# Formstep Docs — Legal # Legal overview Index of Formstep legal documents: the Terms of Service, Privacy Policy, Data Processing Agreement, and Partner Terms, with governing law and contact details. ## Documents The documents below form the legal framework for using Formstep. The Partner Terms apply only to partners in the affiliate program. - [Terms of Service](https://formstep.io/docs/legal/terms-of-service/) — Terms governing your use of Formstep, its website, apps, and APIs: accounts, acceptable use, plans and billing, AI credits, your content, and liability. - [Privacy Policy](https://formstep.io/docs/legal/privacy-policy/) — How Formstep collects, uses, and protects personal data, for the people who build forms and the respondents who fill them in, and the rights you have. - [Data Processing Agreement](https://formstep.io/docs/legal/dpa/) — How Formstep processes personal data on your behalf under the GDPR and similar laws, with each party’s obligations, subprocessors, and security measures. - [Partner Terms](https://formstep.io/docs/legal/partner-terms/) — Terms for partners in the Formstep affiliate program: how referrals are credited, how commission and payouts work, and how you may promote Formstep. ## Who operates Formstep The Service is operated by **Formbase AS**, a Norwegian limited company with organisation number 937 921 217 and registered office in Oslo, Norway. ## Contact For general, legal, and security questions, write to . ## Governing law Norwegian law governs the Terms of Service and the Data Processing Agreement. The parties agree that the Oslo District Court (Oslo tingrett) has jurisdiction to settle any dispute, subject to the mandatory consumer protections described in the Terms of Service. ## Changes When we make a material change to any of these documents, we update the “Last updated” date at the top of that document and notify account holders by email or in-product notice at least thirty (30) days before it takes effect. Last updated: 23 May 2026 # Terms of Service Terms governing your use of Formstep, its website, apps, and APIs: accounts, acceptable use, plans and billing, AI credits, your content, and liability. > **Last updated: 12 November 2026** > > These Terms apply to everyone who creates an account or uses Formstep. Read them carefully. If you have questions, contact us at . ## 1. Acceptance of Terms These Terms of Service (“Terms”) govern your access to and use of Formstep, operated by Formbase AS, a Norwegian limited company with organisation number 937 921 217 and registered office in Oslo, Norway (“Formstep”, “we”, “us”), including our website, applications, APIs, integrations, and related services (collectively, the “Service”). By creating an account or accessing the Service, you agree to be bound by these Terms. If you are using the Service on behalf of an organisation, you represent that you have authority to bind that organisation to these Terms, and “you” refers to both you personally and that organisation. If you do not agree to these Terms, you must not create an account or use the Service. Your continued use of the Service following any updates to these Terms constitutes acceptance of the revised version. These Terms incorporate by reference our Privacy Policy, Data Processing Agreement (where applicable), and any product-specific terms presented to you within the Service. ## 2. Definitions For the purposes of these Terms, capitalized terms have the meanings set out below: - **Service** means the Formstep platform and all features made available through it, including the form builder, hosted forms, dashboards, integrations, AI features, and APIs. - **User** means any individual who accesses or uses the Service in an Account capacity, whether as a workspace owner or member. Respondents are not Users — see [Section 6](#acceptable-use). - **Customer** means a User who holds the Formstep Account under which the Service is used; for individual accounts this is you, for business accounts this is the organisation you act on behalf of. - **Account** means the personal record created when you register for the Service, identified by a unique email address. - **Workspace** means a separately addressable environment within the Service in which forms, submissions, members, and settings are organised. - **Form** means any survey, questionnaire, application, checkout, or other interactive document created and published through the Service. - **Submission** means a response, entry, file upload, payment, or other data record collected through a Form. - **Subscription** means a recurring paid plan that unlocks features or capacity on your Account. - **Content** means any text, media, file, configuration, response, code, prompt, or other material that you, your collaborators, or your respondents create, upload, transmit, or store through the Service. - **Your Content** means the Content that belongs to your account, as described in [Section 8](#user-content). - **AI Features** means any functionality of the Service that uses machine learning or large language models to generate, transform, summarize, route, or otherwise process Content on your behalf. - **Respondent** means a person who submits a response to a Form, whether or not they hold an Account. ## 3. Eligibility To use the Service, you must be at least thirteen (13) years old and have the legal capacity to enter into a binding contract under the laws of your jurisdiction. Where the law that applies to you sets a higher minimum age for consenting to online services or to the processing of your personal data, you must meet that higher age. If you are below the age of majority in your country, you confirm that a parent or legal guardian has authorised your use of the Service. You may not use the Service if you are barred from doing so under applicable laws, including export controls and sanctions administered by Norway, the European Union, the United Nations, the United Kingdom, or the United States. You confirm that you are not located in, ordinarily resident in, or organised under the laws of a country or territory subject to comprehensive sanctions, and that you are not listed on any restricted-party or denied-persons list. We may, at our discretion, refuse, suspend, or terminate access where we reasonably believe these eligibility requirements are not met. ## 4. Account Registration and Security To access most features of the Service, you must register an Account. When you register, you agree to provide accurate, current, and complete information, and to keep that information up to date. Each Account is intended for a single human individual. You may not share login credentials, transfer your Account to another person, or allow multiple people to operate under the same Account (including through a shared inbox or alias). For team use, each team member must register their own Account and you may invite them to your Workspace under their own Accounts. You are responsible for safeguarding your credentials and for any actions taken under your Account, whether or not authorised by you. The Service does not use passwords of its own; you sign in through a magic link sent to your email address or through Google OAuth. You may also try Formstep without registering through a temporary anonymous guest session; guest sessions are temporary and do not persist data. Notify Formstep without undue delay if you become aware of any unauthorised access, suspected compromise, or other security incident involving your Account; you can also reach us at . To the extent permitted by applicable law, we are not liable for losses resulting from your failure to protect your credentials or to notify us promptly. ## 5. Workspaces and Team Accounts The Service is organised around Workspaces. The individual who creates a Workspace is its initial owner and is treated as the primary account holder for ownership of Content and administrative decisions affecting that Workspace. Workspace owners may invite additional members to a Workspace. Workspace roles are currently limited to owner and member; owners administer the Workspace and its billing-relevant configuration, and members can access forms, submissions, and integrations to the extent permitted by the Workspace’s settings, as described in the Service’s documentation and as updated from time to time. If you are invited to a Workspace, you acknowledge that the Workspace owner controls the configuration of that Workspace and may have visibility into, and authority over, the Forms, Submissions, and activity occurring within it. Your use of a Workspace is additionally subject to any internal policies set by its owner, provided they do not conflict with these Terms. A Workspace is intended to support a single team or organisation collaborating together. The paid features that extend to the members of a Pro-owned Workspace are provided for that collaboration. They are not a means to give the paid features of the Service to unrelated individuals, to multiple distinct organisations, or to the general public under a single Subscription. Formstep may apply fair-use limits to the number of members in a Workspace and reserves the right to require separate Subscriptions where a single Workspace, or a set of Workspaces under one Account, is used to extend paid features beyond a single team or organisation. Workspace ownership does not currently transfer through a self-service flow. Formstep is not a party to any agreement between Workspace owners and their members or Respondents, and is not responsible for resolving disputes among them. ## 6. Acceptable Use Policy You may use Formstep to build, publish, and manage forms for lawful purposes that comply with these Terms and any laws applicable to you and to the people you collect information from. Typical permitted uses include customer feedback, lead capture, surveys, registrations, applications, internal workflows, payment collection through supported processors, and similar form-driven activities. You are solely responsible for the forms you publish, the questions you ask, the data you collect, the files respondents upload, and how you store, share, or act on that information. If you collect personal data, you act as the data controller for that data and must provide respondents with any notices, choices, and legal bases required under applicable privacy laws. Formstep is a general-purpose form builder and is **not designed, certified, or warranted for use with regulated sensitive data**. Formstep does not currently offer any certification, business associate agreement, or written authorisation for regulated data use cases — no such arrangement can be obtained by email request alone. Unless we have explicitly agreed otherwise with you in a separate written agreement signed by an authorised representative of Formstep, you must not use Formstep to collect, store, or process: - Protected Health Information (PHI) subject to the U.S. Health Insurance Portability and Accountability Act (HIPAA) or equivalent health-data regimes; - Cardholder data subject to PCI DSS, except through the Payment field — Stripe collects and processes all card data directly; Formstep receives only non-sensitive references such as the last four digits; - Government-issued identifiers used as primary identity proofing (such as full social security numbers, national ID images) unless you have implemented your own additional safeguards; - Information about minors below the age of consent under applicable law, including data subject to the U.S. Children’s Online Privacy Protection Act (COPPA), unless you have obtained verified parental or guardian consent and have your own compliant workflow; - Any other category of data for which your applicable laws require a specific certification, contract, or technical measure that Formstep has not undertaken in writing. If your use case involves any of the above, you are responsible for assessing fitness yourself, putting any additional safeguards in place, and seeking written confirmation from Formstep before proceeding. Respondents are not Users of Formstep. Your relationship with respondents is governed by your own terms and privacy practices. You are responsible for handling their data and any disputes that arise from your forms. Electronic signatures collected through Formstep’s Signature field are not qualified or advanced electronic signatures under the EU eIDAS Regulation. They may not satisfy the heightened evidentiary requirements for document types that require a qualified signature under applicable law. You are responsible for assessing whether signatures collected through Formstep meet the legal requirements for your specific use case and jurisdiction. ## 7. Prohibited Uses You must not use Formstep, and must not allow anyone else to use your account, to do any of the following: - Publish, transmit, or solicit content that is illegal under the laws that apply to you or to your respondents. - Harass, threaten, defame, or incite violence against any person or group. - Send spam, unsolicited bulk messages, or use Formstep to drive traffic to deceptive destinations. - Conduct phishing, credential harvesting, or any form of social engineering. - Distribute malware, viruses, ransomware, or links to malicious software. - Scrape, crawl, or harvest forms, submissions, respondent data, or other data from Formstep’s applications or its users by automated means, except through documented APIs within published rate limits. This does not restrict reading, indexing, or linking to Formstep’s public website and documentation, by people or by automated tools, as `robots.txt` permits. - Circumvent or attempt to circumvent submission limits, plan restrictions, paywalls, rate limits, branding restrictions, or other technical controls. - Infringe any copyright, trademark, patent, trade secret, publicity, or other intellectual property right. - Upload, request, or generate child sexual abuse material (CSAM) or content that sexually exploits or endangers minors. Where we become aware of such content we are required by law to report it to the relevant authorities (for users in Norway, Kripos; we may also forward reports to organizations such as NCMEC (CyberTipline) where appropriate) and we will do so. - Commit fraud, run deceptive schemes, or misrepresent your identity, affiliation, or the purpose of your forms. - Create fake accounts, abuse guest sessions, use multiple accounts or sessions to evade limits or bans, or sell, rent, or transfer accounts to others. - Share, resell, or redistribute the paid features of the Service in breach of the Workspace fair-use rules in [Section 5](#workspaces). - Use Formstep AI Features to generate, refine, or distribute content that is illegal, harmful, hateful, sexually explicit involving minors, or that would otherwise violate these Terms. - Abuse payment-enabled forms, including processing test or stolen card data, laundering funds, or collecting payments for goods or services you cannot lawfully provide. - Interfere with the integrity, security, or performance of Formstep, including by probing, load testing without permission, or attempting to gain unauthorised access to any account, system, or data. We may update the list of prohibited uses as new patterns of abuse emerge. ## 8. Your Content and Ownership You retain all rights you already have in the content you bring to Formstep. This includes the forms you build, the questions and copy you write, the media and files you upload, the submissions your respondents send you, and any data you import or sync through integrations (“Your Content”). To operate the Service for you, you grant Formstep a worldwide, non-exclusive, royalty-free licence to host, store, copy, transmit, display, render, process, back up, and otherwise use Your Content solely as needed to provide, secure, and support the Service for your account, and to improve the Service through aggregated and de-identified analytics that do not contain personal data. This licence covers the technical operations required to run Formstep, such as serving forms to respondents, delivering email and webhook notifications, running integrations you enable, generating previews and analytics for you, and maintaining backups. If you use AI Features, you grant the additional permissions needed for those features to function, including sending the relevant inputs to the AI provider that powers AI Features on your behalf. The provider details, data-handling, and no-training commitments for AI Features are described in [Section 16](#ai). This licence lasts only as long as Your Content is on