This Data Processing Addendum (the "Addendum") is part of the Terms of Service between Qualiform LLC, a Utah limited liability company ("Qualiform," "we," "us," or "our"), and the business that accepted them ("you"). It covers the personal information we process on your behalf when we provide Qualiform. You accept it when you accept the Terms. If you need a signed copy, email coleman@getqualiform.com.
1. Definitions
- "Terms" means the Qualiform Terms of Service.
- "Data Protection Laws" means the laws that apply to the processing of Customer Personal Data under the Terms, including, where they apply: the EU General Data Protection Regulation (the "GDPR"); the GDPR as it forms part of United Kingdom law, with the Data Protection Act 2018 (the "UK GDPR"); the Swiss Federal Act on Data Protection (the "FADP"); the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its regulations (the "CCPA"); and the comprehensive privacy laws of other US states.
- "Customer Personal Data" means the personal information in Customer Data (as the Terms define it) that we process on your behalf. It includes what visitors write in your forms, the answers recorded from it, their contact details, scores, routing decisions, meeting details, and the names and email addresses you give us for the people you add to your organization.
- "Subprocessor" means a company we engage that processes Customer Personal Data.
- "Security Incident" means a breach of security that leads to the accidental or unlawful destruction, loss, or alteration of Customer Personal Data, or to its unauthorized disclosure or access.
- "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
- "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.
- "Controller," "processor," "data subject," "personal data," "processing," "business," "service provider," "sell," and "share" have the meanings given in Data Protection Laws. "Personal information" means "personal data" where the GDPR, the UK GDPR, or the FADP applies.
2. Roles
2.1 You are the controller of Customer Personal Data (a "business" under the CCPA), or a processor acting for a client of yours. We are your processor (your "service provider" under the CCPA), or your subprocessor where you act for a client.
2.2 We are an independent controller of the information our Privacy Policy describes as ours: account and login information, billing information, the records we keep for our own security (rate limits and the bot check), and requests to stop email. This Addendum does not cover that information. The names and email addresses you give us for the people you add to your organization are Customer Personal Data.
2.3 Each party will comply with the Data Protection Laws that apply to it.
3. Details of the processing
The subject matter, duration, nature, and purpose of the processing, the types of personal information, and the categories of people are set out in Annex 1.
4. Instructions
4.1 We will process Customer Personal Data only on your documented instructions, unless the law requires otherwise. In that case, we will tell you before we process it, unless the law forbids that. Your instructions are the Terms and this Addendum; the way you set up and use Qualiform, including your forms, routing rules, recipients, and the services you connect; and any other written instructions you give us that are consistent with the Terms. These instructions include the transfers described in section 15 and Annex 2.
4.2 We will tell you immediately if we believe an instruction breaks Data Protection Laws.
4.3 You are responsible for the lawfulness of your instructions and of the processing you ask for, including having a legal basis, giving notices, and obtaining consents, as section 6 of the Terms describes.
5. Confidentiality
We will make sure that anyone we authorize to process Customer Personal Data is bound by a duty of confidentiality. Access to production data is limited to the operator of the service.
6. Security
6.1 We maintain the technical and organizational measures in Annex 3, which are designed to protect Customer Personal Data against Security Incidents, taking into account the state of the art, the costs of implementation, the nature, scope, context, and purposes of the processing, and the risks to people.
6.2 We may change these measures, as long as a change does not lower the overall protection of Customer Personal Data.
6.3 You are responsible for your own security choices in Qualiform, including whom you invite, which role you give them, keeping logins secure, and the services you connect.
7. Subprocessors
7.1 You authorize us to engage the Subprocessors listed in Annex 2.
7.2 We will bind each Subprocessor by a written contract with data protection obligations no less protective than this Addendum, to the extent they apply to the service it provides. We remain responsible to you for each Subprocessor's performance of those obligations.
7.3 We will tell you about a new Subprocessor at least 14 days before it starts processing Customer Personal Data, by email to your organization's Admins and by updating Annex 2. Within those 14 days, you may object on reasonable data protection grounds by emailing privacy@getqualiform.com. We will try in good faith to address your objection. If we cannot, you may close your organization, and we will refund any fees you prepaid for the time after the new Subprocessor started. If we must replace a Subprocessor urgently to keep Qualiform running or secure, we will tell you as soon as we can, and you may still object as this section describes.
7.4 The services you connect, such as Slack, a webhook, or Google Analytics, are not our Subprocessors. They receive data at your direction, under your own agreements with them.
8. Requests from individuals
8.1 Qualiform lets you read, export, and delete leads, which you can use to respond to requests from individuals about their information.
8.2 If an individual contacts us directly about Customer Personal Data, we will pass the request to you without undue delay. We will not answer it ourselves, except to tell the individual that we have passed it on, unless you tell us to or the law requires it.
