GDPR Consent and Data RetentionPRO
Practical guidance for using FormForge Pro on GDPR-scope websites. This page covers the Consent checkbox field, where your entry data physically lives, how to handle data-subject access and erasure requests today, and what’s coming in a future release. Reading time about 8 minutes; the whole doc is aimed at a site owner working through a compliance review, not a lawyer.
GDPR compliance depends on your jurisdiction, your industry, and how you use the data you collect. This page describes what FormForge Pro does today and what it doesn’t; it doesn’t say whether that’s enough for your specific case. When in doubt, consult a lawyer or your data protection officer.
Where entry data is stored
FormForge Pro stores everything in your own WordPress database. Five tables get created on plugin activation, all prefixed with wp_rfp_:
wp_rfp_forms: form definitions (fields, settings, layout). No personal data.wp_rfp_entries: form submissions, one row per submission. Contains JSON-serialized field values plus metadata: submitter IP address, user agent, source URL, submission timestamp, WordPress user ID if logged in.wp_rfp_entry_meta: extra metadata per entry (edit tokens, quiz scores, integration status flags).wp_rfp_saved_entries: partial submissions saved via the Save & Continue feature. Contains resume tokens plus a copy of the partial entry data plus the visitor’s email address so the resume link can be sent to them.wp_rfp_partial_entries: session-tracked partial fills (for the Partial Entries feature). Contains session ID, IP address, and whatever the visitor typed before abandoning the form.
File uploads (from File Upload fields) land in your WordPress uploads directory, typically wp-content/uploads/YYYY/MM/. These files are stored on disk but are NOT registered as WordPress attachments in the Media Library (FormForge uses wp_handle_upload() without a follow-up wp_insert_attachment()). This matters for deletion: you can’t remove these files from the Media Library UI.
FormForge Pro doesn’t phone home. No analytics, no telemetry, no entry data, no personally identifiable information reaches Royal Plugins servers as part of normal operation. The only outbound calls are: license validation (a per-site heartbeat that carries the site URL and license key, no form data) and any third-party integrations you explicitly configure (Mailchimp, PayPal, Stripe, reCAPTCHA, etc). Data location and jurisdiction are entirely under your control (your hosting provider’s data center).
Add a Consent checkbox to a form
The Consent field is a real field type in the palette. It renders as a checkbox with your consent text next to it and, when marked Required, blocks form submission until the visitor ticks it.
Open the form in the builder
Go to FormForge > All Forms and click the form.
Drag the Consent field onto the canvas
Find Consent in the Advanced Fields section of the field palette (its icon is a lock / privacy shield). Drag it onto the canvas at the bottom of the form, right before the Submit button, which is the visitor-familiar placement for consent language.
Set the label to your consent text
In the field settings panel, set the Label to your consent copy: something like “I agree to the privacy policy and terms of service, and I consent to receiving occasional emails from Your Business.” Keep it specific about what the visitor is agreeing to; vague blanket-consent language doesn’t hold up under GDPR’s specificity requirement.
Check Required
In the field settings, check Required. This forces the checkbox to be ticked before the form can submit. Under GDPR’s active-consent principle, pre-ticked boxes don’t count as consent, so leave the default (unchecked) alone.
Save the form
Click Save Form. The consent checkbox now appears on every embedded copy of the form.
The current admin UI accepts plain text for the consent label, which is escaped when rendered (HTML links appear as literal text, not clickable). If you need an inline HTML link to your privacy policy inside the consent text, that requires setting the field’s consent_text property programmatically for now (the render path at class-formforge-field.php:1461-1484 passes it through wp_kses_post and renders it correctly). A rich-text setting for consent text is planned for a future release; for the current release, most customers put the privacy-policy link as a separate line above or below the consent checkbox using a Section or HTML field.
Handling data-subject requests
GDPR Articles 15 (right of access) and 17 (right to erasure, aka “right to be forgotten”) give data subjects the right to see what personal data you hold about them and to demand you delete it. Here’s the current-release FormForge Pro workflow for both.
Data-access request (Article 15)
Go to FormForge > Entries
In the WordPress admin, open the FormForge Entries page.
Export All to CSV for each form the requester might have used
The Entries admin doesn’t have a free-text search field in the current release, only a form-selector filter. So the workable approach is: use the form-selector dropdown to pick a form, click Export All to CSV, open the CSV in a spreadsheet, filter or grep by the requester’s email. Repeat for every form on the site.
Filter the CSV(s) for the requester’s email
Open each CSV in Excel / Google Sheets / Numbers, filter every column for the email address, extract the matching rows.
