Our service providers.

Microsoft — hosting, storage, delivery and AI features

Microsoft Azure hosts the app, active database and files in Sweden Central. Sign-in and email processing are not limited to Sweden. Azure Communication Services sends our email until we move it to Amazon SES (below). It processes destination addresses, email content and delivery results. Our email includes verification codes, team invitations, private notification links and optional visitor receipts; once we add them, it will also include daily summaries. Notifications include inquiry answers, or an AI summary once we add that option, only for forms the business sets to include them. Azure Communication Services checks messages for spam and malware and keeps records of addresses that bounce.

We are adding optional AI features to makeform.live. Each one is off unless the business turns it on. They will run on Microsoft’s Azure AI services, to translate, summarise and spam-check messages, suggest and translate replies, summarise survey comments, and draft or translate forms. They will receive only the text the feature needs. Microsoft processes it in the EU, or in an EFTA country such as Norway or Switzerland, and doesn’t use it to train AI models. If Microsoft’s automated abuse monitoring flags a request, Microsoft can store it in Europe for review by authorised Microsoft staff in the EEA.

Microsoft’s security services can also check uploaded files for malware and for illegal or harmful images, to protect businesses. Microsoft 365 hosts our company email, including our support, privacy and legal addresses; messages sent to us are stored there under Microsoft’s terms.

Azure is a subprocessor for inquiry storage and delivery, and for the optional AI features once we add them, under our customer processing terms. Microsoft Entra processes the account identifiers of owners and Members, authentication and security information for our account service. Microsoft can separately act as controller for processing defined in its own terms. Sign-in and email handling are not limited to Sweden.

Microsoft Products and Services DPA · Microsoft privacy statement · Entra log-retention information · Azure AI data, privacy and security.

Google — optional sign-in

When you choose Google sign-in, Google provides your Google identifier, email address and basic profile information to our sign-in service and Microsoft Entra. We use your Google identifier to authenticate you and, after verification and your confirmation, connect it to your email sign-in. We do not request access to your Gmail, Drive, contacts or Calendar. Google handles its own sign-in, session and security information under its privacy policy. You can use an email code instead. This sign-in integration does not send form answers or attachments to Google.

Amazon Web Services — email delivery

We are moving our email from Azure Communication Services to Amazon SES, run by Amazon Web Services EMEA SARL, Luxembourg, in its Stockholm region. Until the move is done, Azure Communication Services sends our email; during the move, either service may send a given email. When Amazon SES sends our email, it processes destination addresses, email content and delivery results for the same emails described above. Amazon Web Services or its providers may store and scan messages to block spam, phishing and malware. It keeps records of addresses that bounce or report our email as spam, and these can stay until removed. We don’t use its open or click tracking.

Amazon Web Services is a subprocessor for email delivery, once it sends our email, under our customer processing terms. Its own affiliates, including in the United States, can be involved in support and security operations, under its terms.

AWS Service Terms · AWS Data Processing Addendum · AWS sub-processors · AWS privacy notice.

Cloudflare — DNS and spam protection

Cloudflare supplies DNS and Turnstile. Turnstile processes browser and connection signals such as IP address, browser information and site origin to protect forms. It does not receive the form’s submitted message through our verification integration. Cloudflare processes security signals on our behalf and acts separately as controller when improving its bot detection. Its services operate internationally.

Cloudflare customer DPA · Turnstile privacy addendum. The addendum does not state a single fixed retention period for all signals; we have not verified a contractual maximum for our account.

Paddle — subscription sales

The applicable Paddle entity sells subscriptions and handles payment details, billing addresses, tax information, invoices and payment support. Paddle acts as the merchant of record and controller for its buyer relationship, not as our inquiry-storage subprocessor. We share your verified account email to fill in checkout, and the checkout and payment references needed for billing, not inquiry contents.

Paddle privacy notice · buyer terms · refund policy.

Anthropic and OpenAI — AI support assistants

We use Anthropic’s Claude and OpenAI’s Codex to help us handle support cases, such as a refund, a billing question or a required notice. We give them only references such as account ids, plan, dates and payment references, which don’t identify anyone on their own. We never give them names, email addresses, support messages or inquiries sent to customers’ forms, so they are not subprocessors of inquiry data. Each provider acts under its own terms and privacy policy and processes data in the United States and other countries. We have switched off the settings that let them train their models on our conversations; their policies keep limited exceptions, such as conversations we rate or that are flagged for safety review.

This is separate from the optional AI features we are adding, which will run on Microsoft’s services (above). A business can connect its own AI assistant, such as Claude or ChatGPT, including from their app directories once we are listed there. Anthropic or OpenAI then receive what the business permits, as the business’s own recipients under its own terms with them. They are not our subprocessors.

Anthropic privacy policy · OpenAI privacy policy.

International transfers

Vlomkat Solutions FZ-LLC operates from the UAE. Authorised company support can access service information from outside the EEA or UK. Microsoft, Amazon Web Services and Cloudflare publish contractual transfer safeguards, including standard contractual clauses where applicable. These provider arrangements do not by themselves establish a safeguard for every transfer between a form owner and our UAE company.

For inquiry data transferred to us under EU or UK data-protection law, our data-processing terms incorporate the EU Standard Contractual Clauses and the UK Addendum, which the account owner accepts with those terms. We have documented a transfer assessment of UAE law and practice and the measures we apply; ask privacy@vlomkatsolutions.com for a copy. We have not appointed an EU or UK representative.

Changes to processors

We will notify affected account owners at their account email at least 30 days before adding or replacing a subprocessor of their inquiry data. For Module Three transfers, we will notify the underlying controller in writing at its recorded contact and inform the account owner; the controller's required authorisation must be in place. The notice identifies the new entity, its tasks and locations and the intended change date. The party entitled to object may raise a reasoned data-protection objection during that period. We will seek a reasonable resolution; if we cannot resolve it, they may stop the affected processing and export or end the service before the change. An urgent security or legal issue does not by itself shorten the agreed notice period or remove required authorisation. If necessary, we will suspend the affected processing while a lawful arrangement is established and explain the impact and available remedies. A silent edit to this page alone is not the notification.