Global Privacy Policy & Data Protection
Effective Date: August 15, 2026. Compliant with EU GDPR (Regulation 2016/679), UK GDPR, and California CCPA/CPRA.
Privacy-First Commitment
Formtruck acts as a Data Controller for our registered customer accounts, and as a Data Processor for the form submission payloads processed on behalf of our developers. We do not sell your personal information, train public AI models on your private form submissions, or monetize your end-users' data.
1. Information We Collect
We collect information in two distinct capacities:
A. Customer & Account Data (Controller)
When you register for Formtruck, we collect your name, email address, password hash (salted bcrypt), workspace metadata, billing records (via tokenized payment processors), and IP addresses used for authentication and security audit logs.
B. Form Submitter Data (Processor)
When an end-user submits data to a Formtruck endpoint created by a developer, we receive and store the form payload fields (e.g. contact details, survey replies, file attachments, submitter IP, user agent, and timestamp) solely to route and deliver that data to the developer's workspace and webhooks.
2. Legal Basis for Processing Under GDPR
We process personal data under the following lawful bases set forth in Article 6 of the General Data Protection Regulation (GDPR):
- Performance of a Contract (Art. 6(1)(b)): To operate your endpoints, dispatch webhooks, deliver transactional notifications, and process subscription billing.
- Legitimate Interests (Art. 6(1)(f)): To prevent fraudulent signups, enforce rate limiting, detect automated bot spam, and protect our infrastructure from DDoS and credential abuse.
- Compliance with Legal Obligations (Art. 6(1)(c)): To maintain required tax and accounting transaction records and comply with lawful statutory requests.
- Consent (Art. 6(1)(a)): For optional marketing updates or non-essential cookies where explicit consent was provided.
3. Authorised Sub-processors Directory
To deliver our globally available infrastructure, Formtruck engages trusted third-party sub-processors. All sub-processors are vetted under strict Data Processing Addenda (DPAs) incorporating standard contractual clauses:
| Sub-processor | Role / Service | Data Location |
|---|---|---|
| Cloudflare Inc. | Edge CDN, DDoS Defense, DNS, SSL | Global Edge (US/EU) |
| MongoDB Atlas | Primary Encrypted Database Cluster | EU / US Cloud Regions |
| Redis Cloud | In-Memory Cache & Rate Limiting | EU / US Cloud Regions |
| Cloudinary Inc. | Form Attachment Storage & CDN | United States / Global |
| Flutterwave Inc. | Payment Gateway & Billing Processing | Global / Nigeria / US |
| Plunk / Postmark | Transactional Email Dispatch | EU / US |
4. Data Subject Rights Under GDPR & CCPA
Depending on your location, you hold statutory rights regarding your personal information:
- Right of Access (Art. 15): You have the right to request a complete machine-readable copy of the personal data we hold about you.
- Right to Rectification (Art. 16): You may update or correct inaccurate profile or workspace information anytime in your dashboard.
- Right to Erasure / “Right to be Forgotten” (Art. 17): You may request the permanent deletion of your account and associated form submissions via our GDPR Compliance Center.
- Right to Data Portability (Art. 20): You may export all workspace submissions and account records in structured CSV or JSON formats.
- Right to Object & Restrict Processing (Art. 18 & 21): You may restrict certain processing activities or withdraw consent at any time.
5. Data Retention & Automatic Purge
We retain customer account records for as long as your account remains active. Form submissions are retained based on your workspace plan configuration or until manually deleted or purged by the account owner. Upon account deletion, all database records, submission archives, and file attachments are permanently deleted within thirty (30) days across all backups.
6. Data Protection Officer (DPO) & Inquiries
To exercise your data privacy rights, submit a Data Subject Request (DSR), or contact our appointed Data Protection Officer: