Data processing agreement

This is a starter text for launch. Have your counsel review it and add the legal entity before you publish.

Template

This is a short DPA template, not a signed contract. Counsel should name the parties and add schedules before launch.

Subject

The Formgong operator processes submissions on the customer’s behalf: storing fields and sending notifications.

Location

The Cloudflare D1 database is created with EU jurisdiction. Email goes through ZeptoMail (Zoho, EU data centre). Telegram processes bot messages under Telegram’s terms. When AI lead scoring is on, all form fields, including email and phone, are sent to Vercel AI Gateway (the model provider is Liquid AI by default), and this processing may happen outside the EU.

Rights

The customer can export CSV and delete the account, including submissions, from the dashboard.

Attachments

When attachments are enabled, PDF, JPEG and PNG files are scanned by private ClamAV on a server operated by Formgong at Contabo and stored in private EU-jurisdiction Cloudflare R2. Only the signed-in form owner can download them. File bytes are not sent to the AI scoring provider. Files follow form retention and are deleted with submissions, forms or accounts; storage outages are retried and download access is revoked immediately.

Email: support@formgong.com