Managing entries

Privacy and data

Encryption, IP addresses, keeping less data, retention, consent records and the WordPress personal data tools.

These settings help you collect and keep less personal data. Whether a form meets the law that applies to you depends on what you ask, why, and how you use the answers; check with your adviser.

Collect less

• Store entries (form settings, Storage and privacy): turn it off to keep each entry only until its emails and integrations have run; then its answers are removed. A short record without answers stays for 7 days so you can see whether emails and integrations worked.
• Store in entries (each field, Data and storage): turn it off for answers you only need in an email.
• IP addresses: store in full, store shortened (the last part removed), or do not store. The site default is shortened; each form can override it.
• Store the browser description: on by default; turn it off if you do not need it.
• No cookies for visitors. Showing and sending a form sets no cookie. Saving answers to finish later uses a link instead of a cookie. The only thing kept in the browser is the campaign source of the visit, in the tab's session storage, and only on pages whose form has a campaign field (see Integrations).
• Behind a proxy or CDN. Rate limits and stored addresses use the address that reached your server. If your site sits behind a load balancer or proxy that you run, list its addresses under Settings, Privacy, Trusted proxy addresses; the visitor's address is then taken from the forwarded header, and only from those proxies, so a visitor cannot pass a made up address. Cloudflare's own addresses are recognised automatically.

Encryption

Fields with Encrypt when stored on are encrypted in the database with the site's encryption key, using authenticated encryption from PHP's sodium library (XSalsa20-Poly1305 for answers; files use XChaCha20-Poly1305). Staff see the answers normally.

By default the key is generated on activation and stored in the database. That protects the answers from anyone who can only see the entries tables, but a complete copy of the database includes the key. For real separation, define the key in wp-config.php, so a database copy alone cannot be read (Diagnostics shows which one you use):

define( 'FLVF_ENCRYPTION_KEY', 'a long random value of at least 32 characters' );

Use a random value of at least 32 characters (a password manager can make one); a base64 encoded 32 byte key also works. A shorter value is not used, and Diagnostics reports it. Keep a copy of the value somewhere safe: without it, encrypted answers cannot be read.

Settings, Data can rotate a database-stored key: new data uses the new key and existing encrypted answers are re-encrypted in the background. Take a database backup first. To change a key set in wp-config.php, move the old value to FLVF_ENCRYPTION_KEY_OLD, set the new one, and remove the old one after the re-encryption job in Diagnostics, Jobs has finished.

Search, filters and the personal data tools cannot look inside encrypted answers. If you encrypt the email field, WordPress's export and erase tools can still find entries made by logged in visitors, but not by the email address typed into the form.

Retention

Delete entries after (days) removes entries automatically when they reach that age. Instead of deleting, you can remove personal answers and keep the rest, which keeps counts and non personal answers for reporting. Files are removed with the answers.

Which answers count as personal is decided per field (Data and storage, Personal data): by default text, email, telephone, website, name, address, date, hidden, signature, file, password and repeating group fields are personal, and choices, numbers and ratings are not. You can mark any field yes or no.

Consent

A Consent field stores that the visitor agreed, the exact text they agreed to, and a short fingerprint of that text, so you can tell later which wording was shown. Changing the text changes the fingerprint for new entries.

WordPress personal data tools

Tools, Export Personal Data and Erase Personal Data include form entries. Entries are found by the email address typed into email fields and by the account of a logged in visitor.

• Export includes the personal answers of each entry with the form name and date.
• Erase either removes the personal answers and keeps the rest of the entry, or deletes the whole entry, as set in Settings, Privacy.

Outside services

The plugin itself sends no data anywhere. Data leaves your site only through services you set up: your mail transport, payment providers, integrations, challenge services (reCAPTCHA, hCaptcha, Turnstile), Akismet, address suggestions from Google Maps Platform, and, once you save a licence key, the Flavonto licence server (key, site address and plugin version only). List the ones you use in your privacy policy.