Written to be read, not to be survived.
When someone submits your contact form, we store what they submitted: their name, email address and message if your form collects them, plus the network address it came from. We need it because you have to be able to look at a held message and decide whether we were wrong.
30 days, then it is permanently deleted. That applies to everything equally, genuine and junk alike, and it happens automatically. You can shorten the window in your settings.
After a message is deleted we keep only anonymous counts, so your accuracy figures still work. Those counts contain no names, no addresses, no message content.
Submissions are analysed automatically by our detection technology to decide whether they are genuine. No person reads your enquiries as part of that process.
Nobody, other than the infrastructure providers who host the service on our behalf. We do not sell data, we do not share it with advertisers, and we do not use your enquiries to build products for anyone else.
The people who fill in your form never agreed to anything with us, so we hold their information on your behalf, minimally and briefly. If someone asks you to remove their submission, delete it from your dashboard and it is gone.
Everything is encrypted in transit and at rest.
Backups are encrypted too, and they are held slightly longer than the messages themselves so that a restore stays possible: a deleted message is fully purged from our backups within 35 days. We would rather tell you about that five day tail than claim a deletion is instant everywhere when it is not.