Privacy Policy

Form2Lead ("we", "our", or "us") operates form submission infrastructure. This Privacy Policy describes how we process customer account details and form submission payloads.

1. Information We Process

We process account data (email, name, authentication tokens) and form submission payloads sent to your configured form endpoints.

2. Data Security & Retention

Submissions are encrypted in transit via TLS 1.3 and stored securely in Neon PostgreSQL. Submission retention is governed by your active subscription plan.

3. Retention Windows by Plan

We retain submission payloads only for the window defined by your active plan, after which records are hard-deleted by an automated daily process (attached file objects are deleted first): Free — 7 days; Basic — 14 days; Starter — 30 days (1 month); Growth — 120 days (4 months). These windows mirror the public pricing catalog. Provider-level backups rotate on the infrastructure provider's own schedule.

4. Deletion & Export

Deleting a submission in the dashboard hides it immediately from the inbox, submission counts, and CSV export, and it is permanently purged together with its attached files within 30 days. CSV export is self-serve on every plan, including the $0 Free plan. Email alerts are optional per form: forms without a configured notification email are dashboard/webhook-only, and no email copy of those submissions is created or retained.

5. Sub-processors

We engage a minimal set of sub-processors: Resend (email delivery, only when a form has email configured), Neon (Postgres database and object storage, AES-256 disk encryption with keys held by the infrastructure provider), Upstash Redis (IP rate-limit counters only — never submission content), Cloudflare Turnstile (bot verification on account and support forms; the visitor's IP address and challenge metadata are sent to Cloudflare only to validate the challenge), Razorpay (billing), and PostHog (product analytics for our dashboard, not submitter tracking). We do not sell personal data, run no advertising, and train no AI models on submission content. Submission ingestion sets no cookies and runs no submitter analytics.

6. Data Processing Agreements & Contact

We follow GDPR-ready practices including scoped access, inspectability, export, and deletion. To request a Data Processing Agreement (DPA), exercise access/erasure rights, or ask privacy questions, contact us via the contact page or email security@form2lead.com. Security disclosures follow our RFC 9116 policy at /.well-known/security.txt. Also see our security trust center for transport, storage, and lifecycle details.