Privacy notice and consent fields
Configure privacy notices and consent fields for Qubeforms submissions. Match website field names, inspect captured consent details, and plan access and retention.
1. Record the notice associated with submissions
Under Settings → Delivery & spam, the form owner can save a Privacy notice and Consent fields on every plan. These values are recorded with each new submission’s Trust Passport along with capture time and source origin. They provide context for the submission record. Saving this metadata does not automatically display a notice, add a checkbox to your website, or verify that a visitor agreed.
2. Save a copy of the notice visitors will see
The Privacy notice setting is a saved copy of the wording you display beside your form. For this example, paste the sentence below into Privacy notice under Settings → Delivery & spam. Qubeforms copies that saved text into each new submission’s trust_passport.consent.privacy_notice, so you can later see which notice was associated with the submission. The setting accepts up to 4,000 characters; it does not create a public privacy policy page or display the text on your website.
We use your details to respond to this enquiry.3. Keep the website and settings in sync
Enter one exact submitted field name per line in Consent fields, such as contact_permission or newsletter_opt_in; up to 50 names are retained. Use stable names made from letters, numbers, underscores, dots, or hyphens, starting with a letter or underscore. Save with Save delivery settings, then update the actual website form to show the same notice. In this example, save contact_permission as a consent field and use the notice sentence from the previous step in the visible paragraph below.
4. Capture a visitor choice
Add the notice paragraph and checkbox to your own website. The paragraph displays the same sentence saved in Privacy notice; it is visible text, not a submitted form field. You do not need a hidden privacy_notice input: Qubeforms takes the recorded notice from your saved settings. The checkbox sends contact_permission=yes when checked and uses browser validation to require it. Qubeforms records submitted values in the payload and configured field names in the passport; listing a consent field does not enforce its presence or truth on the server. If your workflow requires a particular choice, validate the actual submitted value in the system that processes it.
<p id="contact-privacy-notice">We use your details to respond to this enquiry.</p>
<label>
<input type="checkbox" name="contact_permission" value="yes"
aria-describedby="contact-privacy-notice" required>
I agree to be contacted about this enquiry.
</label>5. Inspect the captured evidence
Send a test submission and compare the actual field values with trust_passport.consent. The consent metadata contains captured_at, privacy_notice, consent_fields, and source_origin. Field values remain in the submission’s data; the list of configured names alone does not prove a positive choice. The excerpt below shows the saved notice alongside the visitor’s submitted choice. Qubeforms does not check that your website actually displayed that wording. When you change the visible notice, update the saved setting as part of publishing that change. New submissions capture the updated setting; existing records keep their previously captured notice.
{
"data": {
"contact_permission": "yes"
},
"trust_passport": {
"consent": {
"captured_at": "2026-10-19T12:00:00+00:00",
"privacy_notice": "We use your details to respond to this enquiry.",
"consent_fields": ["contact_permission"],
"source_origin": "https://example.com"
}
}
}6. Plan access and retention
Treat the notice and choices as part of the private submission. Authorized inbox users and the form’s read-key holder can access submission details. The metadata follows the submission’s retention period rather than creating a separate permanent archive. If you need records beyond that period, export them through your own authorized workflow before expiry. This feature records context; it does not automatically manage unsubscribe requests or decide what notices your organization should use.
Public form keys can appear in browser code. Read keys, management credentials, and webhook signing secrets must stay on the server.