Your visitors’ answers land in your database, on your server, and go nowhere else. Delete them on a schedule, answer a subject access request in seconds, and export the lot whenever you want.
When you build a form with a hosted service, every answer your client types travels to a company you’ve never met, sits on infrastructure you can’t inspect, and stays there under terms that can change. You rent access to your own enquiries.
QueryCue is a WordPress plugin. It runs where WordPress runs. A submission travels from the visitor’s browser to your server and into your database — four tables, plainly named, on the hosting you already pay for. There is no account to create, no API key to keep alive, and nothing that stops working if we do.
That distinction matters most for the people who feel it hardest: a solicitor taking instructions, a doctor’s practice collecting histories, anyone whose intake form carries something a client would not want travelling through a third party.
The form loads one script and one stylesheet, both from your own domain. No CDN, no web fonts fetched from Google, no analytics, no tracking pixel. Icons are inline SVG; typefaces are system stacks.
The renderer sets no cookies and writes nothing to localStorage or sessionStorage. Nothing to disclose in a banner, because there is nothing to consent to.
Rate limiting needs to recognise a repeat visitor. So the address is salted and hashed on arrival, and only the hash is written. The raw IP exists for the length of one request.
Uninstalling the plugin leaves your submissions untouched by default. Deletion is a deliberate switch you flip, not a surprise. Take everything with you as CSV or JSON, whenever you like.
Available on every connection, free edition included. Combining them with AND, OR and NOT — including nested groups, so you can express A and (B or C) — is a Pro feature.
Owning the data is the easy half. The other half is what the GDPR then expects you to do with it — and that is where most form plugins leave you alone with a database table.
Set a retention period — say 180 days — and QueryCue deletes older submissions every night, together with any encrypted files attached to them. Off by default: before you switch it on, the settings page tells you exactly how many submissions the first run would erase.
Someone asks what data you have on them. You type their email into WordPress’s own privacy tool, and their QueryCue submissions come out with everything else — every answer, every form, every date.
The same tool, the erasure tab. Their submissions go, and the encrypted uploads go with them. No SQL, no support ticket, no hoping you found every table.
Every submission exports as CSV — opens straight in Excel, umlauts intact — or as JSON for anything else. Changed a form over the years? The export still carries every field that ever existed, so an answer from two versions ago doesn’t quietly vanish from the spreadsheet. Form definitions export as JSON too. Submission export is a Pro feature; the privacy tools and retention are free.
That is what data ownership means in practice: not a promise that we won’t look, but the plain ability to take everything and leave — and nothing of yours stays behind.
You didn’t hand the data to anyone, so there’s no third party to list, no agreement to sign, no transfer to justify.
No cookies, no external fonts, no trackers means the form itself asks nothing of your cookie banner.
No subscription gates your archive. If our company vanished tomorrow, your forms keep collecting and your records stay put — and you can still export every one of them.
A captcha (hCaptcha or Turnstile) loads its script only once you’ve configured it, and only on the step that needs it. A Calendly booking step talks to Calendly, because that is the point of it. A webhook posts to the URL you enter, signed with HMAC-SHA-256 so the receiver can prove it came from you.
None of these is on by default. Ship a form without them and the outside world never hears from it. We would rather write that down than let you discover it.
The plumbing is as careful as the promise. Submissions arrive through a nonce-checked route, are rate-limited per hashed IP, are sanitised by type, and pass the server-side path check that discards any answer to a question the visitor was never asked. Spam is caught by a honeypot rather than by handing your visitors to a puzzle from an advertising company.
It’s the sum of where the data lives, who can reach it, and what never gets collected:
On your server, in your database, deleted when they should be. Free to start.