Data Processing Addendum

Last updated: 28 July 2026

This DPA applies where you use FormDock to process personal data of third parties (your form submitters) and forms part of the Terms of Service.

Roles

You (or your client) are the data controller of submission data. FormDock is the data processor. We process submission data only to provide the service: storage, spam filtering, notification delivery, webhooks, and export.

Subprocessors

Neon (Postgres hosting), Vercel (application hosting), Postmark (transactional email), Stripe (billing), Cloudflare (Turnstile spam verification), Sentry (error monitoring — payloads excluded). We'll give 30 days' notice before adding subprocessors.

Security measures

Encryption in transit (TLS) and at rest; access limited to operational need; no payload contents in application logs; per-form rate limiting and abuse controls.

Data subject requests

The dashboard provides search, export, and deletion of individual submissions so you can service access and erasure requests directly. We'll assist with requests we receive by forwarding them to you.

Breach notification

We'll notify you without undue delay, and in any case within 72 hours, of becoming aware of a personal data breach affecting your submission data.

Deletion on termination

On account deletion, all submission data is deleted within 30 days.