Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between [to be confirmed] ("SOYL", "we") and the customer who creates forms with SOYL Forms("Creator", "you"). It applies whenever we process personal data on your behalf, and it is accepted when you accept the Terms. If the DPA and the Terms conflict on data protection, the DPA prevails.

1. Roles

For personal data of people who answer your forms ("Respondents") and of people named in their answers, you are the Data Fiduciary (you decide why and how the data is processed) and SOYL is your Data Processor under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000. For your own account data, SOYL is a Data Fiduciary and our Privacy Policy applies.

2. Subject matter and duration

The subject matter is hosting your forms and collecting, storing, displaying, exporting and sending responses as you configure. We process for as long as you use SOYL Forms, and afterwards only until deletion under section 10.

3. Nature and purpose

• Rendering your published forms and receiving submissions, uploaded files, signatures and payment confirmations.
• Storing responses and saved progress, and showing them to members of your workspace with the roles you assign.
• Sending the notifications, confirmation emails, webhooks and integrations you turn on.
• Bot protection, rate limiting, security monitoring, backups and support you ask for.

We do not sell Respondent data, use it for advertising, use it to train AI models, or send Respondent answers to any AI provider.

Vault forms (Security Plus). If your workspace uses the Security Plus add-on and you mark a form as a vault form, Respondents' answers, hidden fields and uploaded files are encrypted in their browser to your workspace's vault key before they reach us. For that content we store and transmit ciphertext only; we cannot read, search, analyse or recover it, and we cannot decrypt it for you, for a Respondent or for any authority. The encryption protects confidentiality, not authenticity: because Respondents are not identified and the vault public key is public, anyone with write access to our systems could add, delete or swap encrypted responses without being able to read them, and we do not claim otherwise. Changing the vault passphrase does not revoke a person who already knew it. The vault key's private half is held only in a form wrapped under your vault passphrase and under a recovery key that you keep; if you lose both, the encrypted content is permanently unreadable. We still process the response metadata that is not encrypted (form, time, duration, link source, tags, file count and size, the approximate length of the encrypted answers, and the technical data in section 4). The protection depends on the software we serve to browsers, which we operate under the safeguards in section 6.

4. Categories of data and data principals

• Data principals: Respondents, people named in responses, and your workspace members.
• Personal data: whatever your forms ask for — typically name, email, phone number, address, free-text answers, files, signatures and payment status — plus submission time, URL parameters you choose to collect, and technical data used for bot checks and rate limits (IP address, held only in keyed-hash or transient form).
• Sensitive data: you decide whether your forms collect health, financial, biometric, government identifier or children's data; you must have a lawful basis and the safeguards the law requires (see section 5).

5. Your obligations

You are responsible for giving Respondents a clear notice, obtaining valid consent or relying on another lawful ground, limiting collection to your stated purpose, obtaining verifiable parental consent before processing a child's data, honouring Respondents' requests, and making sure your instructions to us are lawful. Our Terms describe these duties in detail.

6. Our obligations

• Process personal data only on your documented instructions: the Terms, this DPA and your configuration of SOYL Forms.
• Tell you if we believe an instruction breaks the law.
• Make sure people with access are bound by confidentiality and access data only as needed.
• Maintain reasonable security safeguards, including those described on our security page, and keep logs that let us investigate incidents.
• Not disclose Respondent data to third parties except sub-processors, destinations you configure, or where the law requires.
• Tell you about a legally binding government or law-enforcement request for your Respondent data unless the law prohibits it, and disclose only what is legally required.

7. Sub-processors

You authorise the sub-processors listed on our sub-processors page. We impose data-protection obligations on each that are no less protective than this DPA and remain responsible for their performance. We give at least 15 days' notice of a new sub-processor, and you may object on reasonable data-protection grounds during that period.

8. Assistance with Respondent requests

SOYL Forms lets you find, export, edit and permanently delete individual responses yourself. If a Respondent contacts us about your form, we will forward the request to you without undue delay and not answer it ourselves unless you ask us to or the law requires it. We will provide reasonable help with access, correction, erasure, nomination and grievance requests, and with any assessment or consultation you must carry out. For vault forms, only your workspace can decrypt responses, so access and correction requests are answered by you after unlocking the vault; vault responses can be exported from your browser and deleted, but not edited.

9. Personal data breaches

We will notify you without undue delay, and in any case within 24 hours, after we confirm a personal data breach affecting your Respondent data. The notice will describe what happened, the data and people likely affected, the likely consequences, what we have done to contain it and what you should do, and a contact point. We will update you as we learn more and give you the information you need to inform the Data Protection Board of India and affected Respondents, which is your responsibility as Data Fiduciary. We also report cyber security incidents to CERT-In as the law requires.

10. Deletion and return

You can export responses as CSV at any time (for vault forms, the export is decrypted and built in your browser). When you delete a response, a form or your account, we permanently delete the related data, including encrypted vault content and your workspace's wrapped vault keys, from our live systems; account deletion completes shortly after you request it, usually within a day. Saved, unsubmitted progress is deleted after 30 days of inactivity. Deleted data remains in encrypted database backups until they expire within 14 days. We keep data longer only where the law requires us to (for example tax records), and then only for that purpose.

11. Audits and information

On written request, no more than once a year (or after a breach or a regulator's request), we will answer reasonable written questions about our processing and security and share relevant summaries of our policies. Where the law requires an inspection, we will cooperate on reasonable notice, during business hours, at your cost and subject to confidentiality and to protecting other customers' data.

12. Location and cross-border transfers

Our primary database and application run in Microsoft Azure's Central India region, and our email service stores data in India. Some sub-processors (for example Cloudflare's network, Microsoft Entra's Asia-Pacific identity geography and Google Fonts) may process data outside India. Transfers follow section 16 of the DPDP Act, and we will stop transferring to any country the Central Government restricts.

13. Contact

Questions about this DPA: [to be confirmed].

Changes

Version 2026.10: first published version of this addendum. We will give notice of material changes as described in the Terms.