Formstep, and ends when you or we delete it, subject to short retention windows in backups and logs and to any obligation we have to retain records under applicable law. You are responsible for ensuring you have the rights needed to grant this licence for everything you upload, including any third-party content and any personal data of respondents. Formstep, the Formstep brand, the Service, its software, and all related materials we provide remain our property or the property of our licensors. Nothing in these Terms transfers ownership of the Service to you. ## 9. Content Moderation and Reporting We have the right, but not the obligation, to review content on Formstep. We do not pre-screen forms or submissions, and you should not rely on us to do so. When we become aware of content or behaviour that violates these Terms or applicable law, we may take any action we consider appropriate. This includes removing or disabling forms, files, or submissions, suspending or terminating accounts, withholding payouts on payment forms, preserving records for investigations, and reporting illegal content to the relevant authorities. Where reasonable and lawful, we will tell you what we have done and why. If you believe content on Formstep violates these Terms or your rights, contact us at with enough information for us to locate and assess it. For copyright and other intellectual property complaints, including notices similar to those provided for under the U.S. Digital Millennium Copyright Act, send your notice to and include the works concerned, the URLs of the allegedly infringing content, your contact details, and a statement that your complaint is made in good faith. Counter-notices may be sent to the same address. We may keep records of reports and the actions we take in response. Submitting a knowingly false or abusive report is itself a breach of these Terms. In appropriate circumstances, we terminate the accounts of users who repeatedly infringe the intellectual property rights of others. Formstep does not scan files uploaded by respondents for malware or other harmful content. You are responsible for any files your respondents upload through your forms, and you should not download or open files from untrusted respondents without appropriate precautions. ## 10. Plans and Subscriptions Formstep is offered on a free tier and paid Pro and Business tiers. Each plan defines the features and usage limits available to you, and the current details for every plan are published on the [Formstep pricing page](https://formstep.io/docs/subscription-billing/plans-pricing/). The free tier lets you build, publish, and collect responses from forms within the limits described on the pricing page. It is intended for personal use, evaluation, and low-volume projects. Formstep may apply soft caps, Formstep branding on public forms, or feature restrictions to the free tier, and may adjust these from time to time. If you exceed the limits applicable to your plan, Formstep may stop accepting new submissions on affected forms, display a limit-reached notice, or notify you by email. The Pro tier unlocks higher limits, custom domains, custom themes, and advanced analytics. No plan includes AI credits; you purchase them separately as described in [Section 12](#ai-credits). The Business tier builds on Pro and additionally includes respondent email verification, custom data retention schedules, version history, a higher custom-domain allowance, and an optional shared AI credit pool for workspace members. Third-party integrations (webhooks, automation platforms, and similar connections) are available on all plans; Pro unlocks higher submission volumes that make them more practical at scale. You may subscribe to Pro or Business on a monthly or yearly billing cycle. Yearly subscriptions are billed up front for the full term and typically include a discount relative to the monthly price. Subscriptions are tied to your individual Formstep user account, not to a workspace. If you belong to multiple workspaces, your plan entitlements and AI credit balance follow you across all of them. Workspaces themselves are not billed; only users are. When you are the owner of a workspace and your account is on a paid tier, that tier’s features (such as custom domains, higher submission limits, and advanced analytics) extend to all members of that workspace; members do not need their own subscription to access those features within your workspace. This member benefit is subject to the fair-use rules in [Section 5](#workspaces). On the free and Pro tiers, AI credits remain personal to each user. On the Business tier, the workspace owner may enable a shared pool, in which case members consume the owner’s purchased AI credits while working in that owner’s workspaces. Your subscription renews automatically at the end of each billing cycle using the payment method on file, unless you cancel before the renewal date. Formstep may change the prices, features, or limits of any plan. For changes that affect the price you pay on renewal, or that materially reduce the features or limits available on a paid plan, we will give you reasonable advance notice before the change takes effect. If you do not accept the change, you may cancel your subscription before it renews, and your access will continue under your existing plan until the end of your current billing period. ## 11. Payment Processing and Billing All subscription payments and AI credit purchases on Formstep are processed by Polar (polar.sh), our payment provider. Polar acts as the Merchant of Record for these transactions. This means Polar sells the Formstep subscription or credit pack to you, collects payment, issues the receipt or invoice, and handles applicable taxes on our behalf. When you subscribe or top up credits, you also agree to Polar’s terms of service and privacy policy in addition to these Terms. Your card details, billing address, and other payment information are collected and stored by Polar, not by Formstep. Formstep receives only the limited transaction data needed to provision your plan and credits and to handle support requests. Because Polar is the Merchant of Record, Polar determines and charges any value-added tax, goods and services tax, sales tax, or equivalent levy that applies to your purchase based on your billing location. The price displayed at checkout will reflect taxes where required. You are responsible for providing accurate billing and tax information, including any VAT number or business identifier if you are purchasing as a business. Receipts and, where applicable, tax-compliant invoices are issued by Polar and made available through the billing portal linked from your Formstep account. If you need a corrected invoice, contact Polar through the billing portal. If payment cannot be collected, your account may enter a grace period during which Pro features are progressively restricted, and may ultimately be downgraded to the free tier until the outstanding balance is paid, as described in the [billing documentation](https://formstep.io/docs/subscription-billing/upgrading-downgrading/#grace-period). You remain responsible for any amounts owed. ## 12. AI Credits Several Formstep features, such as AI-assisted form building and AI chat for analysing submissions, consume AI credits. Credits represent prepaid usage of the underlying AI models that power these features and are not a currency, store of value, or property right. No plan includes AI credits. You can purchase credit top-ups from Polar at any time, on any plan. **Purchased credits do not expire** and remain available on your account until they are used. Different AI operations consume different amounts of credits depending on the model used and the size of the input and output. The current consumption rates are published in the [Formstep documentation](https://formstep.io/docs/ai/ai-credits-usage/) and may be adjusted as model pricing or capabilities change. Credits are tied to your user account and cannot be transferred, gifted, resold, or exchanged for cash. Purchased top-up credits are not refundable once they are used, except where required by mandatory consumer protection law. Formstep applies fair use protections to AI Features to keep the Service stable and affordable for everyone. We may rate-limit, throttle, or temporarily pause AI operations if we detect automated abuse, attempts to extract model weights or training data, or usage patterns that materially exceed normal interactive use. Fair use thresholds, where defined, are published in the [Formstep documentation](https://formstep.io/docs/ai/ai-credits-usage/). If we suspect fraud or abuse, we may also suspend AI access while we investigate. ## 13. Cancellation, Refunds and Right of Withdrawal You can cancel your Pro subscription at any time from your Formstep billing settings. When you cancel, your subscription will not renew at the end of the current billing period. You keep access to Pro features until that period ends, after which your account is moved to the free tier. Purchased AI credits stay on your account. Your forms, responses, and workspace data remain available subject to the free tier’s limits. Formstep does not offer refunds for unused subscription time, unused AI credits, or partially used billing periods, except where required by mandatory consumer protection law or as provided by the [Data Processing Agreement](https://formstep.io/docs/legal/dpa/) in the event of termination following a subprocessor objection. This applies whether you cancel mid-cycle, downgrade, stop using the Service, or are downgraded automatically after a failed payment. Where Polar has issued an invoice, any refund decision is also subject to Polar’s policies as Merchant of Record. If you are a consumer resident in the European Union, the European Economic Area, or Norway, you have a statutory 14-day right to withdraw from a distance contract for digital services, without giving any reason. Because Polar, as Merchant of Record, collects your express prior consent to immediate delivery at checkout — in accordance with Article 16(m) of Directive 2011/83/EU and the Norwegian Right of Cancellation Act (Angrerettloven 2014, LOV-2014-06-20-27) — performance begins when the purchase is completed, and the right of withdrawal is exhausted from that point. ## 14. Respondent Payments via Stripe Connect Formstep lets you add Payment fields to your forms so that respondents can pay you when they submit a response, for example for bookings, donations, paid registrations, or product orders. These respondent payments are processed through Stripe Connect, and they are separate from your Formstep subscription and AI credit purchases. To accept respondent payments, you must connect your own Stripe account to Formstep. You are solely responsible for creating, verifying, and maintaining that Stripe account, for complying with Stripe’s Connected Account Agreement and other applicable Stripe terms, and for meeting any identification, tax, and regulatory requirements Stripe imposes on you. For respondent payments, you are the merchant of record. Formstep is not a party to the transaction between you and your respondent, does not sell your goods or services, does not handle the funds, and does not issue receipts or invoices on your behalf. Funds are processed by Stripe and settled to your connected Stripe account, subject to Stripe’s fees, holds, and payout schedule. As the merchant for these transactions, you are responsible for: - Describing accurately what the respondent is paying for, including price, currency, and any recurring terms. - Charging, collecting, reporting, and remitting any applicable taxes on the respondent’s payment. - Honoring the goods, services, or commitments the respondent has paid for. - Handling refunds, chargebacks, disputes, customer support, and any consumer law obligations toward your respondents. - Complying with all laws that apply to your business, including anti-money-laundering, sanctions, and sector-specific regulations. For data protection purposes, Stripe acts as an independent controller for the payment data it processes. Formstep’s ability to offer respondent payments depends on its ongoing compliance with Stripe’s platform agreement; if that relationship changes, the availability of Payment fields may be affected without notice. We are not liable for Stripe’s availability, fees, fund holds, account suspensions, or disputes between you and a respondent. You agree to indemnify Formstep against claims, losses, and expenses arising from your use of respondent payments, except to the extent caused by our own breach of these Terms. Formstep does not currently charge a platform fee on respondent payments. ## 15. Service Availability and Modifications Formstep does not offer a formal service level agreement (SLA). Uptime is best-effort; we cannot guarantee that the Service will be uninterrupted, error-free, or available at any specific time. From time to time we will perform maintenance, which may occur without advance notice. Formstep reserves the right to modify, suspend, or discontinue any part of the Service — including individual features, integrations, plans, and limits — at any time, with or without notice, and with or without liability to you, except as required by applicable law. Minor changes, performance improvements, and bug fixes may be deployed at any time. Some features are clearly labelled as beta, preview, or experimental. These are offered “as is” and may change, break, or be withdrawn without notice. You should not rely on beta features for production workflows or business-critical use, and any data, configurations, or behaviour tied to a beta feature may be reset when the feature graduates or is removed. ## 16. AI Features and Outputs Formstep includes AI-powered capabilities, including AI-assisted form building and AI chat for analysing submissions. These features are powered by Claude models made by Anthropic, which we run on Amazon Bedrock inside the EU, and the providers we use may change over time as we improve quality, latency, and cost. Any change of AI provider constitutes a new subprocessor and will be notified in accordance with [Section 19](#subprocessors) and the [Data Processing Agreement](https://formstep.io/docs/legal/dpa/). AI outputs are generated probabilistically and can be inaccurate, incomplete, biased, outdated, or misleading. You are responsible for reviewing every AI-generated output before relying on it, publishing it, sending it to respondents, or using it to make decisions. Do not treat AI suggestions as legal, medical, financial, or other professional advice. You remain solely responsible for the forms you publish and any decisions you make based on AI output. When you use AI Features, the prompts you submit and the relevant context from your account (such as form structure or submission samples you explicitly share with the AI) are sent to Amazon Bedrock for processing. We configure it so that, under the [AWS Service Terms](https://aws.amazon.com/service-terms/) governing Amazon Bedrock, your inputs and outputs are: - **Not used to train** any AWS or third-party foundation models; - **Not stored by AWS** after the request is processed, and handled in accordance with the AWS Service Terms and Amazon Bedrock data-protection commitments; and - Processed in line with the security and data protection commitments described in our [Privacy Policy](https://formstep.io/docs/legal/privacy-policy/) and [Data Processing Agreement](https://formstep.io/docs/legal/dpa/). Where AI processing transfers your data outside the European Economic Area, Formstep relies on the safeguards set out in [Section 10 of the Data Processing Agreement](https://formstep.io/docs/legal/dpa/#international-transfers), including Standard Contractual Clauses adopted under Decision (EU) 2021/914 and, where applicable, the EU–US Data Privacy Framework. You should not submit personal data, secrets, or other sensitive information through AI Features unless you have a lawful basis to share that information with AWS and have considered the risks. We do not control how AWS responds to lawful government requests directed at it. The prohibited uses in [Section 7](#prohibited-uses) apply to AI Features. You must not attempt to reverse-engineer the underlying models, extract their weights, or use the AI Features to build a competing product. ## 17. Third-Party Integrations Formstep connects to a range of third-party services so you can route submissions, sync data, and automate workflows. These integrations include messaging