8.3 Taking into account the nature of the processing, we will give you reasonable help with requests you cannot answer with Qualiform's own tools, such as finding one person's conversations across your forms.
9. Assessments and consultations
Taking into account the nature of the processing and the information available to us, we will give you reasonable help with data protection impact assessments, risk assessments, and prior consultations with regulators that relate to your use of Qualiform.
10. Security Incidents
10.1 We will notify you without undue delay after we become aware of a Security Incident, and immediately where the law requires it, aiming to do so within 72 hours. We will send the notice by email to your organization's Admins.
10.2 Our notice will describe, as far as we know at the time, the nature of the Security Incident, the categories and approximate number of people and records concerned, its likely consequences, and the measures we have taken or propose. We will send more information as it becomes available.
10.3 We will take reasonable steps to contain and investigate the Security Incident and to reduce its effects, and we will help you meet your own obligations to notify regulators and individuals.
10.4 Unsuccessful attempts that do not compromise Customer Personal Data, such as blocked sign-in attempts or network scans, are not Security Incidents.
10.5 Our notice of a Security Incident is not an admission of fault or liability.
11. Deletion and return
11.1 While your organization is open, you can export your leads, including their conversations, as a spreadsheet file, and you can delete them.
11.2 When your organization is closed, by you or by us under the Terms, its forms stop taking new conversations within about a minute. Customer Personal Data in our database is then deleted by a daily cleanup once 14 days have passed, or later if a visitor is still to be told that a meeting is canceled, as section 13 of the Terms describes.
11.3 Copies held by Subprocessors are deleted under the retention periods in Annex 2. We do not keep database backups today. If we add them, deleted Customer Personal Data will leave them within 30 days.
11.4 We may keep Customer Personal Data for longer only where the law requires it, and then only for that purpose.
11.5 Deletion does not reach emails already delivered, or data already sent to services you connected.
12. Information and audits
12.1 We will make available the information reasonably needed to show that we comply with this Addendum, including this Addendum, our Privacy Policy, and written answers to a reasonable security questionnaire once every 12 months.
12.2 If that information is not enough to meet a requirement of Data Protection Laws, or a regulator requires it, you may audit our compliance with this Addendum, at your own cost, no more than once every 12 months. You must give us at least 30 days' notice, and the audit must take place during business hours, under confidentiality, and in a way that does not disrupt our business or expose other customers' data. You may use an independent auditor who is bound by confidentiality and is not our competitor.
12.3 Under the CCPA, you may take the reasonable and appropriate steps described in this section to make sure we use Customer Personal Data consistently with your obligations, and the steps in section 13.5 to stop and remediate unauthorized use.
13. California
13.1 We are your service provider. You disclose Customer Personal Data to us only for the limited and specified business purposes in this section, and we process it only for them: providing Qualiform to you as the Terms describe, including hosting, running conversations with AI, recording answers, scoring them, routing, booking meetings, sending notifications, sending data to the services you connect, supporting you, keeping Qualiform secure, and finding and fixing faults.
13.2 We will not:
- sell or share Customer Personal Data;
- retain, use, or disclose it for any purpose other than the business purposes in section 13.1, or as the CCPA otherwise permits a service provider;
- retain, use, or disclose it outside our direct business relationship with you; or
- combine it with personal information we receive from or for anyone else, or collect from our own interactions with people, except as the CCPA permits, such as to detect security incidents or to protect against fraud.
13.3 We will comply with the obligations the CCPA places on us as a service provider, and we will give Customer Personal Data the same level of privacy protection the CCPA requires of you.
13.4 We will notify you within 5 business days if we determine that we can no longer meet our obligations under the CCPA.
13.5 If you reasonably believe we are using Customer Personal Data without authorization, you may, after notifying us, take reasonable and appropriate steps to stop and remediate it, including by instructing us to stop processing it or by closing your organization.
13.6 We will help you respond to consumer requests, as section 8 describes, including by deleting, correcting, or providing the information you tell us to.
13.7 We engage Subprocessors only under written contracts, and you are told about them as section 7 describes.
13.8 We certify that we understand the restrictions in this section and will comply with them.
13.9 We will cooperate with your cybersecurity audits and risk assessments under the CCPA regulations, including by making available the relevant information we hold, and we will give you reasonable help with your obligations for automated decisionmaking technology.
14. Other US state laws
Where the comprehensive privacy law of Colorado, Connecticut, Utah, Virginia, or another US state applies, this Addendum is the contract that law requires between a controller and a processor. Under it, we follow your instructions (section 4); keep Customer Personal Data confidential (section 5); delete it at the end of the processing (section 11); make available the information needed to show our compliance and cooperate with reasonable assessments (section 12); and engage Subprocessors only under written contracts that flow these obligations down, after giving you a chance to object (section 7).
