Privacy kit

Formsieve sends form content to an outside AI service, so it comes with the tools you need to do that carefully: consent before anything is sent, data minimisation, a visitor-facing notice, privacy-policy text, personal-data export and erasure, and log retention. As the site owner you remain the controller of your visitors' data; Formsieve does not make a site compliant with any law by itself.

Nothing leaves your site until an administrator has chosen a route and ticked the consent box. The consent screen is generated from the route and names every recipient (the gateway and TypeSafe AI, Inc. on a gateway route), its country and its role, with links to its privacy policy, data processing agreement and terms, plus what is sent and what a check costs. The record stores a hash of the route and the recipients, the time and the administrator.

Withdraw consent on the plugin's Privacy tab at any time: checks stop immediately and submissions are delivered unchecked.
Changing the route asks again, because the recipients change.
Test mode needs no consent record, because it sends nothing. Test connection sends one canned sample, only when you click it and only after consent for that route.

Data minimisation

Only the domain of the sender's e-mail address is sent (switch off Email domain under Settings → Privacy to send none).
Phone numbers are redacted in field values by default (Phone numbers under Settings → Privacy).
No IP address or user agent is ever sent. IPs are hashed on your server for the rate limit and never leave it. On a Gravity Forms form set not to store IP addresses (Personal Data settings), Formsieve does not use the IP at all. When a form uses Contact Form 7's do_not_store setting, or the visitor leaves a consent_for:storage box unticked, Formsieve's log keeps the verdict but no IP or e-mail hash.
Passwords, payment and card fields, uploads, hidden fields, consent and CAPTCHA fields are never sent.
Sensitive fields are excluded automatically: fields whose label, name or type suggests health or medical data, national ID or social security numbers, passports, driving licences, bank or card numbers, or secrets. Forms that look medical or legal show a warning on the settings screen so you can review them.
Exclude any other field per form (Per-form settings for Gravity Forms, Per-form settings for Contact Form 7).
HTML is removed and every value is capped (2,000 characters per field, 4,000 for the message, about 12 KB in total).

Notice to visitors

AI notice under forms (Settings → Privacy) adds "Submissions are screened for spam by an automated AI service." under the form. Automatic (the default) turns it on for the Vercel AI Gateway route, whose AI Product Terms require telling end users in advance that the application uses AI, and off elsewhere. Choose Always show or Never show to override it globally, or Show / Hide in a form's own Formsieve settings.

Privacy-policy text

Formsieve adds suggested text to WordPress's Settings → Privacy → Policy Guide, generated from your route and your privacy settings. It tells visitors, in plain language:

what is sent (the text typed into the form with its field labels, the domain of the e-mail address unless you switched that off, and a few technical numbers such as the time taken to fill in the form and the number of links);
what is not sent (IP address, full e-mail address, browser details, and fields that look like passwords, payment, bank, identity or health data; phone numbers are replaced when redaction is on);
which companies receive it, in order, with their countries and privacy-policy links (for OpenRouter: OpenRouter, Inc. and then TypeSafe AI, Inc., both in the USA);
that the result is a spam probability used only to deliver, flag or file the submission as spam, and that an administrator can correct the decision;
how long the result (never the message) is kept, from your retention setting.

Copy it into your privacy policy and adapt it with your own advisers; update it when you change routes.

Export and erasure

Formsieve registers with WordPress's personal-data tools (Tools → Export Personal Data and Tools → Erase Personal Data), matching by e-mail address through its hash:

Export lists each Formsieve decision linked to the address (date, form, entry reference, verdict, probability, category, deciding stage, reason code, route and any correction) and whether the address is on a learned list.
Erasure deletes those log rows and removes the address from the learned trusted and blocked lists.

Matching uses a hash keyed with your site's authentication salt. Rows logged before a salt change can no longer be matched to an address; they hold no readable address and are deleted by the retention task (Troubleshooting).

The submission itself is stored by Gravity Forms as an entry or Flamingo as a message and is exported and erased by that plugin's own tools.

Retention

The decision log holds numbers and identifiers only, never what the visitor typed. A daily task deletes rows older than the retention period (Keep decision log for under Settings → Privacy): 30 days, 90 days (default), 1 year, or keep until deleted. The replay cache keeps hashed verdicts for 7 days (only while Replay cache is on), rate-limit counters (only while Rate limit is on) expire after their window, and the counters of the cost caps (only while a cap is set) expire after two hours (hourly cap) or 32 days (monthly cap). The learned trusted and blocked senders (e-mail hashes) are not subject to the retention period: they stay until an erasure request for that address, or until the plugin is deleted with Uninstall on.

Uninstall

Deactivating Formsieve deletes nothing. Deleting the plugin always removes its scheduled daily task, and removes its data (settings, key, consent, learned lists, log table and transients, plus the Formsieve details stored on entries, plus the Formsieve form settings and the Formsieve details stored on Flamingo messages) only when Settings → Advanced → Uninstall ("Delete all Formsieve data when the plugin is deleted") is on (off by default), so a reinstall keeps your setup.