This data processing addendum applies when FormThunder handles personal data on your behalf, which mostly means your form submissions. You're the controller, or a processor for your client, and we're your processor. It forms part of our terms, and it's written to cover the points that GDPR Article 28 and similar laws ask for.
What we process
- Data: whatever your forms collect, plus attachments and technical details such as IP address, user agent and referrer.
- People: your website's visitors and anyone else who submits your forms.
- Purpose: storing submissions and delivering them where you've told us to, and showing them to you.
- Duration: for as long as you use the service, within the retention set by your plan.
What we commit to
- We process the data only on your instructions, meaning your configuration and these terms, unless the law requires otherwise.
- People with access are bound to keep it confidential.
- We help you respond to requests from individuals, and most of that you can do yourself through the dashboard and API.
- We tell you without undue delay if we become aware of a breach affecting your data.
- We delete your data when you delete it or close your account, with backups ageing out in the normal cycle.
- We give you the information you reasonably need to show compliance.
Security
- Data in transit uses TLS.
- The service runs on AWS across two availability zones, with Multi-AZ Postgres and automated backups.
- Captcha secrets are encrypted at rest, and API keys are stored so they can't be read back.
- Webhooks are signed with HMAC-SHA256.
- Changes to an account are recorded in an audit log.
Sub-processors
You authorise these sub-processors. We'll tell you about changes by email or in the dashboard, and you can object.
| Sub-processor | Purpose |
|---|---|
| Amazon Web Services | Hosting, database, storage, email |
| Resend | Email failover |
| Stripe | Payments, which concerns your account and not your submissions |
| Anthropic | The optional template generator, which doesn't receive submissions |
Integrations and captcha providers you turn on, such as Slack, Google or Cloudflare, are your choice and are between you and them.
Transfers
Our sub-processors may process data outside your country. Where the law requires a transfer mechanism, we rely on those the sub-processors provide, and we'll work with you if you need something more.
Your own duties
You're responsible for having a lawful basis for what your forms collect, and for your privacy notice.
Contact
Data protection questions go to support@formthunder.com.
Last updated 5 November 2026.