Skip to content
OneForm
Start free
Legal

Data Processing Addendum

Effective and last updated October 18, 2026

This Data Processing Addendum (the "DPA") is between OneForm ("OneForm", "we", "us") and the business or organization that has accepted our Terms of Service (the "Customer", "you"). It sets out how OneForm processes personal information in Customer Data on your behalf. Words defined in the Terms have the same meaning here.

Contents

1. Scope and precedence

This DPA forms part of the Terms and is incorporated into them by reference (Terms section 4). It applies whenever OneForm processes Customer Personal Information to provide the Service. If this DPA and the rest of the Terms conflict on how Customer Personal Information is processed, this DPA wins. On everything else, the Terms apply.

2. Definitions

  • "Privacy Laws" means the US federal and state laws that apply to the processing of Customer Personal Information under the Terms, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (the "CCPA") and similar state laws.
  • "Business", "service provider", "personal information", "consumer", "sell" and "share" have the meanings given in the CCPA. Where another Privacy Law uses "controller" and "processor", those terms apply to you and to OneForm in the same way.
  • "Customer Personal Information" means personal information in Customer Data, such as the answers your clients give to your forms and the reports generated from them.
  • "Security Breach" means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Information.
  • "Subprocessor" means a service provider OneForm engages to process Customer Personal Information for the Service.

For Customer Personal Information, you are the business and OneForm is your service provider. Tools you connect yourself, such as your CRM, your calendar or an AI agent, are engaged by you and are not OneForm's subprocessors (Terms sections 7 and 8).

3. Your instructions

OneForm processes Customer Personal Information only on your documented instructions. Your instructions are the Terms, this DPA, and how you use and configure the Service, for example the forms you publish, the workflows and integrations you set up, and the reports you approve and send. The business purpose of the processing is to provide, secure and support the Service for you. We will tell you if we believe an instruction breaks a Privacy Law, and we may decline to follow it.

You are responsible for your instructions, for having the notices, consents and legal basis needed to collect the information your forms ask for, and for the accuracy of the Customer Personal Information you give us. That includes any consent your clients must give under Internal Revenue Code §7216 or similar state rules before their tax return information is collected, used or disclosed through the Service, including through its AI features (Terms section 5).

4. Service provider restrictions

OneForm will not:

  • sell or share Customer Personal Information;
  • retain, use or disclose it for any purpose other than the business purpose in section 3, including for any commercial purpose of our own;
  • retain, use or disclose it outside the direct business relationship between you and OneForm;
  • combine it with personal information we receive from anyone else or collect ourselves, except as Privacy Laws allow a service provider to; or
  • use your clients' answers to train AI models.

OneForm will comply with the Privacy Laws that apply to it as your service provider and give Customer Personal Information the level of privacy protection they require. We will tell you if we can no longer meet these obligations. You may then take reasonable and appropriate steps to stop and remedy any unauthorized use, including by suspending your use of the Service or closing your account.

Certification. OneForm certifies that it understands the restrictions in this section and will comply with them.

5. Confidentiality

OneForm makes sure that everyone it authorizes to process Customer Personal Information is bound by an obligation of confidentiality, and that staff access it only as needed for the purposes in Terms section 2: support you ask for, keeping the Service secure, investigating a breach of the Terms, or complying with law.

6. Security

OneForm keeps appropriate technical and organizational measures in place to protect Customer Personal Information, taking into account the nature of the processing and the risks to it. The current measures are described in the Annex and on our Security page. We may update them over time, but not in a way that lowers the overall protection of Customer Personal Information.

7. Subprocessors

  • You authorize OneForm to use the subprocessors listed on our subprocessors page.
  • Each subprocessor is bound by written terms that restrict its use of Customer Personal Information and protect it at least as well as this DPA. OneForm remains responsible for its subprocessors' performance of those obligations.
  • We tell you about a new or replacement subprocessor by updating that list, and note the change in our changelog. If you object on reasonable data protection grounds, write to hello@oneform.si and we will work with you in good faith to resolve it. If we can't, you may close your account.

8. Security breaches

OneForm will notify you without undue delay after confirming a Security Breach affecting your Customer Personal Information. We will tell you what we know about what happened, the information involved and the steps we are taking, and update you as we learn more, so that you can meet your own obligations to notify consumers and regulators. We will take reasonable steps to contain the breach and limit its effects. Notice of a Security Breach is not an admission of fault.

9. Consumer requests

Taking into account the nature of the processing, OneForm will help you respond to consumers who exercise their rights under Privacy Laws, such as the right to know, correct or delete. The Service includes tools to do this yourself: firm owners can download a full export of the firm's data under Settings → Data & privacy, and firm administrators can export or erase one person's data from that person on the Leads page. If a consumer sends a request about Customer Personal Information to OneForm, we will pass it to you and will not answer it ourselves, unless the law requires us to.

We will also give you reasonable help with security, breach notification and any risk assessments Privacy Laws require of you, using the information available to us.

10. Deletion and return

  • You can export your firm's Customer Data from the app at any time.
  • When your account is closed, OneForm permanently deletes Customer Data, including Customer Personal Information, 30 days later, as described in Terms section 3 and the Privacy Policy, except where the law requires us to keep it.
  • Information we must keep by law stays protected under this DPA for as long as we keep it.

11. Audits

OneForm will make available the information reasonably needed to show that it meets this DPA. You may ask us to complete a written security questionnaire, at most once a year, and we will answer it within a reasonable time. You may ask more often if a Security Breach has affected your Customer Personal Information or a regulator requires it. The answers are OneForm's confidential information.

12. FTC Safeguards Rule

We maintain the safeguards described in this DPA and the Privacy Policy to support firms in meeting their own obligations, such as the FTC Safeguards Rule. You remain responsible for your firm's own information security program, including choosing whether OneForm meets your needs as a service provider and overseeing it.

13. Term

This DPA applies for as long as OneForm processes Customer Personal Information for you, and ends when that processing ends and the data has been deleted under section 10. When we change it, we update the date at the top, in the same way as the Terms (Terms section 18).

14. Contact

Questions about this DPA, and notices under it: hello@oneform.si, or by mail to OneForm, 1451 W Cypress Creek Rd, Suite 300, Fort Lauderdale, FL 33309, United States.

Annex: Security measures

OneForm's technical and organizational measures for Customer Personal Information include:

  • Hosting: the Service runs on Railway in its us-east4 region (Virginia), behind Cloudflare DNS and a web application firewall. Customer Data is stored and processed in the United States.
  • Encryption: TLS for data in transit; AES-256-GCM for saved connection secrets and webhook signing secrets at rest; API keys and AI agent tokens stored only as hashes; passwords salted and hashed with scrypt and checked against known breaches; signed client links.
  • Backups: the database is backed up daily by our hosting provider.
  • Access control: roles within each firm; staff access limited to the purposes in section 5, audited, and shown in the firm's audit log when OneForm staff open a firm.
  • Human review: AI-written reports wait for a person at the firm before they are sent, unless the firm turns on automatic sending.
  • Abuse protection: rate limits on public forms and the API, bot checks on sign-up, sign-in and forms, and protection against cross-site requests.
  • Data minimization: voice forms keep the answers, not the recordings; error reports have names, emails, phone numbers, cookies and form contents removed before they are sent.
  • Vulnerability handling: a published vulnerability disclosure policy, with fixes prioritized by severity.