Include partial-fill data if applicable
If your site uses Save & Continue or Partial Entries, those tables (wp_rfp_saved_entries, wp_rfp_partial_entries) can hold data about the requester too but aren’t exposed via the Entries admin UI. Query them directly via a database tool (phpMyAdmin, Adminer, or WP-CLI: wp db query "SELECT * FROM wp_rfp_saved_entries WHERE user_email = ‘requester@example.com’").
Deliver the filtered data to the data subject
Send via a secure channel (encrypted email, password-protected download). GDPR requires the response within 30 days of the request. Keep a record of the request and your response for your compliance audit trail.
Erasure request (Article 17)
Find every entry containing the requester’s email
Same approach as the access request above: export each form’s entries to CSV, filter for the email in a spreadsheet, note the entry IDs to delete. Also check wp_rfp_saved_entries and wp_rfp_partial_entries via a database tool.
Delete each matching entry from FormForge > Entries
Open the entry row, click the Delete row-action. Deletion is immediate; there’s no soft-delete or trash in the current release.
Delete matching rows from the partial-fill tables via database tool
DELETE FROM wp_rfp_saved_entries WHERE user_email = 'requester@example.com'; plus the same on wp_rfp_partial_entries filtered by the appropriate column. Only do this if your site actually uses Save & Continue or Partial Entries; otherwise those tables are empty and this step is skippable.
Delete any file uploads the visitor submitted
Deleting an entry does not automatically delete file uploads. And the files aren’t in the Media Library either (FormForge stores them on disk but doesn’t register them as WordPress attachments). To remove them, use FTP / SFTP / your host’s file manager / SSH to navigate to wp-content/uploads/YYYY/MM/ and delete the specific files. Note the filenames from the entry data before you delete the entry; otherwise you lose the reference. This is a real gap for requests involving job-application, contract, or ID-upload forms.
Cascade to third-party integrations
If the entry was pushed to Mailchimp, Stripe, or any other integration, deleting from FormForge doesn’t remove the record from that third party. You’ll need to log into each integration’s dashboard separately and delete/unsubscribe there too. Keep a checklist of your active integrations so you don’t miss any.
Record the deletion for your audit trail
Note the request date, deletion date, and every place you deleted from. GDPR requires you to be able to demonstrate compliance.
WordPress 4.9.6+ ships built-in Personal Data Exporter and Eraser tools under Tools > Export/Erase Personal Data. Plugins hook into these via the standard WordPress privacy filters. FormForge Pro doesn’t yet hook them, so exports and erasures triggered via WordPress’s built-in tools will NOT include FormForge entries. Don’t rely on WP core Tools; do the manual FormForge workflow above until integration ships in a future release.
Data retention: current state and workaround
GDPR Article 5(1)(e) requires that personal data be kept only as long as necessary. Auto-retention (delete entries older than X days) is planned for a future release; the current release keeps entries indefinitely until manually deleted.
Manual retention workflow (current release)
Two options depending on how strict your retention needs are:
- Periodic manual cleanup. Set a calendar reminder every 30/60/90 days (whatever your policy says), open FormForge > Entries, filter by date range, bulk-delete anything past your retention window. Repeat per form. Time-consuming but straightforward.
- Scheduled database cleanup via a maintenance plugin. Plugins like WP-Optimize or Advanced Database Cleaner can be configured to periodically delete rows from custom tables. Point them at
wp_rfp_entrieswith a WHERE clause oncreated_at. Note: these plugins don’t delete the relatedwp_rfp_entry_metarows or file uploads, so you’ll end up with orphaned meta and files. Use with caution.
A future FormForge Pro release adds a per-form Delete entries older than X days setting that runs on a daily cron. When it lands, it will cascade-delete entries, entry meta, and any file uploads attached to those entries. Until then, use the manual workflows above. Follow the FormForge changelog to know when it ships.
Third-party data flows to disclose in your privacy policy
Any integration you connect ships form data to a third party. Your privacy policy needs to name each third party you use, describe what data flows there, and link to their privacy policies. Here’s the FormForge Pro integrations map:
| Integration category | Data that flows out | Where to find their privacy terms |
|---|---|---|
| Anti-spam (Cloudflare Turnstile, Google reCAPTCHA) | Visitor IP address, browser fingerprint, challenge token | cloudflare.com/privacypolicy, policies.google.com/privacy |
| Email marketing (Mailchimp, ActiveCampaign, Brevo, ConvertKit, etc.) | Subscriber email, name, any mapped merge fields | Each provider’s privacy page |
| Payments (Stripe, PayPal) | Payment amount, currency, subscriber email, card details (never touch your server; sent directly to gateway) | stripe.com/privacy, paypal.com/privacy |
| Automation (Zapier, Make, Google Sheets) | Full form payload, exactly what you configured to send | zapier.com/privacy, make.com/en/privacy-notice, policies.google.com/privacy |
Anytime you enable a new integration, revisit your privacy policy. Regulators are increasingly enforcing the disclosure requirement; a stale privacy policy that doesn’t name a data recipient is a real compliance risk. Note: if you’re GDPR-subject and using US-based providers, you may also need to name the specific US <-> EU data-transfer mechanism (Standard Contractual Clauses, Data Privacy Framework) each provider relies on.