15. International transfers
15.1 We store Customer Personal Data in the United States. Our Subprocessors may process it in the places listed in Annex 2.
15.2 Where Customer Personal Data subject to the GDPR is transferred to us, and no adequacy decision covers that transfer (we do not participate in the EU-U.S. Data Privacy Framework), the SCCs are incorporated into this Addendum and apply as follows:
- Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) applies where you are a processor;
- Clause 7 (the docking clause) applies;
- in Clause 9, Option 2 (general written authorization) applies, with the notice period in section 7.3 of this Addendum;
- the optional wording in Clause 11 does not apply;
- in Clause 13, the competent supervisory authority is the one determined under Clause 13(a) for you;
- in Clause 17, Option 1 applies, and the governing law is the law of Ireland;
- in Clause 18(b), disputes are resolved by the courts of Ireland; and
- Annex I.A of the SCCs is completed with you as the data exporter and Qualiform as the data importer, at the contact details in section 17; Annex I.B with Annex 1 of this Addendum; Annex I.C with the authority named above; Annex II with Annex 3; and Annex III with Annex 2.
15.3 Where Customer Personal Data subject to the UK GDPR is transferred, the UK Addendum is incorporated into this Addendum. Its Tables 1 to 3 are completed with the information in section 15.2 and the Annexes, and in Table 4, neither party may end the UK Addendum when it changes.
15.4 Where Customer Personal Data subject to the FADP is transferred, the SCCs apply as in section 15.2, with these changes: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for those transfers; references to the GDPR include the FADP; and the term "member state" does not prevent people in Switzerland from bringing claims where they habitually live.
15.5 If the SCCs or the UK Addendum conflict with this Addendum or the Terms, the SCCs or the UK Addendum win.
15.6 If a transfer mechanism we rely on is invalidated, we will work with you to put another lawful mechanism in place.
16. Liability, duration, and which document wins
16.1 Each party's liability under this Addendum is subject to the limits and exclusions of liability in the Terms, except where Data Protection Laws or the SCCs do not allow it.
16.2 If documents conflict, the SCCs and the UK Addendum come first, then any written Custom plan agreement, then this Addendum, then the Terms.
16.3 This Addendum lasts as long as we process Customer Personal Data for you. It continues after the Terms end until the Customer Personal Data is deleted.
17. Changes and contact
17.1 We may update this Addendum to reflect changes in the law or in Qualiform, with the notice section 21 of the Terms describes. An update will not lower the protection of Customer Personal Data.
17.2 Our contact for data protection, and our details as data importer under the SCCs: Qualiform LLC, Salt Lake City, Utah, United States, privacy@getqualiform.com.
Annex 1: Details of the processing
| Item | Details |
|---|---|
| Subject matter | Providing Qualiform to you: conversational inquiry forms on your websites, carried out by an AI model, that record visitors' answers, score them, route them, offer meetings, and send them to the people and services you choose. |
| Duration | For as long as you use Qualiform, and until Customer Personal Data is deleted under section 11. |
| Nature | Collecting, recording, organizing, storing, retrieving, using, scoring, transmitting (to you, to the people and services you choose, and to our Subprocessors), and erasing. |
| Purpose | To provide, secure, support, and fix Qualiform for you, as the Terms and your setup describe. |
| Categories of people | Visitors who use your forms; visitors who book, move, or cancel meetings; the people you add to your organization, such as hosts and email recipients, who are also named in leads and meetings; and anyone else named in a conversation or in content you add. |
| Types of personal information | What visitors write and the AI's replies, with the time of each; the answers recorded from them, with the words each answer came from, whether it was stated or inferred, and the AI's confidence; contact details, such as name, email address, phone number, company, job title, and preferred way to be contacted; anything else your questions ask, such as budget, timing, location, and project details; scores, bands, and routing decisions; meeting details, such as time, format, time zone, and a keyed hash of the IP address of the person who booked; the names and email addresses of the people you add, and whether and when they confirmed their address; and technical information we use without storing it with the conversation, such as IP address, browser details, time zone, and the address of the page the form is on. |
| Sensitive information | None intended. Section 6.3 of the Terms prohibits collecting health information, financial account numbers, government ID numbers, and information from or about children under 13, unless we agree in writing. Visitors may still volunteer sensitive information, which is stored with the conversation. |
| Frequency | Continuous, whenever someone uses one of your forms. |
| Retention | Until you delete it, or until your organization is deleted after it is closed (section 11). At Subprocessors, as listed in Annex 2. |
Annex 2: Subprocessors
This list matches the list in our Privacy Policy. Some of these companies also process information for which we are the controller (section 2.2).
