GDPR

Updated 3 days ago

Last reviewed: 27 October 2026

The General Data Protection Regulation (GDPR) governs the processing of personal data in the European Economic Area (EEA) and in certain situations outside it. It gives people rights over their personal data and sets obligations for organizations that collect or process it.

Youform provides controls for managing, exporting, and deleting form responses, a Privacy Policy, and a Data Processing Agreement (DPA). We use HTTPS and encryption at rest for our database and cloud storage.

The form creator is normally the controller of respondent data, and Youform acts as a processor for that data. Form creators are responsible for their collection purpose, lawful basis, privacy notice, consent where required, and the services they choose to connect.

Where is data stored and processed?

Our primary application and database hosting is in Ireland (EU). Uploaded files and database backups use Cloudflare R2; the current R2 bucket is in Asia-Pacific (APAC). Cloudflare's network and other service providers may also process data outside the EEA.

Youform does not provide an EU-only storage or processing guarantee. Review the provider information below before using Youform for a project with a specific data-residency requirement. International transfers are addressed in our DPA and the applicable provider terms; hosting location alone does not establish GDPR compliance.

Do you have a Data Processing Agreement?

Yes. Professional users accept our DPA as part of the terms for using Youform on behalf of their company. No separate signature is required.

What happens to form responses and deleted data?

Youform does not own the responses collected through your forms. You can manage, export, and delete responses from your account.

Deleting a form or response removes it from normal account views. This is separate from permanently erasing retained records and backup copies. Database backup files are configured to expire after 30 days, but that rotation alone does not guarantee that every copy of a record disappears within 30 days of deleting it in your account.

For permanent deletion requests, account deletion, or questions about the retention that applies to your data, contact [email protected]. Some records may need to be retained to meet legal obligations, resolve disputes, or maintain security, as described in our Privacy Policy and DPA.

What does Youform use respondents' IP addresses for?

Youform touches respondents' IP addresses in a few specific places, each with a different purpose:

Duplicate prevention. When you enable Prevent Duplicate Submissions in Settings → Access Settings and choose an IP-based detection method, the respondent's IP address is used to identify repeat submissions. See How can I prevent duplicate submissions in my form?
Network operations. Cloudflare performs country detection as part of network security and CDN operations.
Usage Data. Our Privacy Policy lists IP addresses among the Usage Data that browsers may send when using the service.

How does Youform use account information?

Youform acts as a controller for account and business information, such as registration details, billing information, and support messages. We use it to operate and secure the service, provide support, understand usage, and send account notices and product updates. We do not sell personal data.

You can unsubscribe from optional marketing and product-update emails using the unsubscribe link in the email. Essential account, verification, billing, and service messages may still be sent.

How do AI features process data?

Built-in AI features can send relevant prompts, conversations, form or Page content, and images supplied for design assistance to AI providers. OpenAI is used for these features, with Anthropic (Claude) and xAI/Grok available as automatic fallback providers. The content shared depends on the task.

Automated spam and phishing checks can also send form or Page content to TypeSafe AI (Jev) and an AI provider. Form checks include the creator's email address, organization name, form content, and the template of any automatic email sent to respondents. These checks do not require you to connect an external AI assistant.

If you connect an external assistant such as ChatGPT or Claude through MCP, it can request the forms, settings, or submission data allowed by the permissions you grant. Its own terms also apply. You can revoke the connection in Account → AI Assistants.

Account analytics and session recordings

For selected signed-in account sessions, Youform uses PostHog to understand product usage and investigate issues. These sessions are associated with the user's ID, name, and email. Recordings may contain visible account content and non-password text entered into the interface. Password inputs are masked, and embedded iframes are excluded from recordings.

Youform service providers and subprocessors

The tables describe services Youform uses to operate the product and its business. A provider's role depends on the activity: processing respondent data on behalf of a form creator is different from processing Youform account, billing, support, or marketing information.

Location information describes the relevant service region or the provider's published processing arrangements. A company address is not a guarantee that all processing stays in that country. Networks, support operations, and downstream providers may involve other locations. Contact us if you need details for a specific provider or region.