tools, webhook endpoints, automation platforms, spreadsheets, productivity suites, databases, and email providers. This Section 17 covers only third-party integrations that you optionally enable; the subprocessors Formstep relies on to deliver the Service are described in [Section 19](#subprocessors) and the [Data Processing Agreement](https://formstep.io/docs/legal/dpa/), and you cannot opt out of them while using the Service. Third-party services are operated independently and are not part of Formstep. We do not control their availability, pricing, features, terms, privacy practices, or uptime, and we are not responsible for outages, changes, deprecations, or data loss on their side. If a third-party service changes its API or terms in a way that breaks an integration, we cannot guarantee continued functionality. When you connect a third-party service, you authorise Formstep to exchange data with that service on your behalf. You are responsible for reviewing and complying with the terms and acceptable use policies of every service you connect, and for ensuring you have the right to share the data you route through Formstep. OAuth permissions you grant remain active until you revoke them, either inside Formstep or in the third-party service. If you use API keys or our MCP server to integrate Formstep with your own systems or with AI agents, you are responsible for keeping credentials secret, rotating them when needed, and for all activity performed using those credentials. We may rate-limit, suspend, or revoke API keys and MCP access that show signs of abuse, security risk, or that violate these Terms. ## 18. Data Export and Portability Your data belongs to you. While your account is active, you can export your forms and submissions at any time in standard formats, including CSV and Excel (XLSX), directly from the Formstep application. There is no limit on how often you can export your own data. Cancelling a Pro subscription does not delete your data; you keep access on the free tier subject to the free tier’s limits. If you **close your account**, the account and its forms and submissions are removed from active systems and remain in our providers’ backups only until the corresponding backup window expires, as described in the [Privacy Policy](https://formstep.io/docs/legal/privacy-policy/). We strongly recommend exporting any data you need before closing your account. If you are a Workspace owner and you close your account, the Workspace and all its associated forms, submissions, and data will be scheduled for deletion. Members’ own accounts are not affected by a Workspace owner closing their account. ## 19. Privacy and Data Processing How we collect, use, store, and share personal data is described in our [Privacy Policy](https://formstep.io/docs/legal/privacy-policy/), which forms part of these Terms by reference. For data submitted to your forms by respondents, you are the data controller and Formstep acts as your data processor. This means you decide what personal data to collect, why, and on what legal basis, and we process that data on your behalf and on your documented instructions. The terms of that processing relationship, including subprocessors, security measures, and international transfers, are set out in our [Data Processing Agreement](https://formstep.io/docs/legal/dpa/), which applies automatically to customers subject to the GDPR or equivalent regimes. For data we collect about you as a Formstep user, such as your account details, billing information, and usage of the product, Formstep is the data controller. We process this data to provide and improve the Service as described in the Privacy Policy. Formstep handles personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Norwegian data protection law. If you have questions about how your data or your respondents’ data is handled, or if you need to exercise data subject rights, contact us at . In the event of a personal data breach affecting your account, Formstep will notify you in accordance with [Section 11 of the Data Processing Agreement](https://formstep.io/docs/legal/dpa/#breach), which sets out our notification obligations and timelines. ### Subprocessors Formstep relies on a small set of trusted third-party providers (“subprocessors”) to deliver the Service. These subprocessors process personal data on our behalf only as needed to provide their part of the Service, under contracts that require appropriate confidentiality and security measures. The current core subprocessors include: - **Convex** — application database and backend. - **Cloudflare R2** — object storage for file uploads and signatures. - **Cloudflare** — CDN, DNS, edge security, custom hostnames, and Turnstile bot protection. - **Polar** — subscription billing and AI credit purchases (Merchant of Record; independent controller for buyer billing data). - **Stripe** — respondent payment processing via Stripe Connect (independent controller for payment data). - **Amazon Web Services (AWS)** — Amazon Bedrock for AI Features; Amazon SES for transactional and system emails, including abandoned-response reminders on Pro workspaces. - **Axiom** — operational logs and monitoring. - **PostHog** — analytics and error reports for our website and the Formstep app, and account sign-ups. - **Unsplash** — image search API; selected images are stored in Cloudflare R2 and served from there. The authoritative list of subprocessors — with data categories and regions — is in our [Data Processing Agreement](https://formstep.io/docs/legal/dpa/). Changes to subprocessors are handled in accordance with [Section 9 of the Data Processing Agreement](https://formstep.io/docs/legal/dpa/#subprocessors). ## 20. Intellectual Property Formstep, including its software, source code, user interface, design system, illustrations, documentation, brand name, logos, and other trademarks, is owned by Formstep and protected under Norwegian and international intellectual property laws. All rights not expressly granted to you in these Terms are reserved. Subject to your compliance with these Terms, Formstep grants you a limited, non-exclusive, non-transferable, non-sublicensable, and revocable licence to access and use the Service for your internal business or personal purposes during the term of your account. This licence does not permit you to copy, modify, reverse engineer, decompile, resell, sublicence, or create derivative works based on the Service, except to the extent such restrictions are prohibited by mandatory law. You must not remove, obscure, or alter any proprietary notices on the Service, and you must not use Formstep’s name, logos, or other brand assets except as expressly permitted in writing or as needed to refer to the Service in accordance with applicable law. Nothing in this Section 20 affects the rights you retain in Your Content, as described in [Section 8](#user-content). ## 21. Feedback If you choose to send Formstep ideas, suggestions, feature requests, bug reports, or any other feedback regarding the Service (“Feedback”), you agree that such Feedback is non-confidential and that Formstep may use, reproduce, modify, distribute, and commercialise the Feedback for any purpose, without restriction, attribution, or obligation to compensate you. You waive any rights in the Feedback that would prevent Formstep from exercising the foregoing, to the extent permitted by applicable law, including moral rights under the Norwegian Copyright Act (Åndsverkloven) and equivalent laws in other jurisdictions. You are not required to provide Feedback, and submitting Feedback does not grant Formstep any rights in Your Content beyond those described in [Section 8](#user-content). ## 22. Termination by You You may cancel your subscription or close your account at any time through your account settings or by contacting . See [Section 13](#cancellation) for cancellation and refund terms and [Section 18](#export) for data handling after closure. ## 23. Termination and Suspension by Formstep Formstep may suspend or terminate your access to the Service, in whole or in part, at our sole discretion, with or without cause, and with or without notice, except where mandatory consumer protection law requires otherwise. For consumers on a paid subscription, termination without cause will not take effect before the end of the current paid billing period, and any prepaid fees for the unused remainder of that period will be refunded. Reasons may include: - You materially breach these Terms or any policy incorporated by reference; - You fail to pay fees when due and the failure is not remedied after reasonable notice; - Your use of the Service creates a security, legal, or operational risk to Formstep, its users, or third parties; - Formstep is required to do so by law, regulation, or a binding order from a competent authority; or - Formstep ceases to offer the Service or a specific feature. Where the circumstances permit, Formstep will give you advance notice of suspension or termination and a reasonable opportunity to cure the issue. In cases involving abuse, illegal activity, security incidents, or risk of harm, Formstep may act immediately and without prior notice. If Formstep suspends or terminates your account because you breached these Terms, for example through a prohibited use under [Section 7](#prohibited-uses), Formstep may end your paid subscription immediately. Fees already paid and purchased AI credits, used or unused, are not refunded, except where mandatory consumer protection law requires otherwise. Following termination, Formstep will handle your data in accordance with the Privacy Policy. Provisions that by their nature survive termination remain in effect, including [Section 8](#user-content) (Your Content and ownership), [Section 20](#intellectual-property) (intellectual property), [Section 21](#feedback) (feedback), [Section 24](#warranty-disclaimer) (warranty disclaimer), [Section 25](#limitation-of-liability) (limitation of liability), [Section 26](#indemnification) (indemnification), and [Section 27](#governing-law) (governing law and dispute resolution). ## 24. Warranty Disclaimer To the maximum extent permitted by applicable law, the Service is provided on an “as-is” and “as-available” basis, without warranties of any kind, whether express, implied, or statutory. Formstep specifically disclaims all implied warranties of merchantability, fitness for a particular purpose, non-infringement, accuracy, reliability, and any warranty arising out of course of dealing or usage of trade. Formstep does not warrant that the Service will be uninterrupted, error-free, secure against all threats, free of viruses or harmful components, or that defects will be corrected. You acknowledge that the Service depends on third-party infrastructure, networks, and services outside Formstep’s full control. Nothing in this section limits warranties or rights that cannot be excluded under mandatory Norwegian or EU consumer protection law. ## 25. Limitation of Liability To the maximum extent permitted by applicable law, in no event will Formstep be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, including loss of profits, revenue, goodwill, data, business opportunities, or anticipated savings, even if Formstep has been advised of the possibility of such damages. Formstep’s total aggregate liability arising out of or relating to these Terms or your use of the Service, whether in contract, tort (including negligence), statute, or otherwise, will not exceed (a) for users on a paid plan, the total fees paid for your Formstep Subscription and AI credit purchases through Polar as Merchant of Record during the twelve (12) months immediately preceding the event giving rise to the liability; or (b) for users on a free plan, one hundred euros (EUR 100). Any platform fee that Formstep may charge on respondent payments is treated as fees paid to Formstep for the purposes of calculating the cap in clause (a). The cap in clause (b) does not apply to liability that cannot be limited under mandatory Norwegian or EU consumer protection law, including liability towards a consumer for damage caused by Formstep’s gross negligence, wilful misconduct, or a personal data breach attributable to Formstep, or liability to any data subject under Article 82 GDPR. Formstep is not liable for any failure or delay in performance caused by events beyond its reasonable control, including acts of God, natural disasters, war, terrorism, civil unrest, labour disputes, governmental action, internet or telecommunications failures, power outages, or failures of third-party infrastructure or services (“Force Majeure”). Nothing in this section limits or excludes liability that cannot be limited or excluded under mandatory law, including liability for death or personal injury caused by negligence, fraud, fraudulent misrepresentation, gross negligence, wilful misconduct, or a personal data breach attributable to Formstep, or liability owed to you as a consumer under mandatory Norwegian or EU consumer protection law. ## 26. Indemnification To the extent permitted by applicable law, you agree to defend, indemnify, and hold harmless Formstep and its officers, employees, contractors, and agents from and against any third-party claims, demands, actions, losses, damages, liabilities, costs, and expenses (including reasonable legal fees) arising out of or relating to: - Your Content, including any claim that Your Content infringes third-party rights, violates law, or causes harm to a respondent or other person; - Your use of the Service in breach of these Terms or applicable law; - Your violation of any rights of a third party, including privacy, intellectual property, or contractual rights; or - Your responsibilities as a data controller for submissions you collect through the Service. This indemnity does not apply to the extent the claim arises from Formstep’s own negligence, wilful misconduct, or breach of these Terms. If you are a consumer, this section applies only to the extent permitted by mandatory consumer protection law, and nothing in this section limits your statutory rights. Formstep will notify you of any claim for which it seeks indemnification. ## 27. Governing Law and Dispute Resolution These Terms and any dispute or claim arising out of or in connection with them, their subject matter, or formation (including non-contractual disputes or claims) are governed by and construed in accordance with the laws of Norway, without regard to its conflict of laws principles. Subject to the mandatory consumer-protection carve-outs in this Section 27, the parties agree that the Oslo District Court (Oslo tingrett) has jurisdiction to settle any dispute arising out of or in connection with these Terms or the Service. If you are a consumer resident in the European Economic Area, the choice of law and forum above does not deprive you of the protection of mandatory consumer protection laws of the country in which you are habitually resident. You retain the right to bring proceedings against Formstep, and may be sued by Formstep, only in the courts of the country in which you are habitually resident. If you are a consumer resident outside the European Economic Area, mandatory consumer protections of the country in which you are habitually resident may also apply, in which case the choice of law and forum above does not override those protections to the extent they cannot lawfully be waived. Before initiating formal proceedings, you agree to first attempt to resolve any dispute informally by contacting Formstep at . Formstep is not obliged to participate in alternative dispute resolution before a consumer dispute resolution body, but will consider such requests in good faith. If you are a consumer resident in Norway, you may bring a complaint to the **Norwegian Consumer Authority** (Forbrukertilsynet, [forbrukertilsynet.no](https://www.forbrukertilsynet.no)) or the **Norwegian Consumer Council** (Forbrukerrådet, [forbrukerradet.no](https://www.forbrukerradet.no)). If you are a consumer resident in the European Union, you may also contact the European Commission’s consumer redress portal (accessible at [consumer-redress.ec.europa.eu](https://consumer-redress.ec.europa.eu)) for guidance on dispute resolution options in your country. ## 28. General Provisions ### Changes to These Terms Formstep may update these Terms from time to time to reflect changes in the Service, legal or regulatory requirements, or business practices. For material changes, Formstep will give you reasonable advance notice before the changes take effect. Your continued