Privacy Policy
Last updated: 2026-09-07 (draft — [REVIEW])
GravityAgent is a spam-scoring service for Gravity Forms, operated by [ENTITY]
("we", "us"). This policy explains what data the service handles, what we keep, for
how long, and who else touches it. It is written for the site owners who install the
plugin and for the people whose form submissions are scored.
The short version
- Your WordPress site is the controller. It owns the authoritative record of every submission and every verdict, and it decides when that record is deleted.
- We are a transient processor. We judge a submission while it is in flight and discard it. We never store the submission's content — not in a database, not in a log, not in a backup.
- What we keep is operational and non-content: which site asked, when, which verdict label was produced, how confident the model was, how long it took, and how many tokens it cost. Those records expire automatically.
- Nothing you send is used to train any model. Our language-model provider is used on terms that forbid it.
- All stored data lives in the United States.
1. Data we process on behalf of a site
When a site owner enables scoring on a form, each submission of that form is sent to our API and judged. The request contains:
- The submitted field values — the same text the site's notification e-mail would contain — minus any field the site owner has excluded. Excluded fields never leave the site.
- File uploads as metadata only: the file name and the field's label. File contents and file URLs are never sent.
- Ambient submission metadata: the submitter's IP address, browser user agent, submission time and the URL of the page the form was on.
- Correction examples: when the site owner has previously corrected verdicts on that form, a small number of those past submissions (their field values, read live from the site, minus exclusions) travel with the request as labelled examples.
- The site's own context: a short profile we distilled from the site's public pages, and any notes the site owner typed into the plugin's settings.
This data is held in memory for the duration of the request — normally under two seconds — while it is sent to the language model, the verdict is checked, and the response is returned. It is then discarded. The verdict, the model's short explanation and the decision id are written to the site's own database by the plugin; they are the site's record, not ours.
2. Data we keep
| Record | Contents | Retention |
|---|---|---|
| Site (tenant) record | The site's domain, a one-way hash of its API token, its status, and — on paid plans — the identifiers of its licence at our merchant. | For as long as the site is activated; the record is closed (token revoked) on deactivation. |
| Decision record | Decision id, site id, policy version, the verdict label, the model's confidence score, model name, latency, token counts, timestamp, and — if the site owner later corrects the verdict — the corrected label and when. No field values, no explanation text. | About 90 days, then purged automatically by a nightly job. |
| Daily outcome counts | Per site and day: how many requests ended in a verdict, and how many ended in each non-verdict outcome (timeout, quota reached, model unavailable, …), including counts the plugin reports once a day for failures it saw on its side. Numbers only. | Kept as aggregates (they contain no personal data). |
| Site profile | A short summary, generated by the model, of what the site does, built from the site's public pages; the list of public URLs it was built from. | Overwritten on each re-crawl; deleted on request or when the site's account is closed (see §5). |
| Owner notes | Text the site owner typed into the plugin's "site context" field. | Until the owner clears it (saving an empty field deletes the record) or the account is closed. |
| Entitlement and merchant records | Plan, limits, status, period end; the ids and types of events our merchant sends us about a licence (never amounts, e-mail addresses or names); trial grants (merchant customer id, domain, dates). | For the life of the account plus our accounting obligations. |
| Operational logs | One structured line per request: ids, an outcome code, model name, latency, token counts, error class. The log format has no free-form field, so content cannot appear in it. Activation logs carry the site id and an outcome — never the licence key, the token or the domain. | Up to 7 days (Cloudflare Workers Logs). |
We do not keep: field values, file bytes or URLs, the model's explanation text, correction content, licence keys, or the plain-text API token. Our test suite asserts, on every change, that a sentinel string placed in a submission appears in no database table and on no log line.
3. Who else processes the data
The services we rely on, what each receives and where it runs are listed on our Subprocessors page. In brief: Cloudflare hosts the service; Google (Gemini API, paid tier) provides the language model and is contractually prohibited from training on your data; Firecrawl reads your public pages only when a crawl runs; Freemius handles paid checkout and licences and never sees a submission.
The website gravityagent.io uses Cloudflare Web Analytics, which by Cloudflare's statement uses no cookies or local storage and does not fingerprint visitors by IP address or user agent. It records page views, referrers, countries and performance timings, and does not log query strings.
4. Where data is processed
Everything we store is stored in the United States. While a request is in flight it is handled at the Cloudflare location nearest the calling site's server and by our language-model provider under its own terms. We offer no EU data-residency option.
5. Deletion
- A submission is deleted by deleting the entry in Gravity Forms. That removes the authoritative record — content, verdict and explanation — and any correction example built from it. We hold nothing further to delete: our decision record contains no content and expires within about 90 days.
- A site is closed by deactivating it from the plugin's settings page. The API token stops working immediately, and the site's profile (what we learned from its public pages) and the owner's notes are deleted at the same moment — automatically, with no request needed. The remaining decision records contain no content and expire within about 90 days.
- Uninstalling the plugin removes every option and table the plugin created on the site and leaves Gravity Forms entries untouched.
6. Rights of people whose submissions are scored
If you submitted a form on a site that uses GravityAgent, the site owner is the controller of your submission and the right place to direct access, correction or deletion requests. We keep no content from your submission and cannot identify you from what we hold; if a site owner forwards a request to us we will delete the non-content records associated with the decision ids they name.
7. Security
API tokens are stored only as SHA-256 hashes. Provider credentials are held as platform secrets, never in the database. All traffic is TLS. Requests without a valid token are rejected before any content is read, and repeated failures from one address are rate-limited.
8. Children
The service is offered to site operators and is not directed at children. We have no way to know the age of a person who submits a form on a customer's site.
9. Changes
We will note the date of any change at the top of this page. A change that affects what we keep or who processes it is announced at least 30 days in advance on the Subprocessors page and, for paid plans, by e-mail to the address on the account.
10. Contact
[ENTITY], [SUPPORT EMAIL].