The compliance work the GDPR actually asks for — consent, deletion deadlines, access and erasure requests — built into the plugin, not bolted on.
„Self-hosted” answers where the data lives — on your server, never a third party’s cloud. This is the other half: the tools you need to run a form the way the GDPR expects, without stitching three plugins together.
Ask for consent and have it enforced, not just displayed. Set a retention period and let old entries delete themselves. When someone exercises their right to access or erasure, answer it through WordPress’s own privacy tools — the ones your DPO already knows. And know that what you do keep is minimised: an IP address is never stored in the clear.
Most of it is in the free edition. It isn’t a lawyer, and it won’t write your privacy policy — but the mechanics that a compliant form depends on are there and working
Add a consent checkbox with your own wording and a link to your privacy policy. Turn on required consent and the server rejects any submission without the box ticked. When it is ticked, QueryCue freezes a record with the submission: the exact wording shown, a version fingerprint of that text, and the moment of agreement.
Choose how long entries may live. A daily job then removes anything older — and the encrypted files that came with it. It stays off until you switch it on, and shows you how many entries the first run would touch before you commit.
Requests for access or deletion run through WordPress’s built-in privacy tools. Ask for an export and matching submissions are included; ask for an erasure and they’re removed, uploads and all. Entries are matched by the person’s email address.
The visitor’s IP is never stored as-is — only a salted hash, used for rate-limiting. Prefer to keep nothing in WordPress at all? Switch storage off and route leads by email or webhook instead.
A ticked box the server never checks isn’t consent. Here it’s enforced in PHP before anything is stored, so „they agreed” is a fact about the submission, not a hope about the browser.
Erasure doesn’t leave files behind. Deleting a submission — by request or by retention — removes its uploaded documents from disk too, not just the database row.
By default a form pulls nothing from another server: system fonts, no CDN, a honeypot instead of reCAPTCHA. Opt-in extras like hCaptcha or Calendly are the only exceptions — and the plugin says so.
Uploaded files are encrypted the moment they land, and stored secrets — a Calendly token, a captcha key, a webhook signing secret — are encrypted in the database rather than sitting in plain text. Both use authenticated encryption from libsodium with a 256-bit key.
That key lives in your wp-config.php, not in the database — so a database dump alone can’t decrypt anything. It’s the kind of measure Art. 32 asks you to be able to point to.
To be precise about scope: encryption at rest covers uploaded files and stored secrets. Answer text is held in your own database on your own server — see Self-hosted & data ownership for where that data lives and who can reach it.
These carry the rest of the privacy story:
Consent, retention and data-subject requests are free. Encrypted uploads come with Pro.