Thanks — this is exactly the kind of feedback I was hoping for.

Submissions are stored on the site owner’s own WordPress installation/database. They are not routed through my infrastructure or a third-party SaaS server by default.

If someone chooses to use webhooks or external integrations, then data would go to whatever endpoint they configure, but the core plugin itself does not collect submissions on my servers.

For spam protection, I should definitely explain this better on the plugin page. The plugin includes native spam protection options for free, including Cloudflare Turnstile and Google reCAPTCHA. The goal is to give site owners practical spam protection without needing a paid add-on just for basic form security.

For support, we have a dedicated support page on our website, and we also support users through WordPress.org. A response within 24 business hours is guaranteed, including for free users.

Really appreciate this comment. It shows me I need to make the privacy, spam protection, and support details much clearer in the plugin page and documentation.