FormX.ai

GDPR overview

GDPR is documented, not merely claimed. A data processing agreement is published at /dpa/ (last updated 31 May 2026) and incorporated by reference into the terms of 30 May 2026: you are the controller, FormX the processor. The privacy policy sets out access, rectification, erasure, objection, restriction, portability, withdrawal of consent and complaint to a supervisory authority, and names support@formx.ai as the data protection officer’s address. International transfers rely on the EU standard contractual clauses (Decision 2021/914), the UK IDTA and equivalent Swiss mechanisms. Breaches are notified to the controller without undue delay and within 72 hours at the latest. SOC 2 Type II reports and the ISO 27001 certificate are provided on request, on-site audits under 30 days’ notice, with DPIA assistance and self-service handling of data subject requests. Two gaps: no Article 27 EU representative is designated, and no EU hosting region is offered.

Who owns the data?

Clause 8.1 of the terms is explicit: FormX claims no ownership or control over customer Content, and you retain the copyright and any other rights you already hold in the documents you upload and in the data extracted from them. You grant SkyMakers Digital Limited only a non-exclusive, non-transferable, worldwide, royalty-free licence, limited to providing the service. The service level agreement puts it plainly: “You own your data, not us.” Under the DPA of 31 May 2026 you are the controller and FormX the processor. One reservation: clause 8.5 lets FormX build internal “Derived Data” from Content, but personal data must first be irreversibly anonymised or aggregated.

Reuse rights

You can reuse your documents and the extracted JSON freely, without asking FormX for permission: nothing in the terms limits what you do with your own Content or with the output. FormX’s own use is fenced in. The privacy policy lists service delivery, product research and development, marketing and engagement, customer support and the defence of legitimate interests and legal rights, on legal bases ranging from contractual necessity and consent to legitimate interest, payment processing and legal obligation. Clause 16.1 of the terms rules out using Content to train or fine-tune a generative model or an LLM made available to other customers, unless you have given prior written consent, unless it is strictly necessary to provide, secure or improve the service after prior anonymisation or aggregation, or unless the law requires it. Annex C of the DPA repeats the commitment for personal data, and the pricing FAQ states that documents are not used to optimise the models unless the customer asks. Content is shared with your own team members, with the sub-processors listed publicly, and with authorities under legal process; on the marketing site, non-essential trackers load only after cookie consent.

Data retention & training

Hosting summary

Documents are processed on Google Cloud Platform and Microsoft Azure. The processing region is selected when the project is created, from the United States, Taiwan and Singapore; the privacy policy names hosting providers in those three territories and points to the United States as the primary storage location. There is no European Union region. The infrastructure runs on Google Kubernetes Engine inside a GCP environment certified ISO 27001. Hosting sub-processors are named publicly: Google LLC (United States, Taiwan, Singapore) and Microsoft Corporation (United States, for model inference when enabled). Data is encrypted in transit with TLS, using Let’s Encrypt certificates on the Kubernetes ingress, and at rest with AES-256 through the cloud provider’s key management service. International transfers are covered by the EU standard contractual clauses, the UK IDTA and equivalent Swiss mechanisms, as set out in the DPA of 31 May 2026. For an organisation with EU data residency requirements, the absence of a European region is the first point to check.