splitforms GDPR compliance — form backend data protection.

Roles — controller vs processor

GDPR splits responsibility for personal data between two roles, and developers building forms often conflate them. Here's how it works on splitforms:

One practical consequence: if a form submitter emails hello@splitforms.com asking us to delete their data, we can't do that without identifying which form they submitted to — we'll route the request to you, the form owner, who has the context to act.

What data is collected on a submission

When someone POSTs to your form, splitforms persists exactly this set of fields and nothing else:

We do not enrich submissions with third-party data, do not run analytics on submission contents, and do not share them with anyone other than you (the form owner) and the sub-processors listed below.

Lawful basis for processing

Under GDPR, every act of processing personal data needs one of six lawful bases (Art. 6). For form submissions handled through splitforms, the relevant ones are usually:

• Consent— newsletter sign-ups, marketing opt-ins, surveys. The submitter freely says "yes, you may contact me."
• Legitimate interest — contact forms, lead forms, sales inquiries. The submitter is reaching out to you for a clear, expected purpose.
• Contract — quote requests, service applications. Processing is necessary to take steps at the request of the data subject prior to entering into a contract.

Capturing the basis is your responsibility as controller— usually a short note in your form's privacy text plus, where consent applies, a checkbox the submitter ticks themselves. splitforms doesn't inject consent text on your behalf.

The eight data subject rights — and how to action each

GDPR grants data subjects (the people who fill out your forms) a defined set of rights. Here's how each one maps onto splitforms tooling:

1. 01Right of access (Art. 15)

   Form owners can view all submissions in the splitforms dashboard and export them as CSV at any time. End-users (form submitters) should request access from the form owner — splitforms doesn't know which submission belongs to which natural person without that context.

2. 02Right to rectification (Art. 16)

   Form owners can edit submission rows from the dashboard or contact hello@splitforms.com to correct stored data. End-users should contact the site that operates the form.

3. 03Right to erasure (Art. 17)

   Form owners can delete individual submissions from the dashboard, or delete their entire splitforms account, which cascades and removes every form, submission, webhook, and uploaded file.

4. 04Right to restriction of processing (Art. 18)

   Form owners can pause a form (`is_active = false`) so it no longer accepts submissions while review is in progress. The existing submission rows stay untouched until you choose what to do with them.

5. 05Right to data portability (Art. 20)

   Form owners can export any form's submissions as a CSV file from the dashboard. The export contains all original fields, IP, user-agent, referer, and timestamp — a structured, machine-readable format.

6. 06Right to object (Art. 21)

   Delete the relevant submission(s) from the dashboard. For account-level objections (e.g. you no longer want splitforms processing for any of your forms), delete your account.

7. 07Rights related to automated decision-making (Art. 22)

   Not applicable. splitforms does not perform automated decision-making or profiling on form submitters. The optional AI spam classifier flags spam vs not-spam for the form owner's review; it does not produce legal effects on the submitter.

8. 08Right to withdraw consent (Art. 7)

   Consent for the underlying form (e.g. newsletter sign-up) is captured by the form owner, not splitforms. As the data controller, you remain responsible for offering withdrawal mechanisms (e.g. an unsubscribe link). On the splitforms side, deleting the submission removes our copy.

Data Processing Agreement (DPA)

We offer a standard DPA for any splitforms customer that needs one for their own GDPR obligations — typical for agencies handling EU client data, B2B SaaS reselling forms, and anyone whose own privacy programme requires a written processor contract.

The DPA covers: processor obligations under Art. 28, sub-processor list (matching the table below), breach notification timelines, data subject rights flow-through, audit rights, and Standard Contractual Clauses for any transfer outside the EU.

To request: hello@splitforms.com with subject "DPA".

Sub-processors

We use a small set of named sub-processors to operate the service. We update this list when it changes, with notice sent to active accounts before any new sub-processor is engaged.

Data location

Today the default region is the United States. Submissions, profiles, and uploaded files all live on Supabase Postgres and Storage in AWS US regions. Vercel compute runs at edge and US Lambda regions. AWS SES sends from US infrastructure.

Planned: EU data residency.A Supabase EU-resident project for splitforms is on the roadmap. We'll list the exact region and migration steps on this page the day it goes live. Until then, EU customers can rely on the SCCs documented in our DPA for cross-border transfers.

Data breach notification

If splitforms becomes aware of a personal data breach affecting your data, we will notify you within 72 hours of becoming aware, in line with Art. 33 GDPR. The notice will include: the nature of the breach, the categories and approximate volumes of data affected, the likely consequences, and the measures we have taken or propose to take to address it.

Notification goes to the email on your splitforms account, so please keep that address current.

International transfers

Where personal data is transferred outside the EEA, UK, or Switzerland, splitforms relies on the European Commission's Standard Contractual Clauses (SCCs) as the transfer mechanism, alongside our sub-processors' own adequacy decisions and Data Privacy Framework participation where applicable.

We do not currently rely on Binding Corporate Rules — we don't have the multi-entity structure that BCRs are designed for. SCCs are the right tool for a small, single-entity SaaS.

Retention

Submissions are retained for the lifetime of your account. There is no automated expiry policy — many customers want a permanent CRM of their leads. You stay in control:

• Per-submission delete from the dashboard at any time.
• CSV export from the dashboard, so you can keep your own archive offsite.
• Account deletion cascades through Postgres foreign keys and removes every form, submission, webhook, uploaded file, and profile row. Backups rotate within 30 days.

For a custom retention policy (e.g. auto-delete submissions older than 90 days), email hello@splitforms.com.

Cookies

splitforms.com uses essential cookies only — an HttpOnly, SameSite=Lax session cookie issued by Supabase Auth so you stay signed into the dashboard. We do not run marketing cookies, advertising pixels, session-replay scripts, or third-party analytics on the dashboard.

Cookies on your site are your responsibility. The splitforms POST endpoint at /api/submit doesn't set cookies in your visitors' browsers — it's a stateless API call.

Frequently asked questions