use of the Service after the effective date constitutes your acceptance of the updated Terms. If you do not agree to the changes, you may terminate your account before they take effect, as described in [Section 22](#termination-by-you). ### Entire Agreement These Terms, together with the Privacy Policy and any other policies or supplemental terms expressly incorporated by reference, constitute the entire agreement between you and Formstep regarding the Service, and supersede any prior or contemporaneous agreements, communications, or proposals on the same subject matter. ### Severability If any provision of these Terms is held to be invalid, illegal, or unenforceable by a court of competent jurisdiction, that provision will be enforced to the maximum extent permissible and the remaining provisions will continue in full force and effect. ### No Waiver Formstep’s failure to enforce any right or provision of these Terms does not constitute a waiver of that right or provision. Any waiver must be in writing and signed by an authorised representative of Formstep to be effective. ### Assignment You may not assign, transfer, or delegate these Terms or any of your rights or obligations under them, in whole or in part, without Formstep’s prior written consent. Any attempted assignment in breach of this section is void. Formstep may freely assign or transfer these Terms, in whole or in part, including in connection with a merger, acquisition, reorganisation, sale of assets, or by operation of law, provided that the assignee is bound by these Terms and your rights under them are not materially diminished. If you are a consumer, Formstep will give you reasonable advance notice before such an assignment takes effect, and you may terminate your account if you do not accept the assignment. ### Notices Formstep will provide notices to you by email to the address associated with your account, through the Service interface, or by other reasonable means. You are responsible for keeping your contact information accurate and up to date. You must send legal notices to Formstep by email to , and such notices are deemed received on the earlier of acknowledgement by Formstep or three (3) business days after sending. ### Language These Terms are written in English, which governs in any conflict with a translation, except where mandatory consumer protection law requires otherwise. ## Related documents [Privacy Policy](https://formstep.io/docs/legal/privacy-policy/) — How we collect, use, and share personal data. [Data Processing Agreement](https://formstep.io/docs/legal/dpa/) — Terms for processing personal data on your behalf. [Legal overview](https://formstep.io/docs/legal/overview/) — Index of Formstep legal documents. # Privacy Policy How Formstep collects, uses, and protects personal data, for the people who build forms and the respondents who fill them in, and the rights you have. > **Last updated: 13 November 2026** > > This Privacy Policy explains how Formstep handles personal data for everyone who visits our website, uses the product, or submits a response to a form built on Formstep. If you have any questions, contact us at . ## 1. Introduction Formstep is a form builder. People use it to create surveys, applications, registrations, checkouts, and other interactive documents, and to collect responses from their audiences. Personal data flows through the Service in two distinct ways: data that Formstep collects about its own users (the people who build forms), and data that respondents submit through forms built by those users. This Privacy Policy describes both. We have tried to keep it short, plain, and honest. Where a section applies only to one group, we say so. Capitalized terms not defined here have the meanings set out in our [Terms of Service](https://formstep.io/docs/legal/terms-of-service/). For data protection roles, references to “you” in this policy correspond to the “Customer” (and, under the GDPR, the “Controller”) in our [Data Processing Agreement](https://formstep.io/docs/legal/dpa/). By using Formstep, you acknowledge that we process personal data as described in this policy. If you do not agree, do not use the Service. ## 2. Who We Are The Service is operated by **Formbase AS**, a Norwegian limited company with organisation number 937 921 217 and registered office in Oslo, Norway (“Formstep”, “we”, “us”, “our”). For the personal data we collect about users of the Service — such as your account, billing, and product usage data — Formstep is the data controller. For the personal data that respondents submit through your forms, **you** (the Formstep user who built the form) are the data controller, and Formstep acts as your data processor. The terms of that processing relationship are described in the [Data Processing Agreement](https://formstep.io/docs/legal/dpa/), which applies automatically to customers subject to the GDPR or equivalent regimes. This Privacy Policy still tells respondents what Formstep technically does with their data on your behalf, but it does not replace your own privacy notice. For questions, complaints, or data subject requests, contact us at . ## 3. Scope This Privacy Policy covers personal data that Formstep collects, uses, or shares when: - You visit **formstep.io** or any of its subdomains; - You sign up for, sign in to, or use **the Formstep application** at app.formstep.io; - You **submit a response** to a form that is hosted on Formstep or embedded on another website; - You **contact us** for support, sales, partnerships, or anything else; - You read or interact with our **marketing emails, social channels, or events**. It does not cover third-party websites, services, or integrations that we link to or that you choose to connect, even if they are reached from inside Formstep. Those services have their own privacy policies, and you should review them. ## 4. Personal Data We Collect We try to collect only what we need. The categories below describe the personal data we may handle in different parts of the Service. ### Account data When you create a Formstep account, we collect: - Your **email address**, used to sign in and receive system messages. - A **display name and avatar** if you set them, used to identify you to your collaborators. - Authentication data linked to **sign-in methods** you choose, such as magic-link login, Google sign-in, or anonymous guest sign-in for short-lived guest sessions. - **Workspace settings** you set up, including workspace name, timezone, and the list of members you have invited. Your email address is a contractual requirement for using the Service — it is the only data required to register, and without it we cannot create your account. Display name, avatar, and workspace settings are optional. ### Subscription and billing data Formstep subscriptions and AI credit purchases are sold through **Polar** (polar.sh), our payment provider and Merchant of Record. Polar collects and stores your payment details directly. Formstep receives only the limited information needed to provision your plan and credits, including: - A Polar customer identifier linking your Formstep account to your Polar customer record; - A Polar subscription identifier and the chosen billing interval (monthly or annual); - Subscription lifecycle timestamps such as the current period end, lapse, and grace-period markers used to apply your plan entitlements; - Order and credit-top-up identifiers used to provision AI credits. Formstep does not see or store payment card details, tax identifiers, or billing addresses — Polar holds those records directly, and you can access them through the Polar billing portal. Where you accept respondent payments through the Payment field, Stripe collects all card data directly; Formstep receives only non-sensitive references such as the last four digits. ### Form content you create The forms you build on Formstep — including questions, copy, media, conditional logic, and styling — are stored on our infrastructure so we can display them to respondents and let you edit them later. Form configuration is treated as Your Content under our [Terms of Service](https://formstep.io/docs/legal/terms-of-service/). ### Submission data from respondents When someone submits a response to one of your forms, we store on your behalf: - The **answers and uploads** the respondent provides, exactly as they entered them; - A **submission timestamp**, the respondent’s browser language, the workspace timezone (captured at submit), and identifiers that link the submission to your form; - **Drafts and partial submissions** saved server-side while the respondent fills the form, plus timestamps used to power abandoned-response reminders (when you enable them); - **Technical analytics signals** captured for every published form, including approximate country (derived from the respondent’s timezone or the Cloudflare edge `CF-IPCountry` header), device type, browser, traffic source, and engagement duration; - A **respondent-side visitor identifier** used to deduplicate form view and engagement counts — see [Cookies and Similar Storage](#cookies) for details; - Where you use the Payment field, a reference to the **Stripe payment** the respondent completed (the card data itself is handled by Stripe, not by Formstep); - For a **request** you send to one named recipient, their name and email address and the prefilled values, hidden context, metadata and documents you send with it, plus the history of its invitation, reminder and callback deliveries. Respondent IP addresses are processed transiently for rate limiting, Cloudflare Turnstile bot protection, and abuse prevention, and are not persisted alongside submissions. You decide what fields to include and which of these technical signals to capture. You are the data controller for submissions — see [Section 2](#who-we-are) for data protection roles. Form submissions may include special categories of personal data under Article 9 GDPR — such as health information, political opinions, or biometric data — depending on the questions you ask. As the controller, you are responsible for establishing a valid legal basis under Article 9(2) GDPR before collecting such data and for making any required disclosures to respondents. ### Product usage and device data When you use the Formstep application, we automatically collect: - **Activity logs** such as which pages you load, what features you use, and when, used to operate the product, debug issues, and understand which features matter. - **Device and browser data** such as user-agent, screen size, operating system, language, and approximate location derived from IP. - **IP address**, used to deliver the Service, detect abuse, rate-limit, and meet security obligations. - **Diagnostic data** such as error reports and performance traces when the application encounters a problem, used to diagnose and fix the issue. ### Cookies and similar technologies We use cookies and similar storage mechanisms to keep you signed in, remember your workspace and preferences, and secure the application. On our website and in the Formstep app, where the law asks us to ask first, analytics cookies are set and your visits recorded only if you accept in the cookie banner on our website; elsewhere they are set until you decline. The partner referral cookies on our website follow the same choice. See [Cookies and Similar Storage](#cookies) for details and the choices you have. ### AI feature data When you use AI Features — such as AI-assisted form building or AI chat for analysing submissions — we process: - The **prompts** you send to the AI; - The **context** the feature passes alongside the prompt, such as the structure of the form you are editing or submission data you explicitly share; - The **outputs** the AI returns; - **Credit consumption metadata**, so we can show your remaining balance and deduct usage correctly. These inputs and outputs are sent to Amazon Bedrock, which runs Claude models made by Anthropic, to generate the response. We may add or change providers over time and will update this Privacy Policy and the subprocessor list in the [Data Processing Agreement](https://formstep.io/docs/legal/dpa/) accordingly. See [AI Features](#ai) below for the contractual protections we have in place. ### Support and communications data When you email us, fill out a contact form, or chat with us, we keep the contents of the conversation, the contact details you provide, and any context needed to assist you. Recordings and transcripts of demo calls, if applicable, are stored only with your prior consent. ### Where this data comes from Most personal data comes directly from you. Some is received from Google (sign-in profile), Polar (billing metadata), Stripe (transaction references, not card data), or derived from your IP address (approximate country for analytics). ## 5. How We Use Personal Data We use personal data for the following purposes, and only when one of the legal bases in [Section 6](#legal-bases) applies. | Purpose | What this means in practice | | - | - | | Provide the Service | Run Formstep, show your forms to respondents, store submissions, send notifications, run integrations you enable, and apply your settings. | | Manage your account | Create your account, authenticate you, route you to the right workspace, manage roles and permissions, and apply plan entitlements. | | Process payments | Provision Pro features, top up AI credits, reconcile invoices issued by Polar, and handle billing support requests. | | Operate AI Features | Send the prompts and context you submit to our LLM subprocessors, return their outputs to you, and meter your AI credit usage. | | Secure the Service | Detect and prevent abuse, fraud, spam, account takeover, and other attacks, and investigate incidents when they occur. | | Support you | Respond to your questions, debug issues you report, and keep a record of the conversation so we can follow up. | | Improve the product | Understand which features are used, how the product performs, and where it breaks, so we can make it better. We rely on aggregated and de-identified data wherever possible. | | Communicate with you | Send system emails (account, billing, security) and service announcements. | | Comply with law | Meet our legal obligations, respond to lawful requests from authorities, exercise or defend legal claims, and enforce our Terms. | We do **not** sell personal data, and we do not share personal data with advertisers or data brokers for advertising purposes. For AI data-handling and no-training commitments, see [Section 13](#ai). ## 6. Legal Bases for Processing If you are in the European Economic Area, the United Kingdom, Switzerland, or another jurisdiction with a similar regime, we process personal data only when one of the following legal bases under the GDPR applies: - **Contract** (Article 6(1)(b)) — providing the Service, managing your account, processing payments, operating AI Features, and providing support. - **Legitimate interests** (Article 6(1)(f)) — where our interest does not override your rights. Specifically: - _Securing the Service_ — our interest in keeping Formstep and its users safe from abuse, fraud, and attacks. - _Improving the product_ — our interest in understanding how Formstep is used so we can make it better, relying on aggregated and de-identified data wherever possible, and in finding and fixing faults. This covers the product steps and error reports described in [Cookies and Similar Storage](#cookies). - _Service communications_ — our interest in telling you about changes to features you already use. - _Counting visits_ — our interest in knowing how many people visit our website and the Formstep app and which pages they view, measured without cookies as described in [Cookies and Similar Storage](#cookies). - _Understanding how our website and app are used_ — outside the regions where we ask first, our interest in seeing how visitors use our website and how people use the Formstep app, through analytics cookies and session recordings, as described in [Cookies and Similar Storage](#cookies). You can object at any time through Cookie settings in the website footer. - _Crediting partners who refer customers_ — outside the regions where we ask first, our interest in paying the partners in our affiliate program for the customers they refer, through the referral cookie described in [Cookies and Similar Storage](#cookies). You can object at any time through Cookie settings in the website footer. - **Consent** (Article 6(1)(a)) — analytics cookies and session recordings on our website and in the Formstep