Template — not legal advice. This is a starting point generated for convenience. Replace every [bracketed] placeholder with your details and have it reviewed by a qualified lawyer before you rely on it.
Sub-processors
Last updated: [Effective date]
Our sub-processors
To provide the Service we use the third-party providers below. Each is bound by data-protection terms and only processes data as needed for its function. We update this page before adding a new sub-processor.
| Provider | Purpose | Data processed | Location | When |
|---|---|---|---|---|
| Amazon Web Services (S3) | Object storage for uploaded files | Files respondents upload to forms | US / EU (per workspace data-residency setting) | Always (when file uploads are used) |
| [Hosting / infrastructure provider] | Application and database hosting | All Service data at rest and in transit | [Region] | Always |
| Stripe | Payments and subscription billing | Billing contact + payment details (card data handled by Stripe) | US / Ireland | When you subscribe or collect payments |
| Anthropic | AI form generation, translation, and response analysis | The text you submit to an AI feature | US | Only when you use an AI feature |
| Twilio | SMS notifications and verification codes | Recipient phone number + message content | US | Only when SMS is enabled and Twilio is the active provider |
| Telnyx | SMS notifications and verification codes | Recipient phone number + message content | US | Only when SMS is enabled and Telnyx is the active provider |
| [Email provider — e.g. Resend or your SMTP host] | Transactional and form-notification email delivery | Recipient email + message content | [Region] | When email is sent |
| Cloudflare | Bot protection (Turnstile) | Challenge token + IP (by Cloudflare) | Global | Only when Turnstile is enabled |
| Upstash | Distributed rate-limiting store | Rate-limit keys (pseudonymised) | [Region] | Only if configured |
Changes
To be notified of changes to this list, contact [[email protected]].