Subprocessors
We use other companies for parts of the service that are not our own expertise. Each one only gets the data it needs to do its job, and may only use it to do that job for us.
The first table is used for every customer. The second is used only when you switch on the feature named beside it.
Effective date: 20 August 2026
Used for every customer
| Vendor | What it does | What reaches it | Where | Transfer safeguard |
|---|---|---|---|---|
| Amazon Web Services | Cloud hosting, database, file storage and email delivery | Account, Submission content, Submitter IP address, Notification recipients, Server logs | Ireland | Stays in the EEA |
| Hetzner | Hosts the service that turns an IP address into an approximate location | Submitter IP address | Germany | Stays in the EEA |
| OOPSpam | Scores submissions for spam | Submission content, Submitter IP address, Request metadata | United States | |
| Paddle | Payment processing and merchant of record | Billing | United Kingdom | Adequacy decision |
| Sentry | Error reporting | Error reports | United States | EU-US Data Privacy Framework |
| Mapbox | Draws the map on the form analytics screen | Map tile requests | United States | Standard Contractual Clauses |
Used only when you switch on a feature
None of these receive anything until you connect them to one of your forms. Disconnecting the feature stops the flow.
| Vendor | Turned on by | What it does | What reaches it | Where | Transfer safeguard |
|---|---|---|---|---|---|
| Cloudflare (Turnstile) | Turnstile spam protection | Spam protection | Submitter IP address | United States | Standard Contractual Clauses |
| Google (reCAPTCHA) | reCAPTCHA spam protection | Spam protection | Submitter IP address | Ireland | Stays in the EEA |
| Google (Sheets) | Google Sheets connection | Copies submissions into a Google Sheet the customer connects | Submission content | Ireland | Stays in the EEA |
| hCaptcha | hCaptcha spam protection | Spam protection | Submitter IP address | United States | EU-US Data Privacy Framework |
| Notion | Notion connection | Copies submissions into a Notion database the customer connects | Submission content | ||
| Slack | Slack connection | Posts submissions to a Slack channel the customer connects | Submission content | Ireland | Stays in the EEA |
| Zapier | Zapier connection | Lets the customer's Zap read their submissions | Submission content | United States | Standard Contractual Clauses |
Companies that are not on this list
Signing in with GitHub, Google or Slack is different. Those companies decide the use of that data themselves rather than acting for us, so they are not subprocessors. Their own privacy policies cover it.
Some parts of the service are built and run by us rather than bought in. Those run on the infrastructure already listed above, so they add no company to this page.
When this list changes
We add a vendor here at least 30 days before it starts handling personal data. That gives you time to object.
If you object, write to us. If we cannot resolve it, you may stop using the service and we will refund what you have not used.
Email support@formspark.io and we will add you to the list of people we tell about changes. Our Data Processing Agreement makes this page part of the contract.
Questions
Have a question about this page, your data, or your rights? Email us at support@formspark.io and we will answer it.
Formspark is operated by Trampoline Software SRL, Rue de Marsannay-la-Côte 16, 5032 Gembloux, Belgium. Enterprise number BE 0799.398.081.