app, and the partner referral cookie on our website, for visitors in the regions where we ask first, and optional product data sharing. You can withdraw consent at any time, for example through Cookie settings in the website footer. - **Legal obligation** (Article 6(1)(c)) — tax, accounting, sanctions, and other legal obligations. - **Vital interests** (Article 6(1)(d)) — only in rare cases to protect someone’s life or physical safety. Where we rely on legitimate interests, you have the right to object, and we will reconsider on the basis of your specific situation. ## 7. How We Share Personal Data We share personal data only when one of the following applies. ### With subprocessors that help us run Formstep We rely on a small set of trusted third-party providers to deliver the Service. They process personal data only as needed to provide their part of the Service, under contracts that require appropriate confidentiality and security measures. The core subprocessors include: - **Convex** — application database and backend. - **Cloudflare R2** — object storage for file uploads and signatures. - **Cloudflare** — CDN, DNS, edge security, custom hostnames, and Turnstile bot protection. - **Polar** — subscription billing and AI credit purchases (Merchant of Record; independent controller for buyer billing data). - **Stripe** — respondent payment processing via Stripe Connect (independent controller for payment data). - **Amazon Web Services (AWS)** — Amazon Bedrock for AI Features; Amazon SES for transactional and system emails, including abandoned-response reminders on Pro workspaces. - **Axiom** — operational logs and monitoring. - **PostHog** — analytics and error reports for our website and the Formstep app, and account sign-ups. - **Affonso** — our affiliate program: records which partner referred a visitor and credits that partner when the visitor subscribes. - **Unsplash** — image search API; selected images are stored in Cloudflare R2 and served from there. The authoritative, up-to-date list of subprocessors, along with the categories of data each one processes and the regions in which they operate, is maintained in our [Data Processing Agreement](https://formstep.io/docs/legal/dpa/). ### With integrations you connect When you connect a third-party service to Formstep — such as a webhook endpoint, automation platform, spreadsheet, messaging tool, or CRM — you authorise us to send the relevant data to that service on your behalf. We share only what is needed for the integration to work, and the third party becomes responsible for the data once it receives it under its own terms and privacy policy. ### With AI assistants you connect You can connect an AI assistant, such as ChatGPT or Claude, to Formstep through our MCP server. You sign in, choose one workspace and approve the connection. When the assistant then calls a Formstep tool, we return what that tool reads to the assistant, on your instructions. Depending on what you ask, this can include form content, recipients’ names and email addresses, request details, submission answers, request activity, and analytics about form visitors such as device, browser, country and traffic source. The company that provides the assistant handles that data under its own terms and privacy policy, and Formstep does not control what it does with it. You can revoke a connection at any time from Connected apps & API Keys, which stops further access but does not delete what the assistant has already received. ### With your collaborators If you invite people to your workspace, they will see your name, email, role, and the forms and submissions they have permission to access. Workspace owners can change member access and request ownership reassignment through support; the available workspace roles are described in [Section 5 of the Terms of Service](https://formstep.io/docs/legal/terms-of-service/#workspaces). ### For legal and safety reasons We may disclose personal data when we believe in good faith that disclosure is necessary to (a) comply with applicable law or a binding order from a competent authority, (b) enforce our [Terms of Service](https://formstep.io/docs/legal/terms-of-service/), (c) detect, prevent, or address fraud, security, or technical issues, or (d) protect the rights, property, or safety of Formstep, our users, respondents, or the public. ### In a business transfer If Formstep is involved in a merger, acquisition, reorganisation, sale of assets, or insolvency, personal data may be transferred to the relevant counterparties as part of that transaction. Any such transfer will be subject to applicable data protection law. ## 8. International Data Transfers Formstep is based in Norway, and we aim to minimise transfers outside the European Economic Area. Some of our subprocessors are located in, or transfer data to, jurisdictions outside the EEA, including the United States and the United Kingdom. When personal data leaves the EEA, we rely on Standard Contractual Clauses (SCCs) adopted under Decision (EU) 2021/914, the UK International Data Transfer Addendum, the Swiss FDPIC addendum, adequacy decisions, or the EU–US Data Privacy Framework (DPF), as applicable. We also apply encryption in transit and at rest, restricted access, and contractual data minimisation. The applicable transfer mechanism for each subprocessor is detailed in our [Data Processing Agreement](https://formstep.io/docs/legal/dpa/#international-transfers). ## 9. Data Retention We keep personal data only as long as we need it for the purposes described in this policy and as required by law. - **Account data** is kept while your account is active. When you ask us to delete your account, account records are removed from active systems shortly after the request is processed and remain in backups only until the corresponding backup window expires. - **Form configuration and submissions** are kept while your workspace exists and you have not deleted them. Cancelling a Pro subscription moves you to the free tier; only **closing your account** triggers deletion. You can also configure a per-form submission retention period; submissions are automatically removed by a scheduled cleanup job when that period elapses. - **Requests** — the recipient’s name and email address and what you sent with the request — follow the same rules. A pending request ends at its expiry. One that expired or was canceled without an answer is deleted after the same period as draft submissions, 30 days by default, counted from when it ended. A completed one is kept until you delete it, delete its submission, or the form’s retention period passes, and then it is deleted with its submission. - **Draft submissions** that a respondent starts but does not submit are purged after 30 days, unless you have configured a different retention. - **Trashed forms** that you have moved to trash are permanently purged after 30 days. - **Anonymous (guest) sessions** created when you try Formstep without an account are purged automatically after 1 day. - **Form analytics** — page and question views are kept for up to 365 days. - **Delivery logs** — records of submission processing are kept for 30 days after they finish, and records of notifications for 90 days. Integration event logs are kept for 90 days. - **Connected assistants and apps** — an access or refresh token’s record is deleted 7 days after it expires. Revoking a connection stops access straight away. - **Billing records** are kept for the period required by applicable accounting and tax law. Polar, as Merchant of Record, retains its own billing records under its own retention policy. - **Support communications** sent to or from the Formstep support inbox are kept as long as needed to resolve your request and handle any related legal claims. - **Product usage and device data** — activity logs, device metadata, and diagnostics are retained in identifiable form for a limited period and then deleted or aggregated so that individual users can no longer be identified. - **Operational and security logs** generated by the Service are kept for the period needed to operate, debug, and secure the Service. Where a specific incident requires a longer period, we restrict access and delete the logs as soon as the obligation expires. - **Backups** are created on a regular schedule with a short retention window. File uploads stored in Cloudflare R2 are not covered by object versioning; deletions of file uploads are unrecoverable immediately. Personal data deleted from production becomes unrecoverable once the corresponding backup window expires. - **AI prompts and outputs** sent to Amazon Bedrock are not stored by AWS after the request is processed and are not used to train any models, as described in the [AWS Service Terms](https://aws.amazon.com/service-terms/). If law requires us to keep a record for longer — for example to meet a tax, anti-money-laundering, or court-order obligation — we restrict access to that record and delete it as soon as the obligation expires. ## 10. Security We apply technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, and unauthorised access. These measures include: - Encryption of personal data **in transit** using TLS 1.2 or higher, and **at rest** using industry-standard algorithms; - **Access controls** based on least privilege, with internal access to production systems restricted on a need-to-know basis; - **Logging and monitoring** of administrative actions in production systems; - **Network segmentation** and isolation of production from development environments; - **Vulnerability management**, including timely application of security updates and a responsible disclosure channel at ; - **Access controls** limiting production access to authorised personnel. No system is perfectly secure. If you become aware of a vulnerability or a possible compromise, report it to . ## 11. Your Rights Depending on where you live, you may have the following rights over the personal data we hold about you. Many of these are guaranteed under the GDPR, the UK GDPR, and equivalent laws in other jurisdictions. - **Right of access** — ask for a copy of the personal data we hold about you and information about how it is processed. - **Right to rectification** — ask us to correct inaccurate or incomplete data. - **Right to erasure** — ask us to delete personal data when there is no overriding reason to keep it. You can also close your account and delete most of your data yourself from the product. - **Right to restriction** — ask us to pause processing in certain situations, for example while we check a correction or objection. - **Right to data portability** — receive your personal data in a structured, commonly used, machine-readable format, or have it sent to another controller. The export feature in the application covers most of this for forms and submissions, with CSV and Excel (XLSX) output. - **Right to object** — object to processing based on legitimate interests, including profiling, and to direct marketing at any time. - **Right to withdraw consent** — where we rely on your consent, you can withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing before withdrawal. - **Right not to be subject to a decision based solely on automated processing** (Article 22 GDPR) — we do not make decisions about you that produce legal or similarly significant effects through solely automated processing, including profiling. To exercise any of these rights, email or use the self-service options in the application where available. We will respond within one month, or tell you why we need more time. We may ask for information to verify your identity before acting on a request, especially for access or deletion. If you are unhappy with how we have handled your data, you can lodge a complaint with a supervisory authority — for users in Norway, the **Norwegian Data Protection Authority** (Datatilsynet, [datatilsynet.no](https://datatilsynet.no)). You can also complain to the authority in the EEA country where you live or work. ### Rights of respondents If you are a respondent who submitted a form built on Formstep, your data subject rights run primarily against the Formstep user who built that form — they are the data controller. We can help you reach them, and we will support them in responding to your request. Where we hold the underlying data as a processor on their behalf, we will act on their documented instructions. To contact us, write to and tell us which form you submitted (the URL is usually enough). ## 12. Cookies and Similar Storage We use a small number of cookies, `localStorage`, and `sessionStorage` entries to make Formstep work and to deduplicate analytics on your forms. We try to keep the list short. - **Strictly necessary** — keep you signed in, remember the workspace you last used, secure the application against cross-site request forgery, and store essential preferences. These cannot be disabled without breaking the product. - **Functional** — remember UI preferences such as theme, sidebar state, and language. You can clear them from your browser. - **Analytics on our website (formstep.io) and in the Formstep app (app.formstep.io)** — PostHog, our analytics provider, can count a visit without storing anything on your device. Its servers combine your IP address and browser user agent with a random value that changes every day and is then deleted, so a visit can’t be linked to your visits on other days. If you visit from the European Economic Area, the United Kingdom and its Crown dependencies, Gibraltar, Switzerland, Turkey or Quebec, or from a location we can’t determine, we ask first: only if you accept in the cookie banner does PostHog also set a cookie (`ph_*_posthog`) and `localStorage` entries that identify your browser, and record your visits as session replays. Everywhere else, PostHog sets that cookie and records session replays from your first page, unless your browser sends a Global Privacy Control signal. We tell the regions apart by the country our hosting provider, Cloudflare, derives from your IP address. Session replays hide what you type into fields. Your choice is stored in a cookie (`fs_analytics_consent`) so we don’t ask on every page. You can change it at any time through **Cookie settings** in the website footer; declining or withdrawing deletes what PostHog stored, and your visits are then counted without cookies. The cookie that holds your choice, and PostHog’s cookie, are set for formstep.io and its subdomains, so the same choice applies in the Formstep app, which has no banner of its own: there PostHog sets its cookie and records your use only if you accepted on our website, or if you are outside the regions where we ask first and have not declined. Once you sign in, your use of the app is linked to your account identifier; we do not send PostHog your name or email address. Session replays of the app after you sign in show Formstep’s own interface, such as its buttons, menus and headings, with the layout of the screen and where you click. They hide everything else: text is masked unless it is one of Formstep’s own labels, the form you are editing, every table and the places that show your respondents’ answers or details are masked whole, and images are left out, so replays do not show the wording of your forms, your respondents’ answers or their contact details. A click is recorded with the label of the button you pressed when that label is Formstep’s own. Replays of the guest editor, where you try Formstep without an account, show the screen as you see it, including the form you build there and what you write to the AI assistant; they leave out images, what you type into fields, and the answers you give to the demo request. - **Product steps and error reports in the Formstep app** — these use no cookies and store nothing on your device, so they do not depend on the choice above. When you have an account, our servers tell PostHog when you take one of a few steps: your first workspace is set up, you create a form, edit a form for the first time, publish a form, or create a request. Each is recorded against your account identifier with the identifier of the record and how the step was taken (in the app, or through the API or MCP), and never with the content of a form or anything about your respondents. When the app fails, it sends PostHog an error report: the kind of error, where in our code it happened and, for a request our servers refused, the server’s error code. Text an error message quotes is removed before the report is sent. We use both to find where people get stuck and to fix faults; to object, write