FAQ
Is FormForge Pro GDPR-compliant?
GDPR compliance is the site owner’s responsibility, not any single plugin’s. FormForge Pro gives you the tools you need to comply (a Consent checkbox field, on-your-server data storage, no data sent to Royal Plugins or third parties by default), but the actual compliance work is on you: publish a privacy policy, ask for consent where appropriate, honor data-subject access and erasure requests, retain data only as long as you need it. This page walks through the FormForge Pro side of that work.
Where does FormForge Pro store form entries?
Entry data lives in your own WordPress database in tables prefixed with wp_rfp_ (form definitions, entries, entry metadata). Uploaded files land in wp-content/uploads/YYYY/MM/. Nothing about form entries is ever sent to Royal Plugins servers, and no analytics or telemetry data is collected by the plugin. Data location is entirely under your control (your hosting provider’s data center).
How do I add a GDPR consent checkbox to a form?
Drag the Consent field from the Advanced Fields section of the field palette onto the form canvas. Set the field label to something like “I agree to the privacy policy and terms of service”. Check the Required box so submissions can’t proceed without ticking it. Save the form. On the frontend, the field renders as a checkbox with your label text next to it. If you want a clickable link to your privacy policy inside the consent text, that requires setting the field’s consent_text property programmatically in the current release; a rich-text setting for it is on the roadmap.
How do I handle a GDPR data-access request (Article 15) for a specific person?
In the current release, manually. The Entries admin doesn’t have a free-text search field yet, so the workable approach is: for each form on your site, use the form-selector to pick the form, click Export All to CSV, open the CSV in a spreadsheet, filter for the requester’s email. Also check wp_rfp_saved_entries and wp_rfp_partial_entries via a database tool if your site uses Save & Continue or Partial Entries. FormForge Pro doesn’t yet hook into WordPress Tools > Export Personal Data, so entries won’t appear in the WP core exporter output. WP Privacy Tools integration is on the roadmap; until then, do the export manually. Full walkthrough in the data-subject requests section.
How do I honor a GDPR erasure request (Article 17, “right to be forgotten”)?
In the current release, manually. Find every entry containing the requester’s email using the CSV export approach in the Article 15 answer, delete each matching entry via the Delete row-action in FormForge > Entries. Also delete matching rows from wp_rfp_saved_entries and wp_rfp_partial_entries via a database tool if your site uses those features. Any file uploads the visitor submitted live under wp-content/uploads/YYYY/MM/ but are NOT in the Media Library (FormForge doesn’t register them as WordPress attachments), so delete them via FTP / SFTP / host file manager / SSH. Finally, cascade the deletion to any third-party integrations you push to (Mailchimp, Stripe, etc.). FormForge Pro doesn’t yet hook into WordPress Tools > Erase Personal Data; WP Privacy Tools integration is on the roadmap. Full walkthrough in the data-subject requests section.
Does FormForge Pro auto-delete old entries?
Not in the current release. Entries live in your database indefinitely until manually deleted. If GDPR data-minimization requirements apply to your site (Article 5(1)(e) requires keeping personal data only as long as necessary), you’ll need to either delete entries on a schedule yourself or use a database maintenance plugin to schedule cleanup. Per-form auto-retention (delete entries older than X days) is on the roadmap for a future release.
Does FormForge Pro share data with third parties?
Only if you configure it to. Out of the box, FormForge Pro sends nothing to any third party. The moment you connect an integration (Mailchimp, Salesforce, Zapier, Make, Google Sheets, PayPal, Stripe, reCAPTCHA, Turnstile), form data flows to that third party. Your privacy policy needs to name every third party you’ve configured. If a visitor submits a form with an Email field and you have Mailchimp enabled, that email address gets sent to Mailchimp: your privacy policy needs to say so. See the integrations map.
What license tier includes the Consent field?
The Consent field is included at every FormForge Pro license tier. FormForge Pro ships in three tiers (Pro, Business, Agency) and the consent checkbox is available on all of them.