When someone sends your contact form, the message usually goes further than your inbox. If a spam filter checks it, that filter sees what they wrote, their email address and their IP address. Your visitors deserve to know, and in many places the law expects you to tell them.
This post is general information, not legal advice. If you have specific obligations, check with a lawyer.
What to cover
A good privacy policy explains, in plain words:
- That form submissions are checked for spam, and by which service.
- What’s sent: the contents of the form, the sender’s IP address and browser details.
- Why: to protect your site and inbox from spam and abuse.
- How long it’s kept by the spam filter.
In the EU and UK, processing like this commonly relies on “legitimate interests” under Article 6(1)(f) of the GDPR, and Recital 49 recognizes network and information security as a legitimate interest. Other places have their own rules; the safest approach everywhere is to be clear and specific.
A sample paragraph
If you use Cayve, you can adapt this:
We use Cayve to protect our forms from spam. When you send a form on this site, its contents, your IP address and your browser details are checked by Cayve to decide whether the submission is spam. Cayve deletes the message text after 30 days.
If you’ve left Help Cayve learn switched on in your account, you may want to add that a scrubbed copy, with names, email addresses, phone numbers and links removed, is kept for up to 12 months to improve spam detection.
Keeping it true
Whatever you write, make sure it matches what actually happens. Cayve’s privacy and data guide lists exactly what it receives and how long each part is kept, so you can check your wording against it.