No form builder makes you GDPR compliant. Compliance depends on how you collect, use, store and protect data, and that is your responsibility. A builder can give you the controls. Here is a 12-point checklist of what you decide, with the Qwenvo settings that help. This is practical guidance, not legal advice.
Start with an honest note on hosting
Qwenvo is hosted in the United States. Tally is hosted in Europe and focuses on GDPR. If your rules or your clients require EU hosting, that is a legitimate reason to choose a European tool. If you are comfortable with US hosting for your case, read our privacy page and decide for yourself. We do not claim to make you compliant.
The checklist
- Know why you collect each answer. If you cannot say what you will do with a field, remove it.
- Ask for less. Use optional fields and leave out birth dates, phone numbers and addresses you do not need.
- Tell people what happens to their data. Add a Text block with a short notice and a link to your privacy policy before the submit button.
- Get consent where you need it. Where consent is your basis, add an unticked Checkboxes block, with wording specific to the use ("Send me the newsletter"). Do not bundle several purposes in one box.
- Disclose partial submissions. If you turn on partial submissions, mention that answers are saved before someone presses submit.
- Be careful with hidden fields. If you store UTM values or IDs in hidden fields, check they are covered in your notice.
- Verify only if you need to. Respondent email verification (a one-time code) confirms an address is real, which also helps you avoid sending data to the wrong person.
- Set a retention period. Use the data retention setting to auto-delete after N days. See form data retention.
- Plan for access and deletion requests. You can export submissions as CSV, JSON, XLSX or per-submission PDF, and delete them.
- Know where copies go. Google Sheets, Notion, Airtable, Slack, email, Zapier, Make and webhooks each hold their own copy. List them.
- Limit who can see responses. Invite teammates deliberately and keep the audit log in mind: it records who published, deleted, exported or changed what. See form audit log.
- Review the tools you connect. If payments run through Stripe, or you use Google Analytics 4 or Meta Pixel, check those are in your notice and that you have the consent they need.
Settings you will actually touch
Open the form's Settings drawer. The ones that matter here: data retention, partial submissions, respondent email verification, password protection for private forms, and prevent duplicate submissions. The language setting offers 45+ languages including right-to-left, which helps when your notice has to be in the respondent's language. See form settings.
AI and personal data
AI triage reads submissions to add a category, priority and summary. If you turn it on for a form that collects personal data, include that in your notice and review whether it suits the data. It is a switch per form, so you can leave it off for sensitive ones. See the AI information page. AI suggestions always need a human decision.
What Qwenvo does not offer
- No EU hosting option.
- No HIPAA offering. Do not collect health records on it.
- No legal templates. Your notice and consent wording is yours to write or have reviewed.
A quick audit you can run in 15 minutes
- Open your busiest live form and read it as a stranger. Would you understand why each question is there?
- Check the notice near the submit button. Does it say who you are, why you collect the data, how long you keep it and where to ask questions?
- Open Settings and look at data retention, partial submissions and email verification. Do the settings match what the notice says?
- List every integration and webhook on the form. Does each copy of the data have a retention plan?
- Check who has access to the workspace. Remove anyone who no longer needs it.
- Write down the date and what you changed. A simple record helps if someone asks later.
If you collect data from children, health information or other sensitive data, get professional advice before you publish. A checklist like this one is not enough for those cases.
Questions people ask
Is Qwenvo GDPR compliant?
Compliance is about your use, not the tool alone, and we do not claim to make you compliant. We give you retention, export, verification and an audit log, and say plainly that we are hosted in the United States.
Do I need a consent checkbox on a contact form?
It depends on your legal basis. A person asking a question and expecting a reply is different from a newsletter signup. Ask a qualified adviser for your case.
Can I use a GDPR form template?
Start from the contact form or the event registration form, and add your notice and consent wording.
Next step: pick one live form and go through the 12 points. Comparing hosting and plans? See Qwenvo vs Tally.
Every feature, $0, no card.
Build a privacy-aware form