Is it legal to save form data before the user submits?

It depends on where you and your visitors are. Tell people in your privacy policy, keep only what you need, and in the EU and UK ask for consent first where the law requires it, for example by loading the capture script only after consent.

What should never be captured from a partially filled form?

Passwords, card numbers and other credentials, one-time codes, uploaded files and hidden fields. None of them help a follow-up and all of them are a liability.

When should a partial form be deleted?

As soon as the visitor submits the real form, so you never contact someone twice, and otherwise after a short retention period such as 30 days.

Recover abandoned form leads (partial form capture)

To recover leads from abandoned forms, save what a visitor has typed as they fill the form in, but only once they have entered an email address, so there is someone to follow up with. Never keep passwords, card numbers or files; delete the saved copy the moment they submit for real, and otherwise after a few weeks; and say in your privacy policy that you do this.

How many people abandon forms?

On most sites, more start the form than finish it, often by a wide margin, and the gap grows with every extra field. Some of that is people changing their mind. A lot of it is distraction: a phone call, a tab switch, a question the form asked that they could not answer right then. Those people got as far as typing, which makes them some of the most interested visitors you had that day.

Why wait for an email address?

Because before it there is nothing to act on. Half a message with no way to reply is noise, and keeping it is all risk and no value. The email is the point where a partial form becomes a lead you can actually help. It also keeps the volume sane: you are not storing every stray keystroke from every visitor.

What must never be captured?

Password fields, whatever they are called.
Card numbers, card security codes and one-time codes, including anything a browser would autofill as payment data.
File uploads: large, and rarely needed to start a conversation.
Hidden fields: they are yours, not the visitor's.

How should you follow up?

Briefly, personally and once. "I saw you started asking about a quote for a bathroom refit; happy to help if you still need it" works. A drip sequence for someone who never pressed Send does not, and can turn an interested visitor into a complaint. If they submit the real form later, the partial copy should already be gone, so the two never cross.

How do you stay on the right side of privacy?

Say it plainly in your privacy policy: you save what is typed into the form so you can follow up if it is not finished.
Where consent is required, load the capture script only after the visitor agrees.
Keep the retention short and automatic.
Do not share partial forms with other tools or lists; they are for one follow-up.

Keeping unfinished forms in WebForms

In a form's Settings, tick Keep unfinished forms and add one script tag to the page. From then on, when a visitor leaves a field or the page, what they have typed is saved once there is an email address in it. Password, file, hidden, card and one-time-code fields are never read, and anything shaped like a card number is dropped. Unfinished forms appear in the form's Unfinished tab, are never sent to your destinations, never count toward your monthly submissions, and are deleted when that visitor submits or after 30 days. The same script also makes the form ready for AI agents. Available on Pro and Agency, and over the API and MCP.

index.html

<script src="https://send.webforms.to/webforms.js" defer></script>

Form abandonment: how to recover leads from people who never pressed Send