to . - **Partner referrals on our website (formstep.io)** — when you arrive through a link from a partner in our affiliate program, Affonso, our affiliate provider, records the visit for that partner and stores the referral in cookies (`affonso_referral`, and `affonso_data` with details about the partner) for 30 days. The cookies are set for formstep.io and its subdomains, so the Formstep app reads the referral when you subscribe: we then apply the partner’s offer, if there is one, and pay the partner a commission, and the partner learns that their referral became a customer. The cookies follow your analytics choice above: where we ask first, or when your browser sends a Global Privacy Control signal, they are set only if you accept, and until then Affonso records only that a partner’s link was used, without storing anything on your device: a click identifier (`affonso_id`) in the page address carries the visit from page to page instead. Declining or withdrawing deletes the cookies and removes the identifier from the address. - **Analytics on hosted form pages** — a random visitor identifier (`fs_visitor_id`) in `localStorage`, plus short-lived `sessionStorage` flags (`fs_viewed`, `fs_engaged`), used to deduplicate view and engagement counts. This storage is not needed for the form to function and does not enable advertising, cross-site tracking, or profiling. Formstep places this storage as a data processor on your instructions as controller. If your respondents are in jurisdictions where prior consent is required for non-essential storage (such as the EEA under the ePrivacy Directive or Norway under Ekomloven § 3-15), you are responsible for obtaining that consent before the form page loads. We do not use cookies or similar storage to track respondents across other websites for advertising, and we do not place advertising cookies on hosted form pages. You can clear cookies, `localStorage`, and `sessionStorage` through your browser settings. Blocking strictly necessary cookies or storage may prevent parts of the Service from working. If you build forms on Formstep, your hosted forms will set `fs_visitor_id` in `localStorage` on respondent devices as described above. You should disclose this in your own privacy notice to respondents. ## 13. AI Features Prompts and context you submit through Formstep AI Features are sent to Amazon Bedrock, which runs Claude models made by Anthropic inside the EU. Formstep’s own accounts, including forms Formstep itself publishes, and its test environments may instead use Anthropic’s API, which can process data outside the EU, keeps it for up to 30 days and does not use it to train models. Customer workspaces always run on Amazon Bedrock. Context includes, where applicable, the structure of the form you are editing and submission samples you explicitly share for analysis or summarisation. We configure it so that, under the AWS Service Terms, inputs and outputs are not used to train any models and are not stored by AWS after the request is processed. Processing is in line with the security and data protection commitments in this Privacy Policy and the [Data Processing Agreement](https://formstep.io/docs/legal/dpa/). AI outputs are generated probabilistically and may be inaccurate, incomplete, or out of date. You are responsible for reviewing every AI-generated output before you rely on it, publish it, or send it to respondents. You should not submit personal data, secrets, or other sensitive information through AI Features unless you have a lawful basis to share that information with our subprocessors and have considered the risks. We do not control how providers respond to lawful government requests directed at them. ## 14. Children Formstep is not designed for children. You must be at least sixteen (16) years old to create a Formstep account, as described in our [Terms of Service](https://formstep.io/docs/legal/terms-of-service/). Formstep users may build forms intended for younger audiences. If you collect personal data from children through Formstep, you are responsible for obtaining any required parental or guardian consent and for handling that data in accordance with applicable law, including COPPA where relevant. [Section 6 of the Terms of Service](https://formstep.io/docs/legal/terms-of-service/#acceptable-use) lists sensitive data classes the Service is not designed for, and [Section 7](https://formstep.io/docs/legal/terms-of-service/#prohibited-uses) sets out prohibited uses, including content that exploits or endangers minors. We do not knowingly collect personal data from children under sixteen (16) (or under thirteen (13) where COPPA sets a lower threshold). If you believe we have inadvertently collected personal data from a child below the applicable age threshold without the required consent, contact us at and we will delete it without undue delay. ## 15. Communications We send two kinds of email: - **System emails** about your account, security, billing, and the forms you build. These are part of the Service and cannot be opted out of while your account is active. - **Service announcements** about changes to the product, policies, or features you rely on. We keep these to the minimum needed to keep you informed. ## 16. Notice for California Residents If you are a resident of California, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including the right to know what personal information we collect, the right to delete it, the right to correct inaccuracies, and the right to opt out of the “sale” or “sharing” of personal information. Formstep does not sell personal information and does not share personal information for cross-context behavioural advertising. Because no sale or sharing occurs, no “Do Not Sell or Share My Personal Information” link is required or provided. The categories of personal information we collect, purposes, and retention periods are described in [Section 4](#data-we-collect), [Section 5](#how-we-use), and [Section 9](#retention). We do not build behavioural profiles for advertising and do not use sensitive personal information for inferences or profiling. To exercise your rights — including the right to know, delete, correct, opt out, or limit sensitive personal information — write to . We will not discriminate against you for exercising any of these rights. ## 17. Changes to This Privacy Policy We may update this Privacy Policy from time to time to reflect changes to the Service, our subprocessors, applicable law, or business practices. The “Last updated” date at the top of this policy shows when it was most recently revised. If you continue to use the Service after a change takes effect, you accept the updated Privacy Policy. If you do not agree to a change, you can close your account before it takes effect. ## 18. Contact Us For privacy questions, data subject requests, or anything else related to this policy, contact us at: - **Privacy questions, data subject requests, and security reports** — Formstep has not appointed a Data Protection Officer. Our privacy team monitors the inbox and will route your request appropriately. ## Related documents [Terms of Service](https://formstep.io/docs/legal/terms-of-service/) — The rules that govern your use of Formstep. [Data Processing Agreement](https://formstep.io/docs/legal/dpa/) — Terms for processing personal data on your behalf. [Legal overview](https://formstep.io/docs/legal/overview/) — Index of Formstep legal documents. # Data Processing Agreement How Formstep processes personal data on your behalf under the GDPR and similar laws, with each party’s obligations, subprocessors, and security measures. > **Last updated: 13 November 2026** > > This Data Processing Agreement (“DPA”) forms part of the [Terms of Service](https://formstep.io/docs/legal/terms-of-service/) between you (the “Customer”) and Formstep (the “Processor”). It applies automatically whenever you use Formstep to collect, store, or otherwise process personal data of identifiable individuals subject to the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), the UK GDPR, the Norwegian Personal Data Act (personopplysningsloven), or another applicable data protection law that requires a written processing agreement. > > No signature is required. Your use of Formstep to process personal data constitutes acceptance of this DPA. ## 1. Parties This DPA is entered into between: - **Customer** — the natural or legal person who has accepted the Formstep [Terms of Service](https://formstep.io/docs/legal/terms-of-service/) and on whose behalf personal data is processed (acting as the “Controller”). - **Formstep** — Formbase AS, a Norwegian limited company with organisation number 937 921 217 and registered office in Oslo, Norway (acting as the “Processor”). Where the GDPR or another applicable law refers to the parties as “controller” and “processor”, or “data exporter” and “data importer”, those terms map to Customer and Formstep respectively for the purposes of this DPA. ## 2. Definitions Terms used in this DPA but not defined here have the meanings given in the [Terms of Service](https://formstep.io/docs/legal/terms-of-service/) or in the GDPR. In particular: - **Service** — the Formstep platform, including the form editor, published forms, submission management, integrations, AI Features, APIs, and all related functionality provided under the [Terms of Service](https://formstep.io/docs/legal/terms-of-service/). - **Form** — an online form, survey, quiz, or other data-collection page created and published by Customer through the Service. - **Submission** — a completed or partial response submitted by a Data Subject through a Form, including all field values, file uploads, metadata, and associated timestamps. - **Workspace** — the organisational unit within the Service under which Customer manages Forms, Submissions, members, and integrations. - **AI Features** — the AI-powered capabilities of the Service, including AI form generation, AI chat, and any other feature that sends data to a third-party AI model for inference. - **Personal Data** — any information relating to an identified or identifiable natural person, as defined in Article 4(1) GDPR, that Customer processes through the Service. - **Processing** — any operation performed on Personal Data, as defined in Article 4(2) GDPR. - **Data Subject** — the identifiable individual to whom Personal Data relates, including respondents who submit Forms, members of a Workspace, and Customer’s own end users. - **Subprocessor** — any third party engaged by Formstep to process Personal Data on its behalf in connection with the Service. - **Standard Contractual Clauses** or **SCCs** — the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Decision (EU) 2021/914, including the UK International Data Transfer Addendum where relevant. - **Applicable Data Protection Law** — the GDPR, the UK GDPR, the Norwegian Personal Data Act, and any other privacy or data protection law that applies to Customer’s processing of Personal Data through the Service. ## 3. Scope and Roles This DPA governs Formstep’s Processing of Personal Data on behalf of Customer through the Service. For that Processing: - Customer is the **Controller**. Customer determines the purposes and means of the Processing, decides what Personal Data to collect through Forms, configures retention and sharing settings, and connects integrations. - Formstep is the **Processor**. Formstep processes Personal Data on Customer’s documented instructions, primarily to operate the Service, deliver the features Customer has enabled, and meet its security and support obligations. For Personal Data that Formstep collects directly about Customer as a Formstep user — such as account details, subscription metadata received from Polar, and product usage telemetry — Formstep acts as an independent **Controller**. That Processing is governed by the [Privacy Policy](https://formstep.io/docs/legal/privacy-policy/), not by this DPA. Payment and buyer billing data is controlled by Polar, which acts as an independent controller as Merchant of Record. For respondent payments processed through Stripe Connect, Customer is the merchant of record and Controller of the payment-related Personal Data; Stripe acts as an independent controller for payment processing. See [Annex 1](#annex-1) for details. ## 4. Subject Matter, Nature, Purpose and Duration Formstep processes Personal Data only as needed to provide the Service to Customer under the Terms of Service. - **Subject matter** — the hosting and operation of online forms, the collection and storage of Submissions, and the provision of related features such as analytics, integrations, AI Features, notifications, and exports. - **Nature** — collection, storage, and all technical operations required to run the Service. - **Purpose** — to enable Customer to build and publish Forms, collect responses from Data Subjects, manage Submissions, and connect to third-party tools, all in accordance with Customer’s configuration and instructions. Customer’s instructions may be given through the web application, the API, MCP (Model Context Protocol) connections, or other programmatic interfaces made available as part of the Service. - **Duration** — for as long as Customer’s account is active and Personal Data is stored in the Service, plus any limited retention period set out in [Section 12](#return-deletion). ## 5. Categories of Data Subjects and Personal Data ### Categories of Data Subjects Personal Data processed under this DPA may relate to: - Respondents who submit Customer’s Forms; - Customer’s Workspace owners and members; - Customer’s contacts, leads, or end users whose data Customer imports or routes through integrations; - Any other Data Subjects whose data Customer chooses to process through the Service. ### Categories of Personal Data Customer decides what Personal Data to collect. The categories typically include: - **Identification data** — names, email addresses, phone numbers, postal addresses. - **Form responses** — free-text answers, choices, ratings, file uploads, signatures, payment transaction references, and any other content Data Subjects enter. - **Draft and partial responses** — submission drafts and partial responses saved server-side while a Data Subject is filling a Form, together with the timestamps used to power abandoned-response reminders where Customer has enabled that feature. - **Request data** — for a Request sent to one named recipient, the recipient’s name and email address, and the values Customer sends with it: prefilled answers, hidden-field context, metadata and documents for that recipient, together with the invitation, reminder and callback history. - **Profile and account data** — Workspace member emails, display names, role and permission settings. - **Technical data** — timestamps, approximate country, device type, browser metadata, traffic source, and engagement duration captured as part of Submissions or analytics events; visitor identifiers stored client-side to deduplicate form view and engagement counts. - **IP addresses and security logs** — IP addresses are processed transiently at the edge (Cloudflare) for rate limiting, bot protection through Cloudflare Turnstile, and abuse prevention. IP addresses are not persisted alongside Submission content in Formstep’s primary database. Short-lived security and abuse logs may retain IP addresses for the limited period needed to operate those defences. - **Integration data** — identifiers, tokens, and payloads exchanged with third-party services that Customer connects. - **AI input/output** — prompts, form structure, and Submission samples that Customer explicitly passes as context, plus the generated outputs, where Customer uses AI Features. Formstep is not designed for, and Customer must not submit, special categories of data under Article 9 GDPR, criminal-conviction data under Article 10 GDPR, government identifiers used for primary identity proofing, payment card data outside the Payment field, or other regulated data classes listed in [Section 6 of the Terms of Service](https://formstep.io/docs/legal/terms-of-service/#acceptable-use), unless Formstep has agreed otherwise in writing. If Formstep becomes aware that Customer has submitted prohibited data classes, Formstep may notify Customer and delete the data. Customer is responsible as Controller for ensuring a valid legal basis for all Personal Data submitted to the Service. ## 6. Customer Obligations Customer is responsible for its role as Controller. In particular, Customer: - Determines a lawful basis under Article 6 GDPR (and, where