How Sendform handles data

• Submission fields exactly as sent, minus reserved control fields (_redirect, _subject, honeypot, bot-check tokens and similar).
• Uploaded files, in private storage, reachable only through short-lived signed links.
• Spam score and reason, plus a content hash used to spot duplicate posts.
• Browser user-agent string.
• IP addresses only as salted hashes. The raw IP is never stored; a SHA-256 hash with a secret server-side salt is kept for rate limiting and duplicate detection.
• Webhook delivery logs (status, HTTP code, error) — not the response body.
• Form owner accounts: email address, plan, and form settings.

• Each form keeps submissions for 30, 90 or 365 days (default) — or forever, if the owner chooses. On the Free plan submissions are kept for at most 90 days.
• Spam auto-cleanup: submissions marked as spam, and their files, are deleted after 30 days regardless of the form’s retention setting.
• Deleting a submission also deletes its files and webhook logs.

The Sendform website uses no analytics, no tracking IDs and no advertising cookies, so there is no cookie banner. Only these things are stored, all strictly necessary:

• Sign-in session (form owners only): when you sign in, our authentication provider (Supabase) keeps your session in your browser’s local storage (sb-daflnpwrvuzwoazwvbep-auth-token) so you stay signed in. Signing out removes it.
• Security cookie: our hosting network (Cloudflare) sets a __cf_bm cookie for about 30 minutes to tell people from bots.
• Hosting cookie: our website host (Lovable) sets a __dpl cookie for 24 hours so every page you open comes from the same version of the site.
• Scroll position: your browser’s session storage keeps tsr-scroll-restoration-v1_3 so the back button returns you to the same place. It is deleted when you close the tab.

Strictly necessary storage needs no consent (Swedish Electronic Communications Act, ch. 9 § 28). Legal basis: GDPR Art. 6(1)(b) for the sign-in session; Art. 6(1)(f), our legitimate interest in keeping the site secure, for the security and hosting cookies and the scroll position. Fonts are served from sendform.app; no request goes to a font provider. An older version of one page stored a random visitor ID (sf_funnel); it is no longer used and your browser deletes it on your next visit.

If you submitted a form and want your data removed or a copy of it, contact the site you submitted to. Form owners have two built-in tools in their dashboard:

• Erase data for an email address — deletes every matching submission and file across their forms (GDPR Art. 17).
• Export data for an email address — a JSON copy of every matching submission with 1-hour file links (GDPR Art. 15).

Submission data is stored in the United States (AWS us-west-2, Oregon). Sendform does not currently offer EU-only storage.

• Supabase — database, file storage and authentication.
• Lovable — website hosting (via Cloudflare) and sending notification and autoresponse emails.
• Polar — payments for paid plans (form owners only; submitters are never sent to Polar).
• Cloudflare Turnstile — bot checks, only on forms where the owner enables it.

Form owners can also forward submissions to destinations they configure themselves (their own webhooks, Slack, Discord, Telegram). Those are chosen and controlled by the form owner.

Sendform is operated by Autotune Invest AB, Sweden. For privacy requests, email firstmatecrew@mail.grokbot.com.