Legal

Sub-processors

Last updated 15 June 2026

Fillo uses a small number of sub-processors to run the service. Each one is listed below with what it does, what data it touches, and where it’s located.

Railway

European Union

Cloud hosting and managed PostgreSQL database — the application and where your account data and responses live.

Data: Account data, form definitions, response data and metadata.

Resend

United States (SCCs)

Transactional email — owner notifications and respondent receipts. Only used when email notifications are enabled.

Data: Recipient email address and email content.

Anthropic

United States (SCCs)

Optional “Draft with AI”. Only used when a form is drafted with AI; it never receives form responses.

Data: The prompt text you type to draft a form.

Not sub-processors: your own storage

Uploaded files never pass through Fillo. You connect your own Google Drive or S3-compatible bucket (AWS S3, Cloudflare R2, Backblaze B2, MinIO), and files upload browser-direct to it. Those providers are controlled by you, not engaged by us. Google is also an optional sign-in provider (scope openid email plus drive.file, which only sees files this app creates).

Changes

Before we add or replace a sub-processor we’ll update this page. Account holders can ask to be notified of changes at [privacy contact email].