Privacy and your data

What Cayve receives

For each submission your site sends:

• the fields of the form, comment, review or sign-up;
• the sender’s IP address and browser, the page and the form;
• how the form was filled in: how long it was open, whether the page script ran, the hidden field and the form’s security token;
• if you switch on the typing summary in the plugin, counts of key presses, pastes and pointer movement. Never the keys themselves.

How long it’s kept

What	Kept for
Message text, names and email addresses	30 days, then deleted
The decision, score and reasons	As long as your account
Network fingerprints (one-way hashes)	3 days; spam marks from other accounts 90 days
Scrubbed learning copies	Up to 12 months, unless switched off
Held messages in your WordPress database	90 days

Help Cayve learn

Owners and admins can switch Help Cayve learn on or off under Account → Settings. When it’s on, Cayve keeps a scrubbed, encrypted copy of each message, with names, email addresses, phone numbers, links and address fields removed, to improve detection. Switching it off deletes your account’s copies.

Telling your visitors

You decide what your forms collect, so mention Cayve in your own privacy policy. Something like this works for most sites:

We use Cayve to protect our forms from spam. When you send a form, its contents, your IP address and browser details are checked by Cayve, which deletes the message text after 30 days.

Deleting your data

Revoking a site’s keys stops new checks for it. To close your account and delete its data, an owner can email us from the account’s address. See the privacy policy for your rights.