Aluleth Forms

Aluleth Forms is a form builder made to look good on your site from the first minute and to stay light. Build contact, quote, booking, survey or newsletter forms in a visual builder, follow every entry on a board, and send people to the email tools you already use.

Start in seconds

• Nine designed templates: contact, quote, booking, newsletter, call back, event registration, feedback, support and waitlist, each with its own style, messages and entry statuses.
• Describe your form: with the free Aluleth AI Writer plugin, write one sentence (“a booking form for a bike workshop”) and get a draft to review in the builder.
• Switch in a few clicks: import forms and entries from Contact Form 7 (with Flamingo), WPForms, Elementor Forms and MetForm, even when that plugin is deactivated.

A builder that shows the real thing

• Drag fields, see the form in its real style, edit labels, widths and help texts in place. Undo, redo, phone preview.
• One page or several steps with a progress bar.
• Conditional logic: show a field only when other answers match.

Matches your site

• Button colour from your site’s palette (theme.json or Elementor global colours), so the form follows your changes.
• Three styles, three corner shapes, your site’s fonts; labels above, beside or inside the fields.
• A block, an Elementor widget and a shortcode.

Light and accessible

• One small stylesheet and script, only on pages with a form. No jQuery, and it works without JavaScript.
• Help and error texts are announced to screen readers; everything works with the keyboard.
• Built-in spam protection with no outside service and no cookie.

Security against spam

• Cloudflare Turnstile, hCaptcha, Google reCAPTCHA (v2 or v3) or CleanTalk: one default, and each form can choose another.
• Block addresses, domains and words, and use Akismet if it is active.
• Suspicious entries are kept aside in Spam, and you can mark them as not spam.

Every entry in one place

• Follow entries on a board with your own columns: drag a card to change its status, open it for the answers, history and team notes. List view and CSV export.
• An email to your team and an optional confirmation to the visitor.
• A dashboard: entries, contacts, conversion and subscribers over time.

Take payments with PayPal, no fee from us

• Price fields (choices with prices, extras, fixed price, free amount for donations) and a live total.
• PayPal, Pay Later or card, in PayPal’s secure window; the money goes straight to your account.
• The amount is computed again on your site, and the entry is saved and sent only once the payment is confirmed.
• Sandbox and live mode, 24 currencies. Aluleth takes 0%.

Settings for the whole site

• Defaults for new forms, your own validation messages, a weekly email summary, entry retention.
• Access: choose what editors, authors or shop managers can do.
• AI agents (off by default): let an AI assistant connected through MCP read your forms and create drafts, with the WordPress Abilities API.

Contacts and consent

• One contact per person, with their history and newsletter consent (when and how they agreed).
• Import your list from a CSV or ZIP export (Mailchimp, Brevo, MailerLite, Kit…), pasted addresses or your users.

Send entries to your tools

• Mailchimp, Brevo, MailerLite, Kit (ConvertKit), Mautic, MailPoet, FluentCRM, and webhooks for Zapier, Make, n8n or your own code.
• Team alerts: get each new entry in Slack, Discord or Telegram, with the answers, the amount paid and a link to the entry.
• Lists, tags and field mapping per form. Sending runs in the background and failed sends are tried again.

Aluleth Forms is free and has no limit on forms, entries or contacts.

Privacy

Aluleth Forms stores the answers people send in your site’s database. The visitor’s IP address is never stored: only a one-way hash of it, used to limit abuse. Contacts and entries are included in the WordPress personal data export and erasure tools.

Aluleth Forms does not send any data to outside services by itself. Data leaves your site only when you add an integration to a form:

• Webhook: the answers of each entry (and the contact’s email, name, phone and newsletter consent) are posted to the address you enter, when the entry is received. What happens next depends on the service behind that address (for example Zapier, Make or n8n); read its terms and privacy policy.
• MailPoet and FluentCRM are plugins on your own site: the contact is saved in their tables, nothing is sent elsewhere by Aluleth Forms.
• Mailchimp, Brevo, MailerLite, Kit, Mautic, Slack, Discord and Telegram: see “External services” below.
• Anti-spam services (Cloudflare Turnstile, hCaptcha, Google reCAPTCHA, CleanTalk, Akismet) are used only when you turn them on in Aluleth › Settings › Security: see “External services” below. Aluleth › Settings › Data and privacy lists the ones you use, with a sentence for your privacy policy.

Entries kept aside as spam are stored like the others, without emails or sending to your tools.

Newsletter tools (Mailchimp, Brevo, MailerLite, Kit, Mautic, MailPoet, FluentCRM) only receive people who ticked a newsletter consent. Team alerts (Slack, Discord, Telegram) and webhooks receive every entry by default: you can limit them to entries with newsletter consent in the form’s integration.

On payment forms, the answers wait in your site’s database (a temporary record, up to 2 days) while the visitor is in PayPal’s window, and become an entry once the payment is captured. Unpaid answers are deleted after a day. The entry keeps the amount, the items, the PayPal order and transaction ids and the payer’s name and email address returned by PayPal. Paid entries are kept even with “Do not save entries”.

When the weekly summary is on (Aluleth › Settings › General), it is emailed to the address you choose. It holds numbers and form names, no entry content.

“Keep entries for” deletes older entries for good once a day, and spam is deleted after 30 days unless you untick it. With “Do not save entries”, the answers are only emailed and sent to your connections, then deleted from your site; contacts and consent are still saved.

The AI agents abilities (off by default) let an AI assistant that you connect to your site read what the signed-in WordPress user is allowed to see. What the assistant does with it is governed by its own provider’s terms; Aluleth Forms sends nothing anywhere by itself.

When you use “Write my form” on the Create a form screen, your description of the form is sent through the Aluleth AI Writer plugin to the AI provider you connected in Settings › Connectors. Nothing else is sent, and only when you click the button.

