Data processing terms
Last updated October 9, 2026
When you, the organizer, collect answers with Wunderly, you're the controller of that data and we're your processor. These terms are the agreement between us about it, and they're part of the terms.
[OWNER TO REVIEW] the whole agreement, before the first client site
What we process
| Subject matter | Running the organizer's forms: storing answers, showing results, sending email they choose. |
|---|---|
| Duration | For as long as the organizer's workspace exists, then deletion as described below. |
| Nature and purpose | Hosting, storage, counting, and sending one reminder or an estimate email. |
| Personal data | Whatever the organizer's form asks: typically names, email addresses, phone numbers and answers; the estimate shown; the respondent's country (not their IP address). |
| Data subjects | People who open or fill in the organizer's forms, and guests the organizer invites by name. |
What we do
- We process respondents' data only on your instructions, which are your form and your settings.
- Everyone who can reach it is bound to keep it confidential.
- We keep it secure: HTTPS everywhere, data encrypted at rest by our host, sign-in links, sessions and emailed links stored only as hashes, a spam check on every form, rate limits, an ops console behind single sign-on where every look at answers is logged, and nightly backups kept for 30 days.
- We help you answer requests from respondents to see, correct or delete their data.
- We tell you without undue delay after we learn of a breach affecting your data [OWNER TO REVIEW] notification deadline.
- When your workspace is deleted, we delete its data; backups age out within 30 days.
- We give you the information you need to show you're complying, on request.
Subprocessors
You agree we can use these companies. We'll list any new one on the changelog at least 30 days before it starts, and you can object by writing to us.
| Company | What it does for us | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting, the database, file storage, the spam check (Turnstile) and backups | Global network |
| Resend, Inc. | Sending email: sign-in links, reminders and estimate emails | United States |
Transfers outside the EU and UK
Where data leaves the EU, the EEA or the UK, the transfer is covered by the European Commission's Standard Contractual Clauses (and the UK addendum) [OWNER TO REVIEW] module, signatories and annex.
Contact
Data protection questions: support@wunderly.so.