Data Processing Agreement
Last updated: 2026-09-02
1. Scope
This agreement governs the personal data we process on your behalf when people submit your forms. It is incorporated into the Terms of Service by reference and is accepted the same way they are: by creating an endpoint. No signature is required, and there is nothing to send back — the version above is the version in force, and each acceptance is recorded against your account with that version and a date.
We do not countersign customer paper today. If your own compliance process requires a signed copy, write to privacy@honeyforms.dev and we will tell you honestly whether we can meet it.
2. Roles of the parties
| You | You decide which fields your form collects, why, and who receives them. Our processing instruction is your endpoint configuration. |
|---|---|
| Us | We accept, filter, store and deliver what your form sends, and nothing else. |
| Your visitors | The people the data is about. They never had a relationship with us, which is why their data is treated as yours throughout. |
Where the applicable law uses the terms, you are normally the controller and we are the processor. Which law applies depends on where you and your visitors are; the division of work above holds either way.
3. Processing of personal data
- Subject matter and purpose — receiving, filtering, storing and delivering form submissions for you.
- Instructions — we process the data to provide the service and otherwise in accordance with your applicable instructions, which you give through your endpoint configuration and your use of the service. We do not mine it, sell it, train on it or use it to profile anyone.
- Duration — for as long as you have an endpoint with us, and then for the deletion window in the Terms.
- Confidentiality — everyone with access is bound to keep it confidential.
4. Categories of data
- Contact information — such as the name, email address or phone number a visitor types into your form.
- Form submissions — the content of the fields your form asks for, which we cannot know in advance because the service is schema-less.
- Technical information — timestamps, delivery status, spam score, the origin domain, a truncated user agent.
Categories of data subjects — the visitors of the sites where you install an endpoint.
The service is not designed for special categories of personal data — health, biometric, government identifiers and the like — and the Terms forbid collecting them through it without a lawful basis and appropriate safeguards. We say so here rather than staying silent: a DPA that implied we were ready for that data would be the one sentence in this document that could hurt you.
5. Security
We keep the measures described in the Privacy Policy: encryption in transit, encryption at rest at our database provider, credentials scoped to a single endpoint and revocable by you, domain locking so a copied key cannot be used from somewhere else, and production access limited to the people who operate the service.
We hold no security certification and have commissioned no third-party audit. We make available what we can to help you show your own auditors that this agreement is being kept.
6. Data breaches
If personal data we hold for you is breached, we notify you without undue delay after becoming aware of it, with what we know at the time, what we are doing about it, and what we learn afterwards. We do not promise a deadline in hours: we would rather tell you everything late on the day we find out than commit to a clock we cannot honestly keep.
7. Data subject requests
Requests from your visitors are yours to answer — they are your data subjects. We help where we can: export is self-service, in CSV and JSON, on every plan including the free one, and deleting a stored submission is available to you at any time.
If a visitor contacts us directly, we point them to you rather than act on their data ourselves, except where the law requires otherwise.
8. International transfers
The service runs on global infrastructure, so personal data processed under this agreement may be transferred to and processed in a country other than yours. Where such a transfer needs a legal basis, we rely on the safeguards the applicable law provides, and we require our providers to offer protection consistent with this agreement.
9. Subprocessors
You give general authorisation for us to engage subprocessors in the categories needed to run the service: hosting and network infrastructure, database hosting, email delivery, and payment processing once checkout opens. Each is bound by terms no less protective than these, and we remain responsible to you for what they do.
We do not publish the list at this stage; write to privacy@honeyforms.dev and we will tell you who they are. We announce a new subprocessor by email to account owners at least 30 days before it starts processing, and you may object by writing to the same address — in which case you may terminate before the change takes effect.
10. Data retention and deletion
Submissions are deleted on the schedule of your plan, described in the Privacy Policy. At the end of the retention window, and after termination, the data is really deleted — a scheduled job removing rows, not a hidden flag.
A submission that is still being held for delivery is never deleted by retention: it is exactly the one you have not been able to read yet. Export your data before you cancel; after termination, the deletion window in the Terms is how long you have.
11. Termination
This agreement lasts as long as we process personal data for you, and ends with the Terms. The obligations that protect data already processed — confidentiality, security, deletion — survive it.
12. Contact
Write to privacy@honeyforms.dev. We read everything that arrives there.