Acceptable Use Policy

WebForms delivers notification email from shared sending infrastructure. If one account uses it to blast unsolicited mail, our domain reputation suffers and every other customer's contact form starts landing in spam folders.

So this is not a formality. We enforce it, and we would rather lose a customer than lose deliverability for the rest.

Spam and unsolicited messaging

• Using WebForms to send bulk or marketing email. It is a form backend, not an email service provider. Notifications go to you, the form owner, not to lists of people
• Configuring an autoresponder to send anything other than a genuine acknowledgement to the person who just submitted the form
• Submitting other people's addresses to trigger mail they did not ask for

Deception

• Phishing, or any form that impersonates another brand, bank, or person to harvest credentials, payment details, or identity documents
• Collecting data under false pretences, or hiding what a form does
• Forging headers or falsifying the origin of a submission

Illegal and harmful content

• Anything unlawful where you or your users are, including material that infringes copyright or trade secrets
• Child sexual abuse material. We report this to the authorities without warning and without exception
• Content that harasses, threatens, or incites violence against people, or promotes self-harm
• Malware, exploit payloads, or links intended to compromise the person receiving them

Attacks on infrastructure

• Denial of service attempts, whether against us or through us at someone else
• Using webhook destinations to probe internal networks or scan ports
• Deliberately evading quotas, rate limits, or spam filtering, including by cycling accounts or keys
• Probing our systems for vulnerabilities without contacting help@webforms.to first

Sensitive data

Do not collect the following through WebForms unless you have your own lawful basis, appropriate safeguards, and have told us in advance:

• Payment card numbers. There is never a good reason to put these in a form field
• Government identity numbers, passport, or licence details
• Health, biometric, or genetic information
• Political opinions, religious beliefs, trade union membership, or sexual orientation
• Login credentials for any system

You are the one facing your respondents, so you carry these responsibilities:

• Tell people what you collect and why, with a privacy notice they can actually reach from the form
• Ask only for what you need. A newsletter signup does not need a postal address
• Get consent where the law requires it, and keep a record you could show a regulator
• Honour access and deletion requests from your respondents. We will help you action them

Plan quotas assume normal form traffic. Automated load testing against the live ingest endpoint, using a single form as a general purpose data pipeline, or storing submissions purely to use us as a database are all outside what the plans are priced for.

If your legitimate volume is unusual, talk to us. We would rather find a plan that fits than throttle you unexpectedly.

Proportionate to what is happening:

1. A warning by email for most first issues, with time to fix it
2. Rate limiting or feature suspension where the problem is ongoing but not malicious
3. Immediate suspension for phishing, illegal content, attacks, or anything threatening our sending reputation
4. Termination and, where required, referral to authorities for serious or repeated abuse

We do not refund fees for an account terminated for abuse.

If you have received unwanted mail sent through WebForms, or found a form using us to phish, email help@webforms.to. Include full message headers if you have them, since they let us identify the exact form and shut it down quickly.

We investigate every report and we do not share your identity with the account you are reporting.

We may update this policy as new abuse patterns appear. Material changes are emailed to account holders. Continued use means acceptance, and this policy forms part of the Terms of Service.