Data processing agreement
Data processing agreement
Parties and scope
This is Formgong’s standard data processing agreement under Art. 28 GDPR. The processor is Formgong (contact: support@formgong.com). The controller is the customer who holds the Formgong account.
The agreement covers all submissions Formgong receives from the customer’s forms. It is part of the terms and is accepted when the customer creates an account and uses the service; no separate signature is needed.
Subject
The Formgong operator processes submissions on the customer’s behalf: storing fields and sending notifications.
When the customer sends store orders for review emails (through the Formgong WordPress plugin, the orders API, a CSV upload, or the Formgong Shopify app once the customer turns review emails on), Formgong also processes the buyers' order data on the customer's behalf: the order number, email address, first name, language, billing country, marketing consent and ordered products. It uses them only to send the customer's review request, at most one reminder and a review coupon if the customer offers one, and to mark verified reviews. An order is deleted 30 days after its last email was sent, skipped or cancelled; the email log keeps only a masked address for 30 days.
Instructions and confidentiality
Formgong processes submission data only to provide the service as the customer configures it in the dashboard: storing fields, sending notifications and webhooks, and exports. The dashboard settings and these terms are the customer’s documented instructions.
Everyone with access to submission data is bound to confidentiality. Submission data is not sold and not used for advertising.
Sub-processors
Cloudflare (hosting, database, Turnstile captcha). Contabo (hosting of Formgong’s own mail server in the EU, which sends part of the email and delivers it when UniOne is unavailable; also the server for virus scanning of attachments and review photos and videos, only when the customer enables attachments or photo and video reviews). UniOne (email delivery through its EU data centre). Telegram, only when the customer connects a chat.
Google (Google Sheets API), only when the customer connects a spreadsheet: form fields, the time and the page URL are sent to sheets.googleapis.com and stored in the customer’s Google spreadsheet. That spreadsheet follows the customer’s Google account, which Google may store outside the EU. Formgong keeps the Google refresh token encrypted in the EU database and does not use the Google account for anything else. Notion (Notion API), only when the customer connects Notion: form fields, the time and the page URL are sent to api.notion.com and stored in the customer’s Notion database. That database follows the customer’s Notion workspace, which Notion may store outside the EU. Formgong keeps the Notion tokens encrypted in the EU database and does not use the Notion account for anything else.
Cloudflare Workers AI, only when the customer turns on AI review summaries for a review site: the star rating and text of that site's approved reviews, without names, email addresses or dates, are sent to write the summary, which is stored in the EU database. Cloudflare may run the model outside the EU.
Cloudflare Workers AI, also only when the customer turns on automatic (AI) review moderation for a review site: the text of each new review (without the star rating, name, email address or date) and its photos are sent to check them for spam, abuse, other people's personal data and unrelated content. Only the verdict and its reason are stored, in the EU database. Cloudflare may run the model outside the EU.
Cloudflare Workers AI, only on Pro: the text of each review (without the rating, name, email address or date) is sent to tag its mood (praise, neutral or complaint) in the owner’s dashboard and, when the customer turns on translation for a review site, to translate approved reviews into visitors’ languages. The tag and the translations are stored in the EU database. Cloudflare may run the model outside the EU.
Cloudflare Workers AI, only on Pro and only when the owner presses Draft a reply under a review: the star rating and text of that review (without the name, email address or date) are sent to write a draft reply. The draft is not stored or published unless the owner saves it. Cloudflare may run the model outside the EU.
Cloudflare Workers AI, only on forms where the customer turned on file uploads: each audio file of up to 4 MiB (for example a voice-field recording) is sent once to the speech-to-text model @cf/openai/whisper-large-v3-turbo to write a transcript, unless the visitor typed one. The transcript is stored with the submission in the EU database; the recording stays in Cloudflare R2 with EU jurisdiction. Cloudflare may run the model outside the EU.
Email providers the customer connects for review emails (Klaviyo, SendGrid, Mailgun, Postmark or Brevo) are not Formgong sub-processors. The customer chooses them, holds the account and gives Formgong its API key; on the customer's instruction Formgong hands each email to that account (with Klaviyo, an event with the buyer's email address, first name and the email's content), and the provider processes it for the customer under the customer's own agreement with it. Formgong stores the API key encrypted.
Email-marketing services the customer connects under a form's Settings → Email lists (Mailchimp, Klaviyo, Brevo, MailerLite or Kit) are not Formgong sub-processors either. On the customer's instruction, and only for a visitor who passed the consent rule the customer set, Formgong sends that visitor's email address and the name fields the customer mapped to the customer's account; the service processes them for the customer under the customer's own agreement with it. Formgong stores the API key encrypted.
Before adding or replacing a sub-processor, Formgong updates this page. If the customer objects, the customer can stop using the affected feature or delete the account.
Location
The Cloudflare D1 database is created with EU jurisdiction. Review photos and videos are stored in Cloudflare R2, also created with EU jurisdiction. Email goes through UniOne’s EU data centre or through Formgong’s own mail server, hosted by Contabo in the EU. Telegram processes bot messages under Telegram’s terms.