applicable, Article 9 GDPR) for each Processing activity carried out through the Service; - Provides Data Subjects with all required notices, including a privacy notice covering Customer’s use of Formstep, and obtains any required consent; - Respects Data Subject rights under Articles 15–22 GDPR for the Personal Data Customer processes; - Sets up the Service appropriately, including retention rules, sharing settings, integrations, and access controls; - Does not upload Personal Data the Service is not designed for, as set out in [Section 5](#categories) and [Section 6 of the Terms of Service](https://formstep.io/docs/legal/terms-of-service/#acceptable-use); - Keeps Workspace member access lists, API keys, OAuth credentials, and MCP tokens up to date and revokes them when no longer needed; - Documents its own Processing activities under Article 30 GDPR and carries out data protection impact assessments where required under Article 35 GDPR. Customer warrants that it has the right to give Formstep the instructions set out in this DPA and that all Personal Data has been collected and shared with Formstep lawfully. ## 7. Formstep’s Obligations ### Documented instructions Formstep processes Personal Data only on Customer’s documented instructions, including transfers of Personal Data outside the European Economic Area, unless required to do otherwise by Union or Member State law. Customer’s instructions are set out in this DPA, in the Terms of Service, in the configuration of the Service, and in any further written instructions Customer may give from time to time. Formstep does not process Personal Data for its own marketing purposes, profiling, or any purpose beyond providing and securing the Service as instructed by Customer. If Formstep believes an instruction infringes Applicable Data Protection Law, it will inform Customer and not carry out the instruction. ### Confidentiality Formstep ensures that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Access to Personal Data is limited to personnel who need it to perform their duties. ### Security measures Formstep implements appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing. The current measures are described in [Annex 2](#annex-2). ### Assistance Taking into account the nature of the Processing and the information available to it, Formstep will assist Customer, by appropriate technical and organisational measures, in fulfilling its obligations to: - Respond to Data Subject requests under Articles 15–22 GDPR (see [Section 8](#data-subjects-rights)); - Maintain the security of Processing (Article 32 GDPR); - Notify Personal Data breaches (Article 33 GDPR) — see [Section 11](#breach); - Communicate breaches to Data Subjects where required (Article 34 GDPR); - Carry out data protection impact assessments (Article 35 GDPR); and - Consult with supervisory authorities where required (Article 36 GDPR). Where this assistance materially exceeds what is available through standard product features, Formstep may charge a reasonable fee, confirmed with Customer in writing (including by email) before work begins. ## 8. Data Subject Rights The Service is designed so that Customer can respond to most Data Subject requests directly, without Formstep’s involvement. Customer can: - View, export, and delete Submissions from the Submissions area of any Form; - View and delete a single Request from the Requests area or the API, which deletes its Submission and the data Customer sent with it; - Set a per-Form retention period, after which Submissions and ended Requests are deleted automatically; - Export Workspace data, including Forms and Submissions, in CSV or Excel (XLSX) — these structured, machine-readable formats also satisfy Article 20 GDPR data portability requests; - Restrict or delete a Workspace member’s access; - Delete entire Forms, Workspaces, or the account, subject to the retention rules in the [Privacy Policy](https://formstep.io/docs/legal/privacy-policy/). Formstep does not carry out automated decision-making or profiling on Customer’s Personal Data within the meaning of Article 22 GDPR. If a Data Subject contacts Formstep directly with a request relating to Personal Data processed for Customer, Formstep will redirect the Data Subject to Customer where possible and will not respond on Customer’s behalf. ## 9. Subprocessors Customer authorises Formstep to engage the Subprocessors listed in [Annex 1](#annex-1) for the Processing of Personal Data. Formstep will: - Enter into a written agreement with each Subprocessor that imposes data protection obligations no less protective than those set out in this DPA, including, where applicable, the SCCs; - Remain fully liable to Customer for the performance of each Subprocessor’s data protection obligations, in accordance with Article 28(4) GDPR. Formstep will give Customer reasonable advance notice before a new Subprocessor begins Processing Personal Data. Customer may object to a new Subprocessor on reasonable, documented data protection grounds by writing to within a reasonable period. If Formstep cannot reasonably accommodate Customer’s objection, Customer may terminate the affected Processing. ## 10. International Transfers Formstep is established in Norway, which is part of the European Economic Area (EEA). No transfer safeguard is required for flows between Formstep and Customers located within the EEA. Several of Formstep’s Subprocessors are established in the United States or process Personal Data on infrastructure located outside the EEA or the United Kingdom. For each such international transfer, Formstep relies on one or more of the following safeguards: - An **adequacy decision** by the European Commission or a competent authority, where one exists for the destination country; - The **Standard Contractual Clauses** adopted by the European Commission in [Decision (EU) 2021/914](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0914) (as extended to the EEA by EEA Joint Committee Decision), incorporated by reference into this DPA, with the module that applies depending on the transfer in question (Module 2 — Controller to Processor — for Customer’s transfer to Formstep; Module 3 — Processor to Processor — for Formstep’s onward transfer to Subprocessors that act as processors). Where a Subprocessor (such as Polar or Stripe) collects billing or payment data **directly** from buyers or respondents as an independent controller, that collection is outside Formstep’s processor chain and the Subprocessor’s own transfer mechanisms apply between the data subject and the Subprocessor; - The **UK International Data Transfer Addendum** issued by the UK Information Commissioner (in force March 2022), where Personal Data is subject to the UK GDPR; - The **Standard Contractual Clauses** as recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC), with the Swiss-specific adaptations set out in the FDPIC’s guidance of 27 August 2021 (clarifying that references to “Member State” must not be interpreted to exclude Switzerland, designating the FDPIC as the competent supervisory authority, and extending the scope to cover personal data of legal entities), where Personal Data is subject to the Swiss Federal Act on Data Protection (nFADP); - The **EU–US Data Privacy Framework** (DPF), its UK extension, and the **Swiss–US Data Privacy Framework**, where the specific US-based Subprocessor is self-certified under the applicable framework (Formstep falls back to SCCs where certification is absent or lapses); and - **Supplementary technical and organisational measures** as described in [Annex 2](#annex-2). Where Formstep relies on SCCs for a transfer to a country without an adequacy decision, Formstep considers the legal framework in the destination country and applies the supplementary measures in [Annex 2](#annex-2) to address identified risks. Where SCCs are the applicable transfer safeguard, by accepting this DPA Customer is deemed to have signed the SCCs as the data exporter and Formstep signs them as the data importer. For the purposes of Annex I to the SCCs: (a) the parties are identified in [Section 1](#parties) of this DPA; (b) the description of the transfer — categories of data subjects, categories of personal data, frequency of transfer, nature and purpose of processing, and retention period — is set out in [Sections 4](#subject-matter) and [5](#categories) of this DPA; and (c) the competent supervisory authority is the Norwegian Data Protection Authority (Datatilsynet). This DPA thereby satisfies the Annex I requirements of the SCCs. The SCCs apply only to transfers that require them. In the event of a conflict between this DPA and the SCCs, the SCCs prevail to the extent of the conflict. ## 11. Personal Data Breaches Formstep will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer’s Personal Data. The notification will include, to the extent known at the time, the nature and scope of the breach, the likely consequences, and the measures Formstep has taken or proposes to take. Where complete information is not available at the time of the initial notification, Formstep will provide it in stages without undue delay. Customer is responsible for keeping its contact details up to date and for notifying its own Data Subjects and supervisory authorities where required. Notifying Customer is not, by itself, an admission by Formstep of fault or liability for any breach. ## 12. Return and Deletion of Data Customer can export Forms and Submissions in standard formats at any time while its account is active, as described in the [Terms of Service](https://formstep.io/docs/legal/terms-of-service/). On termination of the Service or written request by Customer, Formstep will delete all Personal Data Processed on Customer’s behalf, unless Union law, Member State law, or applicable Norwegian law requires further storage. Customer is responsible for exporting any data it wishes to keep before closing the account, using the in-product tools described in [Section 8](#data-subjects-rights). Specifically: - When a Form or Workspace is deleted from the Service, the underlying records are removed from active systems and become unreachable through the application; - When a Customer account is closed, the account’s Personal Data is removed from active systems. Customer is responsible for exporting any data it wishes to keep before closing the account; - Personal Data is removed from backups when the corresponding backup window expires. File uploads stored in Cloudflare R2 are not covered by object versioning; deletions of file uploads are unrecoverable immediately; - Draft and partial responses are retained for a limited period (or until the Data Subject completes the Submission), after which they are automatically purged from active systems. Requests that expired or were canceled without a Submission are purged on the same period, counted from when they ended; - Where Customer has set a retention period for a Form, Submissions and ended Requests are deleted from active systems once it passes; - Personal Data that Formstep is required to retain by law — such as billing records or records relating to a legal claim — will be archived in restricted-access systems for the period required by law. ## 13. Audits Formstep will make available to Customer all information reasonably necessary to demonstrate compliance with its obligations under Article 28 GDPR and this DPA, where Customer has justifiable grounds — such as a confirmed Personal Data Breach, a material breach of this DPA, or a request from a supervisory authority. By default, this information takes the form of: - This DPA and the [Privacy Policy](https://formstep.io/docs/legal/privacy-policy/) in Formstep’s documentation; - The list of Subprocessors in [Annex 1](#annex-1) and the technical and organisational measures described in [Annex 2](#annex-2); - Written responses to reasonable, specific questions sent to . Where a supervisory authority requires an on-site inspection, Formstep will cooperate to the extent required by law. ## 14. Liability The liability of each party under this DPA is subject to the limitations and exclusions set out in [Section 25 (Limitation of Liability)](https://formstep.io/docs/legal/terms-of-service/#limitation-of-liability) of the Terms of Service. The aggregate liability of Formstep under or in connection with this DPA forms part of, and is not in addition to, the overall liability cap set out in the Terms of Service. Notwithstanding the foregoing financial cap, nothing in this DPA limits any liability that cannot be limited under mandatory Applicable Data Protection Law, including liability towards a Data Subject under Article 82 GDPR. The Article 82 carve-out operates regardless of the aggregate cap in the Terms of Service. Formstep is not liable under Article 82 GDPR to the extent it demonstrates it is not in any way responsible for the event giving rise to the damage, in accordance with Article 82(3) GDPR. ## 15. Term and Termination This DPA enters into force when Customer first submits Personal Data to the Service, and no later than the date Customer accepts the Terms of Service. It remains in effect for as long as Formstep processes Personal Data on Customer’s behalf. This DPA terminates when the Terms of Service terminate, provided that it continues in force until Formstep has completed the return or deletion of all Personal Data pursuant to [Section 12](#return-deletion). The provisions of [Sections 5 (Categories)](#categories), [7 (Formstep’s Obligations)](#formstep-obligations) (including the confidentiality obligations therein), [9 (Subprocessors)](#subprocessors), [11 (Breach)](#breach), [12 (Return and Deletion)](#return-deletion), [13 (Audits)](#audits), [14 (Liability)](#liability), and [16 (Governing Law)](#governing-law) survive termination to the extent necessary to give effect to them. ## 16. Governing Law and Jurisdiction This DPA is governed by the laws of Norway, without regard to its conflict of laws principles. Any dispute arising out of or in connection with this DPA is subject to the same dispute resolution and jurisdiction terms as the Terms of Service, except where Applicable Data Protection Law mandates a different forum. Where the SCCs apply, the governing law and forum specified in the SCCs prevail to the extent of any conflict. ## 17. Updates to This DPA Formstep may update this DPA from time to time to reflect changes in the Service, in Applicable Data Protection Law, or in the supervisory authorities’ guidance. - **Non-material changes** (formatting, clarifications that do not alter obligations, updates to Annex 1 that follow the [Section 9](#subprocessors) notice process) take effect upon publication. - **Material changes** (any change that alters the scope of Processing, reduces the level of protection afforded to Personal Data, or modifies the parties’ obligations) take effect after reasonable advance notice. Continued use of the Service after the notice period constitutes acceptance. ## 18. Contact For any matter relating to this DPA, including data subject requests that cannot be handled through the Service, subprocessor objections, audit requests, or breach notifications, contact us at: - **DPA enquiries, data subject requests, and security reports** — Formstep has not appointed a Data Protection Officer. Under Article 37 GDPR, a DPO is required for public authorities and bodies (excluding courts), or where core activities consist of large-scale, regular, and systematic monitoring of individuals, or large-scale processing of special categories of data (Article 9) or criminal-conviction data (Article 10); Formstep’s core activities do not meet any of these thresholds. All DPA-related matters are handled through the contact point above. ## Annex 1 — Subprocessors Formstep engages the following parties in connection with the Service. Convex, Cloudflare R2, Cloudflare, Amazon Web Services (AWS), Axiom, and Unsplash act as data processors under Formstep’s instruction and are true subprocessors for purposes of Article 28 GDPR. Polar and Stripe are listed here for transparency, but they act as **independent controllers** for the data they collect directly from buyers and respondents respectively; Formstep’s Article 28 obligations do not apply to the data those parties control, and their own transfer mechanisms govern where applicable. Google provides optional OAuth sign-in: users authenticate directly with Google, which acts as an independent controller for the Google account; Formstep receives only the basic sign-in profile (name, email, profile picture). PostHog and Affonso are