| Subprocessor | What it does | Customer Personal Data it receives | Location | How long it keeps it |
|---|---|---|---|---|
| Vercel | Hosts the app | Every request to forms and booking pages, including visitors' IP addresses and browser details | United States | Logs for up to 1 day |
| Supabase | Database and sign-in | Conversations, answers, scores, routing decisions, meetings, and the names and email addresses of the people you add | United States (Oregon) | Until deleted under section 11; logs for up to 7 days |
| Anthropic | AI models that carry out conversations | Each conversation, with your form's instructions | United States company; processing may take place in other countries | Up to 30 days; up to 2 years if flagged by its safety systems, and up to 7 years for its safety scores |
| Resend | Email delivery | Lead emails to your recipients, with visitors' answers and conversations; booking emails to visitors; requests to confirm the addresses of the people you add | United States | 30 days |
| Sentry | Error reporting | Error reports (with request contents, cookies, and headers removed, and email addresses and phone numbers redacted from error messages); page-load notices with browser details | United States | Up to 90 days |
| Cloudflare | The bot check on forms (Turnstile) | None as a Subprocessor. The bot check's signals (a visitor's IP address, browser details, and other signals) are records we control for security (section 2.2). Cloudflare also uses them, as a controller, to improve its bot detection. | Worldwide network | Under Cloudflare's Turnstile Privacy Addendum |
| Fonts, only if you choose one for your form; our company email; and calendar availability for connected calendars | Visitors' IP addresses and browser details when a form or its booking page loads a Google font; anything you email us. Calendar availability involves no Customer Personal Data. | United States and other countries | Fonts: under Google's terms. Email: as long as needed to help you. | |
| Stripe | Payments | None. Stripe processes billing information, for which we are the controller. | United States and other countries | Not applicable |
Annex 3: Security measures
Encryption
- Every connection to the Qualiform app uses HTTPS, and the app tells browsers, through a 2-year Strict-Transport-Security header, to accept nothing else.
- The conversation state a visitor's browser carries between messages is sealed with AES-256-GCM, so it cannot be read or changed on the device. Production refuses to run a conversation without the sealing key, and refuses a state that was not sealed.
- Credentials for connected services (calendar tokens, Slack webhook addresses, webhook signing secrets, and the Google Analytics secret) are encrypted with AES-256-GCM under a key held only in the server environment, bound to their own record, and kept in a table that no browser role can read.
Access control
- Row-level security is enabled on every database table. Measured with the public key, reads of leads, organizations, meetings, credentials, and billing records are refused.
- Automated checks confirm that database functions that bypass row-level security are closed to browser roles.
- Three roles: Admin, User, and Guest. A Guest reads only contact details, answers, and conversations on the forms they are on, as a host or an email recipient, through dedicated functions, and never a score.
- Access to production data is limited to the operator of the service.
Storing as little as possible
- Visitors' IP addresses are not stored with conversations. Rate limits store only a truncated SHA-256 hash of an IP address, and meetings store only a keyed hash.
- In our database, booking links and calendar connection links are stored only as hashes, meeting links are derived from a stored random value, and confirmation and unsubscribe links are signed, not stored.
- Requests to stop email are stored as a hash of the address, never the address.
- Calendar availability is read at the moment it is needed and never stored, and only the free/busy permission is requested. An automated check plants meeting titles, guests, locations, and descriptions in a test calendar and confirms that none reaches a table, a log, a lead, or a delivery.
- Error reports exclude request contents, cookies, headers, and user details, and email addresses and phone numbers are redacted from error messages. Session replay and performance tracing are off.
Preventing abuse
- Rate limits per IP address on conversations (30 messages per 10 minutes and 200 per day), on booking (120 page reads per 10 minutes, and 10 bookings, moves, or cancellations per 10 minutes and 40 per day), and on the other public pages.
- Cloudflare Turnstile on a conversation's first message, a hidden field that catches bots, and checks for junk messages before any AI processing.
- Monthly limits per organization on conversations and on AI cost.
- Links for connecting a calendar work once and expire after 24 hours. Links for confirming an email address expire after 7 days.
- Pages that carry private links tell browsers not to cache them, not to pass them on as a referrer, and not to index them.
- A form can be limited to the websites its owner lists.
- Spreadsheet exports stop cells from running as formulas.
- Incoming payment events from Stripe are checked against Stripe's signature, and outgoing webhooks are signed with HMAC-SHA256 when a signing secret is set.
Testing changes
- We test changes with automated checks, including checks of the calendar boundary, the sealing of visitors' conversation state, database function permissions, what each role can read, and organization closure.
Location and deletion
- The database is in the United States (Oregon), and the app runs in the United States (Washington, D.C.).
- Closing an organization stops its forms within about a minute, and a daily cleanup deletes everything in it once 14 days have passed (later only while a visitor is still to be told that a meeting is canceled). Deleting a lead removes it with its booking links and holds, and erases the details of the person who booked from its meetings.