The log of sends is kept 30 days (90 days for failed sends) and is removed with the contact by the WordPress erasure tool.

To show the conversion of your forms, Aluleth Forms counts how many times each form is shown: one number per form and per day, stored in your site. No cookie is set and nothing about the visitor is stored. Visits of logged-in editors are not counted. Developers can turn the counter off with the aluleth_forms/count_views filter.

External services

Aluleth Forms connects to the services below only after you connect your own account in Aluleth › Connections (by pasting your API key) and add the service to a form in its Settings › Integrations. Nothing is sent before that.

When you connect an account or open a form’s integrations, Aluleth Forms reads your lists, tags and fields from the service. When someone sends a form that uses the service and gave newsletter consent, it sends their email address, first name, last name, phone (when the form has these fields), the lists and tags you chose, and the answers of the fields you mapped.

• Mailchimp (Intuit Mailchimp), API at *.api.mailchimp.com. Terms of use, Privacy policy.
• Brevo (Sendinblue), API at api.brevo.com. Terms of use, Privacy policy.
• MailerLite, API at connect.mailerlite.com. Terms of service, Privacy policy.
• Kit (formerly ConvertKit), API at api.kit.com. Terms of service, Privacy policy.
• Mautic is open-source software that you or your provider install on your own server: Aluleth Forms connects to the address you enter (its API at /api) with the user name and password of a Mautic API user. It reads your segments and contact fields, and creates or updates the contact and adds them to the segment you chose. The terms are those of whoever hosts your Mautic. Mautic privacy policy.
• Webhooks go to the address you enter yourself (for example Zapier, Make or n8n): the answers of each entry are posted there.

Your API keys and passwords are stored in your site’s database and are never shown again in full.

Team alerts: Slack, Discord and Telegram

Used only after you add the service to a form in its Settings › Integrations (and, for Telegram, connect your bot in Aluleth › Connections). When the form receives an entry, your site sends a message with the form’s name, the answers that are not empty, the amount paid (on payment forms) and a link to the entry in your WordPress admin, which only signed-in users can open. “Send a test” sends a sample message with made-up answers.

• Slack (Slack Technologies, LLC, a Salesforce company), to the incoming webhook address you paste (hooks.slack.com). User terms of service, Privacy policy.
• Discord (Discord Inc.), to the channel webhook address you paste: only Discord webhook addresses are accepted (discord.com/api/webhooks/…, and the older discordapp.com, canary.discord.com and ptb.discord.com forms that Discord also gives). The message is posted there when an entry arrives, as described above. Terms of service, Privacy policy.
• Telegram (Telegram Messenger Inc.), through the Bot API at api.telegram.org with the token of the bot you create with @BotFather. When you connect the bot, your site reads its name; when you open a form’s integrations, it reads the chats that wrote to the bot (their id and name) so that you can choose where messages go. Terms of service, Bot API terms, Privacy policy.

PayPal

Used only after you paste the keys of your own PayPal app in Aluleth › Settings › Payments, and only on forms that have a price field.

• PayPal (PayPal Holdings, Inc., and its local companies, for example PayPal (Europe) S.à r.l. et Cie, S.C.A. in the European Union). On the pages that show such a form, the visitor’s browser loads PayPal’s script from www.paypal.com/sdk/js, which receives the visitor’s IP address and browser details. When the visitor clicks a PayPal button, your site sends the items, their prices, the total, the form’s name and a reference to PayPal’s API (api-m.paypal.com, or api-m.sandbox.paypal.com in test mode) to create the order; after the visitor approves it in PayPal’s window, your site asks PayPal to capture it and receives the payment status, the transaction id and the payer’s name and email address. The payment details the visitor types (card, PayPal login) are sent by the visitor to PayPal directly and never reach your site. “Save and check the keys” sends your Client ID and secret to PayPal to get an access token. User agreement, Privacy statement.

Anti-spam services

These are used only after you paste your own keys in Aluleth › Settings › Security and choose the service, by default or on a form. Nothing is sent before that.

• Cloudflare Turnstile (Cloudflare, Inc.). On the pages that show a form using it, the visitor’s browser loads the Turnstile script from challenges.cloudflare.com, which receives the visitor’s IP address and browser details to run the check. When the form is sent, your site sends the check result and the visitor’s IP address to challenges.cloudflare.com/turnstile/v0/siteverify. Terms of use, Privacy policy, Turnstile privacy addendum.
• hCaptcha (Intuition Machines, Inc.). The visitor’s browser loads the script from js.hcaptcha.com, which receives the visitor’s IP address and browser details. When the form is sent, your site sends the check result and the visitor’s IP address to api.hcaptcha.com/siteverify. Terms of service, Privacy policy.
• Google reCAPTCHA (Google LLC). The visitor’s browser loads the script from www.google.com/recaptcha, which receives the visitor’s IP address, browser details and how they use the page. When the form is sent, your site sends the check result and the visitor’s IP address to www.google.com/recaptcha/api/siteverify. Terms of service, Privacy policy.
• CleanTalk (CleanTalk Inc.). No script is added to your pages. When a form using it is sent, your site sends the email address, the name, the message, the visitor’s IP address and browser, and how long the form took to fill to moderate.cleantalk.org. Terms of service, Privacy policy.
• Akismet (Automattic Inc.), only when the Akismet plugin is active and connected on your site and you tick it. When a form is sent, your site sends the name, email address, message, the visitor’s IP address, browser and the page they came from to Akismet through the Akismet plugin. Terms of service, Privacy policy.

When you click “Save and check the keys”, your site sends your secret key with the answer of the test check shown on that screen (or a made-up value when there is none) to the service’s address above, to tell you whether the keys work. For CleanTalk, it sends a short test message with your access key.