🛡️ GDPR
This page is not intended as legal advice. Please consult with your legal advisor to determine how GDPR applies to your business.
No analytics, session-recording or AI tool is loaded on the forms you publish. A form you share with respondents loads only FormNX's own code, and all of your form data is stored inside the European Union.
What is GDPR?
The General Data Protection Regulation (GDPR) is a privacy law of the European Union that gives people in the European Economic Area (EEA) the right to access and control their personal data. It protects anyone who is in the EEA when their data is processed, regardless of their citizenship. The United Kingdom has near-identical rules under the UK GDPR, and everything on this page applies there too.
Does it affect you?
If your business is based in the EEA or the UK, or if you handle the personal data of people located there, GDPR applies to you — including when you collect that data through a FormNX form.
What happens with form data?
FormNX provides a form service but does not own the collected form responses.
The responsibility for the data collected lies with the form creator, who acts as the data controller for respondent data. FormNX acts as a data processor and securely stores information on behalf of form creators. As long as your account is active, you retain full control over the data collected and how long it is stored. You can delete or export form responses from your account at any time.
All deletions are honoured: data you delete is removed from our live systems straight away, and permanently purged from our backups within 30 days.
How do you use my personal data?
FormNX acts as a data controller for the personal information you provide as an account holder, such as your registration and billing details. FormNX does not sell personal data to third parties, and does not use it for advertising. Your information is shared only with the service providers listed below, each of which is required to meet GDPR standards.
Where your data is stored
| What | Provider | Location |
|---|---|---|
| Application and database | DigitalOcean | Frankfurt, Germany (FRA) |
| Files uploaded through your forms | Backblaze B2 | EU Central |
All form data — responses and uploaded files — resides within the European Union.
Our sub-processors
We group these by whether they can ever reach the data your forms collect. Most of them cannot.
A. Handle your form data
These are part of delivering the service and process form data by design.
| Sub-processor | What we use it for | Location | GDPR |
|---|---|---|---|
| DigitalOcean | Application hosting and database | Frankfurt, Germany (FRA) | Compliance |
| Backblaze B2 | Storage for files uploaded through your forms | EU Central | Compliance |
| Zoho ZeptoMail | Transactional email, including the submission notifications we send you | EU | Compliance |
B. Run our business — never see your form data
These support our website, billing and infrastructure. None of them is loaded on a published form.
| Sub-processor | What we use it for | Where it runs | GDPR |
|---|---|---|---|
| Stripe | Billing for your FormNX subscription | Checkout and billing pages | Compliance |
| Cloudflare | DNS resolution — never receives form content | Domain infrastructure | Compliance |
| Google Analytics | Aggregate traffic statistics | Marketing site and dashboard | Compliance |
| Microsoft Clarity | Usage analytics and session replay, with text typed into input fields masked | Marketing site and dashboard | Compliance |
| OpenAI | Generating form fields from a description you type — prompts only, never submissions | AI features in the form builder | Compliance |
| Google (sign-in) | "Sign in with Google", if you choose to use it | Login and signup | Compliance |
| Vbout | Our own marketing email to FormNX account holders | Our mailing list | Privacy |
C. Integrations you connect yourself
These receive your form data only because you chose to connect them. When you do, you are instructing that service directly, and it acts as your processor rather than ours. You are responsible for the terms and privacy notice that apply to it.
| Integration | What it receives | Enabled by |
|---|---|---|
| Google Sheets | Form submissions routed to your own spreadsheet | You |
| Stripe on your forms | Payments collected into your own Stripe account | You |
| Email marketing tools | Contact details you choose to sync | You |
| Webhooks | Whatever payload you configure | You |
Whenever we start using a new sub-processor, it is added to this page.
International transfers
We are based in India, and some of our service providers operate outside the European Economic Area, including in the United States. Where personal data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses, or on an equivalent transfer mechanism offered by the provider, together with appropriate technical and organisational safeguards.
How we protect your data
- Encryption in transit — all traffic to and from FormNX uses TLS.
- Encryption at rest for sensitive fields — you can mark any field in the form builder as sensitive, and the data it captures is encrypted before it is stored. We recommend enabling this for any field that collects sensitive personal data.
- Password hashing — account passwords are stored only as irreversible hashes. We never store plain-text passwords.
- Access control — access to production systems is limited to the personnel who need it to operate and support the service.
- Backups — data is backed up regularly so it can be restored after a failure.
- Breach notification — if we become aware of a personal data breach, we will notify affected controllers and the relevant supervisory authority without undue delay, and within 72 hours where the law requires it.
If you need further detail on our security measures for a vendor assessment, email [email protected].
If a respondent contacts us directly
If someone who filled in one of your forms contacts FormNX asking to access or delete their data, we will forward that request to you as the form creator and help you respond. Because you are the data controller for that information, the decision is yours to make.
How do I make sure my FormNX form is GDPR compliant?
Several considerations need to be taken into account when collecting personal information (e.g., name, email, phone) with your form.
How to create a GDPR compliant form
Last reviewed: 15 August 2026