Get early access

GDPR and privacy settings

IP anonymisation, data retention, consent, and the WordPress export and erasure tools.

Sense Forms gives you the tools to handle personal data properly. It cannot make you compliant on its own — that depends on what you collect, what you tell visitors, and your lawful basis for it.

Settings

Anonymise IP addresses — removes the last octet before storage, so 203.0.113.47 becomes 203.0.113.0. Enough to distinguish visitors in aggregate; not enough to identify a household.

Respect Do Not Track — skips tracking entirely for visitors whose browser sends a DNT header.

Data retention — deletes entries older than a number of days you set. A daily scheduled task handles it.

Disable entry storage — accepts submissions and sends notifications without writing them to the database. Suits sites that want the email but no stored record.

Disable user cookies — stops the visitor cookie being set. Attribution still works within a single page view but sessions and journeys cannot be linked.

Disable user details — stops device, browser, screen and language being recorded while keeping traffic source and UTM data.

A field type that adds a consent checkbox with wording you control. Add it to any form collecting personal data.

Write the label yourself and make it specific. “I agree to the privacy policy” is weaker than “I agree to Acme Ltd storing my details to respond to this enquiry” — consent has to be informed to count.

WordPress export and erasure

Sense Forms registers with WordPress’s built-in privacy tools, so Tools → Export Personal Data and Tools → Erase Personal Data include Sense Forms submissions automatically.

When someone exercises a subject access or erasure request, the standard WordPress workflow covers your form data without extra work.

What to put in your privacy policy

At minimum, disclose:

  • That you collect form submissions and what fields they include
  • That you record how visitors arrived — traffic source, UTM parameters, referring page
  • That pages viewed during a visit are recorded
  • That a first-party cookie stores a visitor identifier, and its duration
  • How long you keep entries
  • If reCAPTCHA is enabled, that data is sent to Google, with a link to their policy

Deleting everything

Remove all data on uninstall is off by default, so deleting the plugin leaves your data intact. Turn it on before deleting if you want the tables removed.

Enable it before deleting the plugin. Once the files are gone the setting cannot run.