Data

Formstack Forms and the GDPR: AI training, data location and DPA

: Doesn't train on your data. EU hosting not documented · DPA on request.

Vendor: Intellistack, LLC (formerly Formstack, LLC), Fishers, IndianaResearch, forms and storageChecked on How we check

Verdict

Is Formstack Forms GDPR compliant?

Business

Doesn't train on your data

EU hosting not documented · DPA on request

Price: $83 / mo

No tool is GDPR compliant on its own: that depends on how your business uses it. This page shows the vendor's side, from its own pages. It is not legal advice.

Training

Does Formstack Forms train on your data?

Trains on your data by default?

Checked

Doesn't train on your data.

No, per Intellistack's Legal FAQ: it does not use customer content or form data to train or improve AI models. The FAQ says it is informational and not part of the contract.

Vendor's wording: “Intellistack does not use customer content or form data to train or improve AI models within any of its products.”

Source: vault.pactsafe.ioLegal, Privacy & Security FAQ > AI Functionality, question 2Checked on

Contract

Does Formstack Forms sign a data processing agreement?

Data processing agreement (DPA)

Checked

DPA on request.

Yes. The DPA is part of the Software Services Agreement and is pre-signed by Intellistack; the customer accepts it via an executable link or by emailing a completed copy to legal@intellistack.com.

Vendor's wording: “Yes. The DPA is incorporated into our Software Services Agreement and available at intellistack.com/legal.”

Source: vault.pactsafe.ioLegal, Privacy & Security FAQ > Privacy & Security, question 5; DPA 'How to execute this DPA'Checked on

Processors

Who else handles Formstack Forms data?

EU–US Data Privacy Framework

Checked

On the list.

Active (Intellistack; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Intellistack'Checked on

Retention

How long does Formstack Forms keep your data?

How long data is kept

Checked

No fixed period published. Data is kept while the service is provided; after the contract ends Intellistack may permanently delete it at its discretion, so download your data first.

Vendor's wording: “Following termination, Intellistack shall have no obligation with respect to storage of Customer Data and may, in its sole discretion, permanently delete Customer Data in accordance with its internal policies and procedures.”

Source: vault.pactsafe.ioSoftware Services Agreement 7.4 Effect of TerminationChecked on

Security

Which certifications and admin controls does Formstack Forms have?

Security certifications

Checked

Trust Center names SOC 2 Type II, HIPAA, PCI, GDPR, CCPA, TX-RAMP and three DPF badges (9 badges); documents also include an ISO 27001 engagement summary letter.

Vendor's wording: “CCPA EU-US DPF GDPR HIPAA PCI SOC 2 Type II Swiss-US DPF TX-RAMP UK-US DPF”

Source: trust.intellistack.comTrust Center > BadgesChecked on

Admin controls for AI

Checked

Yes. In Formstack Forms, AI ('Forms AI') is optional and an Org Admin can turn it on or off in account settings.

Vendor's wording: “In Formstack Forms, AI (known as “Forms AI”) is optional and can be turned on or off by an Org Admin in account settings.”

Source: vault.pactsafe.ioLegal, Privacy & Security FAQ > AI Functionality, question 1Checked on

The vendor doesn't say: data location, EU hosting, sub-processors, price.

Alternatives

Formstack Forms alternatives that don't train on your data

Other research, forms and storage tools whose business plan doesn't train on your data and includes a DPA.

The five marks, in order: No AI training · EU hosting · DPA · Sub-processors listed · DPF or EU vendor. ✓ meets it, ✕ doesn't, – partly, ? not stated.

Tool · PlanVerdictYour five rules
  • Google Drive

    Google Workspace Business Standard · €13.60 / user / mo

    Doesn't train on your dataEU hosting available · DPA in the terms

    ✓✓✓✓✓

  • Google Forms

    Google Workspace Business Standard · €13.60 / user / mo

    Doesn't train on your dataEU hosting available · DPA in the terms

    ✓✓✓✓✓

  • Jotform

    Silver · See details

    Doesn't train on your dataEU hosting available · DPA on request

    ✓✓✓✓✓

  • Microsoft Copilot Chat in Microsoft Edge

    work account, included with Microsoft 365 · See details

    Doesn't train on your dataEU hosting available · DPA in the terms

    ✓✓✓✓✓

  • Cal.com

    Teams · $12 / user / mo

    Doesn't train on your dataNo EU hosting · DPA on request

    ✓✕✓✓✓

Need something your tools can't do?

We design and build what your team is missing, around the way you already work and the data rules you set.

Book a callServices