GDPR compliance and data handling

When you collect personal data with a Formclick form, you are the data controller and Formclick processes the data on your behalf to deliver the service.

What is stored

• The fields your visitor submits (control fields like access_key and botcheck are removed).
• Submission time, the page it came from, IP address and browser user agent (used for spam and abuse prevention).
• Files uploaded through your forms. Our privacy policy states these are kept for 30 days.

How it is protected

• TLS encryption for every request, and encryption at rest for sensitive data such as integration credentials.
• Access to data limited to authorised personnel.
• If you close your account, personal data is deleted within 30 days, except where the law requires us to keep it.

Your checklist

• Tell visitors how you use their data, and link to your privacy policy near the form.
• Only collect the fields you need.
• Add a consent checkbox when you need explicit consent, e.g. for marketing emails.
• Delete submissions you no longer need. See Delete your submission data.

<label>
  <input type="checkbox" name="marketing_consent" value="yes" required>
  I agree to receive emails. See our <a href="/privacy">privacy policy</a>.
</label>

Read the full Privacy Policy. Data requests (access, correction, erasure) go to support@formclick.io; we respond within 30 days.