Product infrastructure, communications, AI, and monitoring

Provider	Purpose and data involved	Location information	Details
Amazon Web Services (AWS)	Application hosting and database storage.	Ireland (EU) for primary application/database hosting.	Provider information
Cloudflare	Network security, CDN, country detection, uploaded files, and database backups in R2.	R2 storage: Asia-Pacific (APAC). Network processing: global.	Provider information
Approximated	Custom-domain routing and SSL; domain settings and requests routed through the proxy.	Selected proxy regions; control-plane processing in Canada and the US.	Provider information
Mailgun	Transactional emails, including account emails and form notifications; recipient addresses and email content.	US service endpoint.	Provider information
OpenAI	Built-in AI form and Page creation/editing, design assistance, help answers, translation, and abuse checks; relevant prompts and content.	US and other processing locations under the provider's service terms.	Provider information
Anthropic (Claude)	AI processing, including automatic fallback when another provider is unavailable; relevant prompts and content.	US and other processing locations under the provider's service terms.	Provider information
xAI / Grok	AI processing, including automatic fallback; relevant prompts and content.	US and other processing locations under the provider's service terms.	Provider information
TypeSafe AI (Jev)	Spam and phishing detection; form/Page content and, for form checks, creator email, organization name, and respondent-email template content.	International processing under the provider's data-processing terms.	Provider information
Sentry	Error reports and diagnostic information, which may include request and account context.	US.	Provider information
Laravel Nightwatch	Application performance monitoring, errors, logs, and diagnostic metadata.	Region is selected per application; contact us for the current account-specific region.	Provider information
Papertrail	Application log management; logs may include account identifiers, URLs, and diagnostic context.	US.	Provider information
Laravel Forge and Envoyer	Server administration and code deployment; infrastructure and deployment metadata.	US.	Provider information
Oh Dear	Uptime and application-health monitoring.	Primary hosting in Belgium (EU).	Provider information
PostHog	Identified account analytics and session recordings for selected signed-in sessions; user ID, name, email, and recorded interface activity.	EU project.	Provider information

Account, billing, support, feedback, and marketing services

Provider	Purpose and data involved	Location information	Details
Stripe	Subscription billing and payments; billing/contact information and payment-related records.	US and other processing locations under Stripe's terms.	Provider information
MailCheap (mailcheap.ai; JustShipIt Pte. Ltd.)	Product-update email delivery and contact management. The current sync targets eligible paid account owners and shares email, first name, account signup date, and Youform user ID. Email delivery, engagement, and suppression events may also be processed.	Singapore company; processing may take place in the US and other countries.	Provider information
Fernand	Support inbox; contact details, messages, and attachments provided in support conversations.	Primary hosting in France (EU).	Provider information
Ferndesk	Help-center hosting and documentation search; help questions, customer content, and help-center usage data.	Primarily US; some providers process internationally.	Provider information
UserJot	Feedback, roadmap, and changelog widget; signed-in user ID, email, first name, last name, and feedback submitted.	Primarily US.	Provider information
Slack (Youform's internal workspace)	Operational, billing, and abuse notifications, which may contain account email addresses, form titles, and form URLs.	US and other locations under Slack's terms.	Provider information
Simple Analytics	Visit statistics on the Youform marketing website.	Netherlands (EU).	Provider information

Optional features, media, and integrations

Additional services receive data when the relevant feature is used:

Google reCAPTCHA: bot protection on forms where the owner enables CAPTCHA. Google processes browser and verification information. See Google's Privacy Policy.
Twilio: SMS verification through an SMS-provider account connected by the organization; recipient phone numbers and verification messages are sent through that account.
Pexels, Unsplash, and Noun Project: stock-photo, video, and icon search. Search terms are sent to the relevant provider; loading remote previews or media may also share the browser's IP address and request information.
External fonts and assets: some product, public-page, and help-center screens load assets from Google Fonts, Bunny Fonts, jsDelivr, Cloudflare-hosted libraries, or rsms.me. Those hosts receive connection information such as IP address when the browser requests an asset.

Form and Page owners may also connect Google Sheets, Gmail, Notion, Slack, Zapier, webhooks, scheduling services (including Calendly, Cal.com, Cal.id, SavvyCal, and TidyCal), their own PostHog or analytics accounts, Google Analytics/Tag Manager, Meta Pixel, maps, and other embedded content. These services may receive form responses, contact details, event data, or browser information according to the integration and its settings.

Customer-connected services have their own terms and privacy notices. Form and Page owners are responsible for explaining these uses to respondents and obtaining consent where required.

Changes to this list

We review this list as the services we use change. Subprocessor-change notifications are governed by our DPA. Contact us with questions about a provider, its role, or an international transfer.

Contacting us about data privacy

Privacy contact: Abhishek Chakravarty
Email: [email protected]

We aim to acknowledge privacy inquiries within 3–4 business days. Requests to exercise data-protection rights are handled within the applicable legal time limits. If your information was collected through someone else's form, contact the form creator first; Youform can assist them in handling the request.

Was this helpful?