listed for transparency: Formstep uses them for analytics on its own website and app and for its affiliate program on its website and account sign-ups, as controller of that data, and they receive no Customer Personal Data. | Subprocessor | Purpose | Region | | - | - | - | | Convex | Application database and backend infrastructure (hosted on AWS in the eu-west-1 region in Ireland; AWS acts as Convex's infrastructure sub-processor). Convex, Inc. is established in the United States. | European Union (AWS eu-west-1, Ireland) | | Cloudflare R2 | Object storage for file uploads and signatures. Transfer mechanism: Module 3 SCCs under Cloudflare's Data Processing Addendum, supplemented by the measures in Annex 2. | European Union (Cloudflare EU jurisdiction). Cloudflare guarantees that the files are stored within the EU. | | Cloudflare | CDN, DNS, edge security, custom hostnames for hosted forms, Turnstile bot protection. Processes IP addresses transiently for bot protection and abuse prevention. | Global | | Polar | Subscription billing and AI credit purchases. Acts as Merchant of Record and as an independent controller for the buyer billing data it collects. | United States | | Stripe | Respondent payment processing via Stripe Connect (when Payment fields are used). Acts as an independent controller for payment processing. Customer, as the merchant of record for respondent payments, is responsible for ensuring an appropriate transfer mechanism between Customer and Stripe. | Global; region depends on Stripe's processing for the connected account | | Amazon Web Services (AWS) | Amazon Bedrock for AI inference behind AI Features (form building, AI chat, AI Validation, translations), running Claude models made by Anthropic. Anthropic does not receive Customer data. Processing governed by the AWS Service Terms; AWS does not store inputs or outputs after processing and does not use them to train any models. | European Union (Amazon Bedrock cross-region inference within the EU) | | Amazon Web Services (AWS) — Amazon SES | Delivery of all transactional and system email: submission notifications, respondent confirmation and notification emails, magic-link logins, abandoned-response reminder emails, and other account emails. Custom sending domains are verified as SES domain identities (DKIM). Processing governed by the AWS Data Processing Addendum (SCCs incorporated). | Same AWS region as Formstep's AI inference (see the Amazon Web Services entry above) | | Axiom | Operational logging and monitoring of the Service. Logs can contain account and record identifiers and the email addresses of email recipients, including respondents. Logs are kept for 30 days. Axiom, Inc. is established in the United States. | European Union (AWS eu-central-1, Frankfurt) | | PostHog | Analytics for Formstep's own website, app and account sign-ups, including session replays of website visits and of how account holders use the app. Replays of the signed-in app show Formstep's own interface text, such as its buttons and menus. All other text is masked, the places that show forms, Submissions and respondents' details are masked whole, and images are left out, so replays hold no Submissions or other Customer Personal Data. Also receives the product steps an account takes (such as creating or publishing a form), as record identifiers without content, and error reports from the app with the text an error message quotes removed. Receives Formstep account identifiers and visit data; no Customer Personal Data. PostHog, Inc. is established in the United States. | European Union (PostHog EU Cloud, AWS eu-central-1, Frankfurt) | | Affonso | Formstep's affiliate program: records visits that arrive through a partner's link and, through Formstep's Polar account, the subscriptions they lead to, so the partner is credited. Receives website visit data and the billing details of referred subscriptions; no Customer Personal Data. Affonso is operated by ZASolution, established in Germany. | European Union (Frankfurt, Germany) | | Unsplash | Image search API used server-side to find and retrieve form cover images. Selected images are fetched by Formstep at publish time and stored in Cloudflare R2; respondents load images from R2, not directly from Unsplash. Only image URLs and search queries are sent to Unsplash — no Customer Personal Data is transmitted. Transfer mechanism: SCCs under Unsplash's API terms. | United States / Global | **Customer-directed integrations.** When Customer enables an integration (Notion, Airtable, Google Sheets, Slack, Discord, Linear, GitHub, webhooks, etc.), Formstep transmits data to that service on Customer’s documented instruction. The third-party service is not a Formstep Subprocessor; Customer is responsible as Controller for ensuring a lawful basis, appropriate data processing agreements, and transfer mechanisms with each service it connects. If Formstep engages a new Subprocessor or adds a new LLM provider, [Annex 1](#annex-1) will be updated in accordance with [Section 9](#subprocessors). The contractual obligations Formstep imposes on each Subprocessor are set out in [Section 9](#subprocessors). ## Annex 2 — Technical and Organisational Measures Formstep implements the following technical and organisational measures to protect Personal Data, taking into account the state of the art, the cost of implementation, and the nature of the Processing. Specific measures may evolve over time, provided that the overall level of protection is not reduced. ### Access control - Role-based access controls within the Service, with workspace-level permissions for owners and members; - Passwordless authentication using magic-link email or Google OAuth sign-in (Customer-managed multi-factor authentication is available on the Google account used for sign-in), with rate limiting on the login endpoints; anonymous guest sessions (created when a user tries the Service without registering) are purged automatically within a short period; - Internal access to production systems restricted on a need-to-know basis. ### Encryption - TLS 1.2 or higher for all data in transit between Data Subjects, Customers, the Service, and Subprocessors; - Encryption at rest for the primary database, file storage, and backups, using industry-standard ciphers managed by Convex and the underlying cloud provider; - Secrets and API keys stored in encrypted secret stores; passwords are not stored — the Service uses passwordless authentication. ### Logical isolation - Multi-tenant architecture with row-level access scoping by Workspace and Customer; - Logical separation between development, staging, and production environments; production data is not used in non-production environments; - Subprocessor integrations are scoped to the minimum data required to perform their function. ### Resilience and backups - Automated, encrypted daily backups of the primary database (delegated to Convex under its infrastructure service terms); file uploads in Cloudflare R2 are not covered by object versioning; - Use of cloud providers with redundant infrastructure and DDoS protection. ### Vulnerability management - Security updates for application dependencies applied as appropriate. ### Organisational measures - Access to production systems is limited to authorised personnel; - Breach notification procedures aligned with [Section 11](#breach); - Maintenance of records of processing activities in accordance with Article 30(2) GDPR, made available to supervisory authorities on request as required by Article 30(4) GDPR. ### Supplementary measures for international transfers (Schrems II) In addition to the general security measures above, Formstep applies the following supplementary measures for transfers to countries without an adequacy decision, in line with EDPB Recommendations 01/2020: - Encryption in transit (TLS 1.2+) and at rest as described in the [Encryption](#encryption) section; encryption keys are managed by the cloud provider’s key management service and are not accessible to third-country government authorities without a lawful order. ### Data minimisation and retention - The Service collects only the data Customer chooses to collect through Forms and the operational data needed to run the Service. Retention and deletion rules are set out in [Section 12](#return-deletion); - Aggregation is applied to product analytics where the underlying identifiers are not needed for the purpose; - AI inputs and outputs sent to Amazon Bedrock are processed under the [AWS Service Terms](https://aws.amazon.com/service-terms/) and are not stored by AWS after processing. ## Related documents [Privacy Policy](https://formstep.io/docs/legal/privacy-policy/) — How we collect, use, and share personal data. [Terms of Service](https://formstep.io/docs/legal/terms-of-service/) — The rules that govern your use of Formstep. [Legal overview](https://formstep.io/docs/legal/overview/) — Index of Formstep legal documents. # Partner Terms Terms for partners in the Formstep affiliate program: how referrals are credited, how commission and payouts work, and how you may promote Formstep. > **Last updated: 31 October 2026** > > These terms apply to everyone who joins the Formstep partner program. Questions go to . ## 1. The Agreement These Partner Terms (“Partner Terms”) are an agreement between you and Formbase AS, a Norwegian limited company with organisation number 937 921 217 and registered office in Oslo, Norway (“Formstep”, “we”, “us”). You accept them when you create an account in the Formstep partner portal. If you join on behalf of a business, “you” means that business, and you confirm you may bind it. The partner portal is run for us by Affonso. Our [Terms of Service](https://formstep.io/docs/legal/terms-of-service/) still govern any use you make of Formstep itself. ## 2. Joining You must be at least 18 years old and able to receive payouts by one of the methods in [Section 5](#payouts). New partners are approved automatically. We may decline or remove any partner, at any time, including where we believe a partner’s audience or methods do not suit Formstep. ## 3. Your Link and Referrals The portal gives you a referral link. A visitor who arrives through it is credited to you for 30 days. If they click another partner’s link in that time, the last link clicked is credited. A referral counts only when the visitor subscribes to Formstep for the first time, on a plan that earns commission (see [Section 4](#commission)). A visitor who has subscribed to Formstep before, or who uses no referral link, is not a referral. Referral tracking relies on cookies. Where the law requires it, a visitor must accept those cookies first, so some visits through your link cannot be credited. Our records decide whether a subscription is credited to you. ## 4. Commission Commission is earned on Pro subscriptions with monthly billing. Annual plans, the Business plan, AI credit packs and other purchases earn no commission. For each referred customer you earn: - 20% of each payment for the first three months, while the customer has the partner discount (50% off Pro for three months); - 40% of each payment from month four to month twelve. Commission is calculated on the amount the customer actually pays, without tax. No commission is earned on payments made after the twelfth month, or after the customer cancels. We may change commission rates for the future by giving you at least 30 days’ notice. Customers you referred before the change keep the rates that applied when they subscribed for the rest of their twelve months. ## 5. Payouts - Each commission is held for 60 days after the customer’s payment, so refunds and chargebacks can settle first. - We pay monthly in US dollars, by Wise or bank transfer, once your approved balance reaches USD 50. A smaller balance carries over. - We may delay a payout while we review unusual activity, such as a sudden spike in referrals or signs of a breach of these Partner Terms. Commission that passes the review is paid with the next payout. - If a referred customer is refunded, the commission on that payment is cancelled, or deducted from a later payout if it was already paid. - For each chargeback, we deduct the commission plus a USD 15 fee from your future payouts. After two chargebacks we pause your account while we review it. - You must give accurate payout details. Fees charged by your bank or payment provider are yours. - You are responsible for reporting and paying your own taxes on commission. We may ask for an invoice or tax information before paying. ## 6. How You May Promote Formstep You must: - Disclose clearly, next to your link, that you earn a commission when someone subscribes; - Describe Formstep, its prices and the partner discount accurately, and make no promise we do not make; - Follow the advertising, consumer protection, privacy and anti-spam laws that apply to you and your audience. You may list Formstep and the partner discount on your own pages, including deal, perk and startup directories, as long as the listing links through your referral link and describes the offer accurately. You must not: - Bid on “Formstep”, “Formbase” or any close variant or misspelling in search or social ads, or use them in ad copy or display URLs; - Offer visitors cash, cashback, points or any other reward for clicking your link or subscribing; - Send unsolicited messages, or promote Formstep in spam, forums or comments where it is unwelcome; - Use forced clicks, hidden links, pop-unders, cookie stuffing or any method that credits you for a visitor who did not choose to click your link; - Refer yourself, your own company, or accounts you control; - Register domains, social handles or app names that contain “Formstep”, or present yourself as Formstep or as speaking for us; - Promote Formstep next to illegal, hateful, adult or deceptive content. If you break this section, we may cancel commission earned through the breach and end your partnership under [Section 9](#ending). ## 7. Our Brand and Marketing Kit While you are a partner, you may use the Formstep name, logos, screenshots, graphics and copy from our marketing kit to promote Formstep under these Partner Terms. Do not change the logos’ colours or shape, or combine them with your own marks. This permission ends when your partnership ends, and we may ask you to change or remove any material at any time. ## 8. Privacy You see the clicks, conversions and commission your link earns. You do not see who our customers are, and you must not try to identify them. We process your own personal data, such as your name, email and payout details, to run the program and pay you, as described in our [Privacy Policy](https://formstep.io/docs/legal/privacy-policy/). Affonso processes that data for us. ## 9. Ending the Partnership You may leave at any time by closing your partner account or writing to us. We may end your partnership at any time with notice, or at once if you break these Partner Terms. When a partnership ends without a breach, we pay the commission you earned before it ended, once its hold period has passed and the balance reaches the payout minimum. When we end it because of a breach, unpaid commission is cancelled. ## 10. Our Relationship You act as an independent partner. Nothing in these Partner Terms makes you our employee, agent or representative, and you may not make commitments on our behalf. The program is not exclusive: you may promote other products, and we may work with other partners. ## 11. Liability The partner program is provided as it is. We do not promise any level of referrals or earnings, or that tracking is always uninterrupted. To the extent the law allows, our total liability to you under these Partner Terms is limited to the commission paid to you in the twelve months before the claim. You are responsible for your own promotion and for any claims that arise from it. ## 12. Changes We may update these Partner Terms. For a material change, we email you at least 30 days before it takes effect. If you keep promoting Formstep after that, you accept the updated terms. ## 13. Governing Law Norwegian law governs these Partner Terms. The Oslo District Court (Oslo tingrett) has jurisdiction to settle any dispute arising out of or in connection with them. ## Related documents [Terms of Service](https://formstep.io/docs/legal/terms-of-service/) — Rules governing your access to and use of Formstep. [Privacy Policy](https://formstep.io/docs/legal/privacy-policy/) — How we collect, use, and share personal data. [Legal overview](https://formstep.io/docs/legal/overview/) — Index of Formstep legal documents.