Sub-processors

Last Updated: October 20, 2026

The companies that process personal data from your forms for Formbold, what they do, the data involved and where they are based.

Version 1.0 · Effective 20 October 2026

These are the companies that process personal data from your forms on our behalf, so we can run Formbold. The list matches Schedule 3 of our Data Processing Agreement (DPA), which explains how we protect that data.

Current sub-processors

We use the following Sub-processors to provide the Services as of the effective date of the DPA. Changes are notified as described in Section 6 of the DPA.

DigitalOcean, LLC

  • What they do for Formbold: Application hosting, compute and databases
  • Data involved: All Customer Personal Data stored in the Services
  • Location: Data centre region selected for the Services

Cloudflare, Inc.

  • What they do for Formbold: File storage for form uploads (Cloudflare R2)
  • Data involved: Uploaded files and file metadata
  • Location: Storage location configured for the Services

Amazon Web Services, Inc.

  • What they do for Formbold: Email delivery for notifications and autoresponders (Amazon SES)
  • Data involved: Submission content included in emails, recipient and sender addresses
  • Location: AWS region configured for the Services

Zoho Corporation (ZeptoMail)

  • What they do for Formbold: Transactional email delivery for notifications and autoresponders
  • Data involved: Submission content included in emails, recipient and sender addresses
  • Location: Data centre linked to our ZeptoMail account

Google LLC (reCAPTCHA)

  • What they do for Formbold: Bot and spam detection on forms where reCAPTCHA is enabled
  • Data involved: IP address, browser and device details, interaction signals
  • Location: United States and global

Functional Software, Inc. (Sentry)

  • What they do for Formbold: Error monitoring and diagnostics
  • Data involved: Technical data in error reports, which may include IP address and limited request data
  • Location: Region of our Sentry organisation

Microsoft Corporation (Clarity)

  • What they do for Formbold: Product analytics and session replay on the Formbold website and dashboard, used to improve usability
  • Data involved: On-screen interaction data, device details, IP address
  • Location: United States and global

Services that are not Sub-processors

  • Website analytics: We run Umami analytics on our own infrastructure. No submission or analytics data is shared with a third party analytics provider through it.
  • Customer support: Support is handled by email and through Nivon, a support platform built and run in-house by Pimjo.
  • Payments: Paddle.com Market Limited is our merchant of record. Paddle handles billing, tax and fraud prevention as an independent Controller under its own terms and privacy policy, and does not receive form submission data.
  • Integrations and webhooks: When you connect a third party tool or send submissions to a webhook, data goes to your own account or endpoint with that provider. That provider works for you, not for us, and is not our Sub-processor. Your agreement with them governs that data.

Changes to this list

We will give you at least 30 days' notice before adding or replacing a Sub-processor, by email to your account owner and by updating our Sub-processor list.

You may object to a change on reasonable data protection grounds by emailing [email protected] within the notice period. We will work with you in good faith to resolve the objection. If we cannot, you may end the affected Services, and we will refund any prepaid fees for the period after termination.

Contact

Questions about our sub-processors or how we handle your data can go to [email protected].