Legal
Sub-processors
Last updated: 2026-09-30
Thinking42, Inc., a Delaware corporation, uses the companies below to run Formsieve. Table A lists those that process the form submissions our customers' plugins send to us (Thinking42 acts as our customers' processor; see the Data Processing Agreement, /dpa/). Table B lists those that process Thinking42's own account, billing and support data (see the Privacy Policy, /privacy-policy/).
Change notices. We give at least 30 days' notice before adding or replacing a sub-processor in table A, by updating this page and e-mailing every account owner. If you are not an account owner and want these notices, write to support@formsieve.com with "Sub-processor notices" in the subject line. Where the change is urgent (for example the sudden loss of a provider), we may switch to a provider listed as standby and tell you as soon as possible.
A. Sub-processors for form submissions
| Company | Purpose | Data | Location | Transfer mechanism (as of 2026-09-25) | Status |
|---|---|---|---|---|---|
| Cloudflare, Inc. | DNS, network protection and the encrypted tunnel to our server. Cloudflare's edge terminates HTTPS, so submissions pass through it in transit | Submission data in transit; request metadata | Global network; US company | Within the USA. Data Privacy Framework: active (EU-U.S., UK Extension, Swiss), valid to 2027-09-15. Cloudflare's DPA with standard contractual clauses | Active |
| Amazon Web Services, Inc. | Hosting of our server and database (EC2, us-east-1) | Submission data in memory while a request runs; request metadata | USA (Virginia) | Within the USA. Data Privacy Framework: active through Amazon.com, Inc., valid to 2027-01-02. AWS DPA | Active |
| OpenRouter, Inc. | Gateway to the AI model; zero-data-retention routing requested on every request | Submission data; a pseudonymous account identifier | USA | Within the USA. Not on the Data Privacy Framework list. OpenRouter DPA (last updated 2026-08-26) with standard contractual clauses | Active |
| TypeSafe AI, Inc. | Runs the Jev AI model that answers Formsieve's questions | Submission data | USA (its sub-processor list, read 2026-09-28: AWS, Modal, Nebius and CoreWeave for computing, all "USA", no region stated; Slack and Google Workspace for support) | Within the USA. Not on the Data Privacy Framework list (checked 2026-09-28). TypeSafe's terms and DPA | Active |
| TypeSafe AI, Inc. (direct API) | Alternative route to the same model if OpenRouter is unavailable. Same company, same terms as the row above | Submission data | USA | As above | Standby |
If a customer chooses to forward a submission to us in a support request, that e-mail is handled by our mailbox providers in table B.
B. Sub-processors for Thinking42's own data (account, billing, support, website)
| Company | Purpose | Data | Location | Transfer mechanism (as of 2026-09-25) |
|---|---|---|---|---|
| Stripe, Inc. | Payments, subscriptions, invoices, tax calculation, customer portal | Billing and account data (never form submissions) | USA | Data Privacy Framework: active (EU-U.S., UK Extension, Swiss), valid to 2027-05-11. Stripe DPA |
| Resend (Plus Five Five, Inc.) | Sending our e-mails (sign-in codes, receipts, alerts, reminders) | E-mail address and message content (never form submissions) | USA | Data Privacy Framework: active (EU-U.S. and UK Extension), valid to 2027-03-03. Resend DPA with standard contractual clauses |
| Google LLC (Google Workspace) | Thinking42's own mailboxes | Support mail | USA | Data Privacy Framework: active. Google Workspace data processing terms |
| Zoho Corporation | The hello@ and support@formsieve.com mailboxes (as of 2026-09-27) | Support mail | USA / India | Not on the Data Privacy Framework list (withdrawn 2024-02-23). Zoho's standard contractual clauses |
| Cloudflare, Inc. | DNS, network security, tunnel, anti-bot check on forms, cookieless website statistics, storage of our nightly backups (R2) | IP addresses and request data; an encrypted copy of the databases and files on our server, encrypted before upload (Cloudflare does not hold the key) and deleted within 14 days | Global network; US company | As in table A |
| Amazon Web Services, Inc. | Hosting of our website and database | All data we store | USA (Virginia) | As in table A |
Notes
- The EU-U.S. Data Privacy Framework stands as of 2026-09-25: the EU General Court dismissed Latombe v Commission (T-553/23) on 2025-09-03; an appeal (C-703/25 P) is pending. Our DPA relies on the standard contractual clauses in any case.
- Thinking42 itself is not certified under the Data Privacy Framework.