Where Your Form Submissions Live, and How Long to Keep Them

Short answer: keep submissions only as long as the purpose you collected them for requires — dead enquiries six to twelve months, customer records for your accounting retention period, applications for a period you publish — and remember that the notification email and the CSV export are copies you are equally responsible for. A twice-yearly clear-out is the whole practice.

Nobody sets out to build a personal-data archive. You put a contact form on a website because you wanted phone calls. Four years later that form holds eleven thousand submissions containing names, phone numbers, home addresses, photographs of the insides of people's houses, and in a few cases things they typed into a "anything else we should know" box that they would not have written down if they had thought about it.

This is not a compliance lecture. It is the observation that a form is a database, it grows without attention, and a small amount of structure makes it manageable rather than a thing you hope nobody asks about.

Know where the copies are

The most common mistake is thinking of submissions as living in one place. They almost never do.

The platform. Wherever your form builder stores them. This is the copy people think of, and usually the best-protected one.

Every notification email. The moment the form emails the submission to you, a copy exists in that mailbox — and in the mailbox of anyone it was forwarded to, and in the phone that syncs it. Mailboxes are rarely cleared. In practice this is the longest-lived copy of your form data.

Exports. Every CSV anyone has downloaded. On a laptop, in a downloads folder, attached to a message to an accountant. This copy has no access controls at all.

Downstream systems. The CRM record, the spreadsheet a coordinator keeps, the project tool where someone pasted the details.

Write your list down once. It takes ten minutes and it is the only way a deletion request can be answered honestly.

Retention periods you can defend

There is no universal number, because the correct period depends on why you collected the data. What matters is having a stated period and sticking to it.

Data type	Reasonable period	Why
Enquiries that went nowhere	6–12 months	Long enough to reconnect, short enough not to accumulate
Quote requests not taken up	12 months	Seasonal work often comes back a year later
Customer job records	Your accounting retention period	Tax and dispute records usually govern this
Job applications, unsuccessful	A stated period, published	Lets you revisit near-misses for the next opening
Newsletter and marketing contacts	Until they unsubscribe, plus a suppression record	The unsubscribe record must outlive the contact record
Photographs and uploads	Same as their parent record	These are the biggest and most personal files you hold
Anything you cannot justify	Delete now	If you cannot name the purpose, there is no purpose

Check your own jurisdiction's rules for financial records before setting the customer line — that period is set by tax law, not by you.

The privacy note nobody writes

A paragraph is enough for the ordinary business form, and it should answer four questions in plain language: what you collect, why, who sees it, and how someone asks for deletion. Link it near the submit button.

Two things worth including that most notes omit. Say roughly how long you keep it, because that is the question that actually gets asked. And name a real contact route for deletion requests — an address, not a form on another page — because the alternative is that a request arrives as an angry message to whoever answers the phone.

Avoid claims you cannot back. "Bank-level encryption" and "fully GDPR compliant" are the two most-copied phrases on small business websites and neither means anything specific. Saying what you do is stronger than saying what you are certified as.

Collect less

Every field is a liability as well as an asset, and the cheapest privacy improvement available is asking for fewer things.

Look at your busiest form and find the fields nobody has used in the last fifty submissions. A date of birth collected out of habit, a full address where a postcode would do, a "company" field on a residential service form. Each one is data you are storing, protecting and eventually deleting for no return.

There is a conversion argument for the same change — shorter forms complete better — which is covered in how many fields a form should have. The privacy argument is simply that data you never collected cannot leak.

The other half is spam. A form that collects junk is still collecting, and stored junk carries the same handling cost as real submissions with none of the value; stopping contact form spam without a captcha covers keeping it out in the first place.

Access is most of security in practice

For a small business, the realistic risk is not a sophisticated attack on your form vendor. It is a shared login, a departed employee whose access was never removed, or a spreadsheet on a personal laptop.

Three habits cover most of it:

Individual accounts, never a shared one. Shared credentials make it impossible to know who did what and impossible to remove one person cleanly.

Scope access to what the role needs. A technician who needs today's job addresses does not need the last four years of enquiries. The seat-versus-scoped-view distinction is in who on your team should see form submissions.

Remove access on the day someone leaves. Put it in the off-boarding checklist next to the door key. This is the single most common gap and it is entirely procedural.

Exports are the weak point

Exports are indispensable — for reporting, accounting, moving to another system — and they are the copy that escapes every control you have.

A workable discipline: export for a specific purpose, keep it in a shared location with access controls rather than a personal downloads folder, and delete it when the task is done. If you export the same report monthly, it is worth asking whether an integration could send the data where it needs to go without creating a file at all. The options are in form webhooks and APIs versus Zapier, and the export mechanics themselves — including the encoding setting that mangles accented names — are in exporting form submissions to CSV or Excel.

Uploads deserve their own thought

Photographs and documents are personal data with extra properties: they are large, they often contain more than the submitter intended — the inside of a home, a document with a second person's details, metadata including location — and they are the files most likely to be forwarded around.

Treat an upload's retention as inseparable from its record, and be specific in the field label about what you want, because a vague "upload photos" invites more than you asked for. Handling is covered in file and photo uploads on forms.

Things not to collect on a general form

Card numbers. Never. Payment goes through a payment processor whose entire job is handling that data. A card number typed into a form field is a problem you have created for yourself.

Passwords or account credentials. For any reason, including "so we can log in and fix it".

Health information, unless you are a healthcare provider operating under the relevant regime. A general form is not the right container, and "do you have any accessibility requirements for the visit" is a different and legitimate question.

Protected characteristics on a job application. Age, ethnicity, health, family status. If you run diversity monitoring, it goes in a separate, anonymous, optional form that is not attached to the application.

Anything you asked for out of habit. Reread your fields once a year with the question "what would we do with this?" and delete the ones with no answer.

A twice-yearly hour

The whole practice fits in one recurring calendar entry.

Open the submission list and delete anything past its retention period. Open the user list and name every account out loud — hesitation means remove. Check where each form's notifications go and whether that mailbox is still monitored. Ask whether any recurring export could be an integration instead. And reread the busiest form's fields, looking for the one that nobody uses.

An hour, twice a year. It is the difference between a form system you understand and a filing cabinet in the corner that nobody has opened since the previous manager.

Getting started

Do the inventory first — list your live forms, what each collects, where the copies go, and how long you intend to keep them. Most businesses find one form that is collecting something they no longer use, and one distribution list that includes someone who left.

Then write the retention line into your privacy note, put the clear-out in the calendar, and fix the access list. That is the entire programme.

BotForms keeps submissions in one dashboard with individual accounts and scoped team access rather than a shared login, and exports are available on every plan when you need to move data elsewhere. Starter is $29/month with 5 GB of storage, Pro $79 with 25 GB, Business $199 with 100 GB — all with a 30-day trial. See features, pricing, or start a trial.