Privacy Policy

A form backend sits between two parties, and privacy law treats them differently. Getting this distinction right is the whole basis of the rest of this document.

• Customers. People with a WebForms account. For their account data we are the controller: we decide what to collect and why.
• Form respondents. People who submit one of our customers' forms. For that data we are a processor: the customer decides what to ask for and why, and we only act on their instructions.

Only what an account needs to function. There is no enrichment, no profile building, no data bought from third parties.

The form fields themselves are chosen by our customer, not by us. We store whatever their form sends. Alongside that we record a small amount of technical metadata, because a form endpoint that cannot tell a person from a bot is unusable:

• IP address of the submitting device, for rate limiting and abuse investigation
• Browser user agent, for spam scoring
• Referring page and origin, so a key stolen from one site cannot be used from another
• Time taken to fill the form, because a form completed in under a second was not completed by a human

That metadata exists for security, and we do not use it to build a profile of anyone or track people between sites.

We run no advertising pixels and no third-party ad trackers, and nothing at all on the pages where your form is embedded. Our script does not follow your visitors around.

On this website only, we measure page views with Umami, a cookieless analytics service. It records the page you viewed, the referring site and coarse device and country information. It sets no cookies, assigns no cross-site identifier, and we cannot use it to identify you or follow you to another site.

The only cookies we set are the ones sign-in cannot work without:

• A session cookie on .webforms.to, so the dashboard knows who you are
• A short-lived cache of that session, to avoid a database read on every page load

These are strictly necessary cookies, which is why you are not being shown a consent banner. Our analytics sets no cookies at all, so there is nothing optional to consent to.

Submissions are deleted automatically once they pass your plan's retention window. This runs as a scheduled job, not on request:

• Free: 30 days
• Pro: 180 days
• Agency: 365 days

Uploaded files are removed sooner than the submissions that carry them: 30 days after upload on plans that accept attachments. The submission record survives its full window, but the file itself is deleted from storage.

When a submission is purged, the delivery records attached to it go with it, because those contain a copy of what was submitted. Deleting one and keeping the other would be theatre.

Account data is kept while the account is open. Delete the account and we remove it, along with every form, submission, and delivery record belonging to it, within 30 days. Backups age out on their own cycle, described in the Data Processing Agreement.

On servers in Germany, inside the EU. Submissions and account records do not leave that infrastructure except when your own configuration sends them somewhere.

That last part matters. If you route submissions to Slack, Notion, Airtable, a webhook, or anywhere else, you are instructing us to transmit that data to a service you chose. What happens to it there is governed by your relationship with that service, not by this policy.

We keep the list short deliberately. Every vendor is a place your data could leak from.

The spam classifiers are the only subprocessors that see submission content, and only for submissions the cheap checks cannot decide on their own. They receive the submitted fields, nothing about your account, and they are contractually barred from training on what they receive. If you would rather no third party saw any submission, turn AI spam detection off for the form and the deterministic filter runs alone.

If you enable a captcha, the challenge is verified by whichever provider you chose (Cloudflare Turnstile, hCaptcha, or Google reCAPTCHA). That is your configuration choice and it sends the challenge token to them.

We will post changes to this list here before a new subprocessor starts handling customer data.

We do not sell personal data. We do not share it with advertisers. We do not use form submissions to train machine learning models. We do not read your submissions except when you ask us to help debug something, or where we are legally compelled.

If you are in the UK, EU, or another region with comparable law, you can ask us to give you a copy of your data, correct it, delete it, restrict how it is used, or object to that use. Email help@webforms.to and we will respond within 30 days.

Requests about a submission rather than an account go to the customer who operates the form, for the reasons in clause 1. We will help them fulfil it.

You can also complain to your local data protection authority. We would rather you told us first so we can fix it.

Traffic is encrypted in transit with TLS. Passwords are hashed. API keys are stored hashed, which is why we can only show you a secret key once. Webhook payloads are signed so your receiving endpoint can verify they came from us and were not altered.

No system is perfectly secure. If we discover a breach affecting your data we will tell you without undue delay, and within 72 hours where the law requires it.

Found a vulnerability? Email help@webforms.to. We will not pursue action against good-faith research that avoids privacy violations and service degradation.

WebForms is not intended for children under 16, and we do not knowingly create accounts for them. If you believe a child has given us data, email us and we will delete it.

If we change something that materially affects your rights, we will email account holders before it takes effect rather than quietly editing this page. The date at the top always reflects the current version.

Questions: help@webforms.to