When Google Sheets is connected, the copied rows are stored in the customer’s Google account, which Google may store outside the EU.
Security and assistance
Traffic is encrypted with HTTPS, raw IP addresses are not stored, access keys and webhook secrets can be rotated in the dashboard, and access to production systems is restricted.
Formgong informs the customer without undue delay after becoming aware of a personal data breach affecting the customer’s submissions, helps as far as reasonable with data subject requests and the duties under Art. 32–36 GDPR, and on request provides the information needed to show compliance with Art. 28 GDPR.
Rights
The customer can export CSV and delete the account, including submissions, from the dashboard.
End of processing
When the customer deletes the account, forms and submissions are deleted. Cloudflare’s database recovery history expires on its own schedule (up to 30 days). On the Free plan, submissions are deleted after 30 days anyway.
Addendum for Shopify merchants
This addendum applies when a merchant installs the Formgong Shopify app. It is part of this agreement and is accepted when the merchant installs the app; no separate signature is needed. The merchant is the controller of its customers' data, Formgong is the processor, and Shopify is not a party.
Data processed: shop details and the contact email of the shop; products, variants and inventory levels; submissions from Formgong forms and reviews on the store; and, only after the merchant turns on review emails, the store's fulfilled and cancelled orders as Shopify sends them to the app (orders/fulfilled and orders/cancelled): the order number, the buyer's email address, language, billing country, email marketing consent and the ordered products. Formgong uses these orders only to send the merchant's review request and at most one reminder, and to mark reviews from that email as from a verified buyer. Shopify order lookups and personalisation based on a customer's purchase history are not currently available in the help chat. Formgong does not request customer name, phone or address fields.
Purpose: answering the store's visitors in the help chat (customer service), delivering the store's form submissions and reviews, and sending the store's review emails. Formgong uses the data for no other purpose, does not sell or share it, does not use it for advertising or to train AI models, and makes no automated decisions with legal or similarly significant effects.
Retention: chat transcripts are deleted after 30 days. Submissions follow the merchant's plan retention. An order for review emails is deleted 30 days after its last email was sent, skipped or cancelled. On app uninstall and on Shopify's shop/redact request the shop's data is deleted; customers/redact deletes that customer's chat data, submissions, orders kept for review emails, and reviews tied to their email address or to one of those orders (a review sent without an address can be found only while its order is kept); an address on Formgong's do-not-email list stays there, so it is not emailed again; customers/data_request returns them to the merchant.
Consent and opt-out: the help chat does not use customers' purchase history. Formgong honours customer decisions passed on by the merchant or Shopify, including deletion and opt-out of data sharing.
Sub-processors for the Shopify app: Cloudflare (hosting and EU database), UniOne in the EU (email, with Formgong’s own mail server in the EU as the fallback), and Cloudflare Workers AI (only the chat message and catalogue excerpts needed for the answer). Formgong informs merchants of new sub-processors by updating this page before they are used.
Security measures
Encryption: all data is encrypted in transit with TLS and at rest in Cloudflare D1 and R2 with AES-256-GCM, including database backups. Shopify access tokens are additionally encrypted with an application key.
Backups: the database has point-in-time recovery for 30 days through Cloudflare D1 Time Travel, stored under the same encryption. No other copies of production data are kept.
Separation: automated tests and development use separate databases and a separate Shopify development store with synthetic data only. Production data is never copied into test or development environments.
Access: only the Formgong owner role can reach production data. Staff accounts use unique strong passwords from an encrypted vault and two-factor authentication. Every staff access to personal data is recorded in an access log (who, when, what and why), kept two years and reviewed monthly.
Data loss prevention: data minimisation, no bulk exports of production data, secrets kept out of source code, read-only and logged manual queries, and code review with automated tests before each release.
Incidents: Formgong follows a written incident response policy with severity levels, containment, evidence collection and review. Formgong notifies affected merchants without undue delay and in any case within 48 hours after confirming a personal data breach, and informs Shopify when Shopify data is involved. Report security issues to support@formgong.com.
Product questions (AI answers)
Only when the customer picks a chat bot for product questions on a review site. The shopper's question, the product's catalogue details, excerpts of the bot's pages and facts, and a few of the product's approved reviews (without reviewers' names) go to Cloudflare Workers AI to write an automatic answer that only that shopper sees; the question and the answer are also checked there for harmful content. Cloudflare may run the model outside the EU. The question is stored in the EU database without an email or IP address and is deleted 90 days after it was asked unless the customer publishes it. Each automatic answer counts as one answer of the customer's AI chat plan.
Attachments
When attachments are enabled, PDF, JPEG and PNG files are scanned by private ClamAV on a server operated by Formgong at Contabo and stored in private EU-jurisdiction Cloudflare R2. Only the signed-in form owner can download them. File contents are never sent to an AI provider. Files follow form retention and are deleted with submissions, forms or accounts; storage outages are retried and download access is revoked immediately.
Contact
Questions about privacy, these terms, or your data go to Formgong: support@formgong.com