Legal
Sub-processors
Version 2026.10 · Effective [to be confirmed]
These providers process personal data on our behalf to run SOYL Forms. Each is bound by a contract that requires it to protect the data, use it only to provide its service to us, and keep it confidential. This list forms part of our Data Processing Addendum and Privacy Policy.
| Provider | Purpose | Personal data | Location |
|---|---|---|---|
| Microsoft Azure (Container Apps, Database for PostgreSQL, Key Vault, Log Analytics) | Application hosting, primary database, secrets and operational logs | All account data, form content, responses, consent and request records, security logs | India (Central India region) |
| Microsoft Entra External ID | Creator sign-up, sign-in, email verification and password reset | Creator name, email address, sign-in identifiers and authentication logs | Asia-Pacific identity geography |
| Azure Communication Services (Email) | Transactional email: response notifications, respondent confirmations, invitations, request acknowledgements | Recipient email address and email content (which can include response answers the creator chose to email) | India (data location) |
| Cloudflare R2 | Private storage for files uploaded to forms and creator assets | Uploaded files and file metadata | Configured region [to be confirmed] |
| Cloudflare Turnstile | Bot protection on published forms and our request forms | IP address, browser and device signals during the check | Cloudflare global network |
| Razorpay | Subscription and AI-credit payments; payments inside forms on the creator's own Razorpay account | Name, email, phone, payment status and order identifiers (card and UPI details stay with Razorpay) | India |
| Microsoft Azure AI Foundry | AI drafting of forms and brand extraction, on the creator's request | Creator prompts, notes, uploaded brand documents and website content. Never respondent answers | Region [to be confirmed] |
| Google Fonts | Web fonts on published forms that use a Google font theme | Respondent IP address and browser user agent when the font files load | Google global network |
Not our sub-processors
When a creator connects a webhook, Google Sheets, Slack, Discord, Zapier, an AI assistant through an API key, or their own Razorpay account to a form, the creator chooses that destination and responses are sent there on the creator's instructions. Those services are the creator's processors or independent recipients, not ours.
Changes
We give at least 15 days' notice before a new sub-processor starts processing customer personal data, by updating this page and emailing workspace owners. A creator who objects on reasonable data-protection grounds can tell us at [to be confirmed] within that period; if we can't address the objection, the creator may cancel their plan and close their account, as described in our refund and cancellation policy. In an emergency (for example, to keep the service secure) we may make a change with shorter notice and will tell you as soon as we can.