account details.
Polar: billing for Formkit plans (your account details only, never your responses).
Google (Gemini): the AI features. It receives your prompts and the form when you use Ask Formkit; responses without names, emails or phone numbers when you ask it to read them; each response to a form with AI replies, AI logic or AI insights turned on; voice recordings on questions set to be written out; and, for forms with search by meaning on, each response's answers without contact details. It may not use the data to train its models.

Changes to subprocessors

We will list any new subprocessor on this page and tell Business accounts in the app at least 30 days before it starts. If you object on reasonable data-protection grounds, you may end your plan and we will refund the unused part of it.

Services you connect yourself

Webhooks, Slack, Discord, Microsoft Teams, Google Sheets, Notion, Airtable, HubSpot, Stripe payments, the API and the AI assistants you connect send data where you tell them to. Those services are yours to choose, and your agreement with them, not this one, covers what they do with it.

Push notifications reach a device through its browser’s push service (run by Apple, Google, Microsoft or Mozilla), encrypted on the way so that service cannot read them.

Helping you with requests and incidents

Requests from the people who answered your forms to see, correct or delete their answers can be handled by you in the app. If one comes to us, we pass it to you.
If we learn of a breach affecting your data, we will tell you without undue delay, and within 72 hours, with what we know and what we are doing.
We will give you the information you reasonably need for a data-protection impact assessment or to answer a regulator.

International transfers

Data is stored in the United States and the European Union. Where data leaves the EEA, the UK or Switzerland, transfers rely on the standard contractual clauses our providers have signed.

Deletion at the end

You can export and delete your data at any time. When you close your account, everything (forms, responses, uploads) is removed within 30 days, and backups age out within 90.

Audits

We will answer reasonable written questions about how we protect your data, once a year or after an incident. On-site audits are by agreement, at your cost.

Where this agreement and the terms of service disagree about personal data, this agreement wins. Questions go to hello@formkit.app.