SentientMail Form Builder

SentientMail Form Builder connects your WordPress site to SentientMail, so every newsletter signup and form submission lands in your email audience automatically, ready for journeys, campaigns, and transactional email.

Newsletter signups in two minutes

1. Install and activate the plugin
2. Paste your SentientMail Events API key on the Get Started screen
3. Add the ready-made Newsletter Signup form to any page, as a block or a shortcode

Everything else a small site needs from forms

• Contact, application, and custom forms with 23 field types (including file uploads, address, rating, consent, calculations, signature, matrix and repeatable groups)
• Save and resume, so a long form can be finished later, plus optional capture of forms people abandon
• Conditional logic: show or hide fields based on earlier answers, enforced on the server as well as in the browser
• Multi-page forms with a progress indicator and per-page validation
• Eight starter templates, so you never begin with an empty form
• Privacy controls: optional IP logging, an entry retention window, and support for WordPress export and erasure requests
• Every submission saved as an entry, with CSV export
• Per-form analytics: views, submissions, the conversion rate between them, and which field people were on when they gave up. Aggregate counters only, kept in your own database, with no third-party service and no charting library
• Email notifications with smart tags ({all_fields}, {field_id="2"}, …)
• Show-a-message or redirect confirmations
• Invisible anti-spam (honeypot + time trap) out of the box; optional Cloudflare Turnstile
• A keyword blocklist you control, plus optional Akismet if you already use it. Suspected spam is held for review, not thrown away
• Trigger a SentientMail transactional email to the submitter (welcome emails, promo codes)
• Add subscribers to a Mailchimp audience, with your own field-to-merge-field mapping. Double opt-in by default, and a consent checkbox on the form is honoured
• Post each submission to a Slack channel, using the same smart tags as your notification emails
• Outgoing webhooks with HMAC signatures for anything else (Zapier, Make, custom apps)
• One-click import of WPForms forms and entries if you’re switching

The plugin works without a SentientMail account too. Forms, entries, and notifications are fully functional standalone. Connect an account when you’re ready to grow your list.

External services

This plugin can connect to five named external services, and it can send
submissions to a webhook address you choose. All of it is optional: with none of
it configured, forms, entries and email notifications work entirely on your own
site and no data leaves it. The keyword blocklist is not one of them; it is
matched on your own server and sends nothing anywhere.

SentientMail

SentientMail is a hosted email marketing and transactional email platform, operated
by us. It is what the plugin syncs your form submissions into, so that signups
become contacts you can send campaigns and journeys to.

It is used only after you paste a SentientMail Events API key on the Get Started
screen. Nothing is sent before that.

What is sent, and when:

• When you verify your API key on the Get Started screen: your site’s address and
  the plugin version, plus your WordPress administrator email address, as a single
  connection event.
• When a visitor submits a form that has audience sync enabled: the values that
  form collected (typically name and email address), the form’s name, and whether
  the visitor gave marketing consent.
• When a form is configured to send a welcome or transactional email: the
  recipient’s email address and the merge values that email needs.

Requests go to https://app.sentientmail.com over HTTPS and are authenticated with
the key you supplied. Forms without audience sync enabled send nothing.

Terms of service: https://sentientmail.com/terms.html
Privacy policy: https://sentientmail.com/privacy.html

Mailchimp

Mailchimp is a hosted email marketing platform operated by Intuit. It is used
only if you enter your own Mailchimp API key under Settings AND switch Mailchimp
on for a particular form, where you also choose which audience to add people to.
It is off by default. With no key entered, no form makes any request to
Mailchimp.

Your Mailchimp API key ends in a dash and a short datacenter code, such as
-us21. The plugin reads that code out of the key to work out which Mailchimp
server your account is on, so there is no server address for you to enter. A key
without that suffix is refused, and nothing is sent.

What is sent, and when:

• When a visitor submits a form that has Mailchimp enabled: their email address,
  the audience ID you chose, and the values you mapped to Mailchimp merge fields,
  which by default are their first and last name. Uploaded files and signature
  images are never sent. Nothing else from the submission is sent unless you map
  it to a merge field yourself.
• Nothing is sent at any other time. There is no background sync, and the plugin
  never reads your audiences or your Mailchimp account back.

If the form contains a consent checkbox, nothing is sent to Mailchimp at all
unless the visitor ticked it.

New subscribers are added as “pending” by default, which is Mailchimp’s double
opt-in: Mailchimp emails a confirmation link and nobody joins the audience until
they click it. You can choose single opt-in per form instead, which adds the
address immediately.

Requests go from your server to https://.api.mailchimp.com over
HTTPS, authenticated with the API key you supplied. The key is sent in an
Authorization header, is never written into a URL, is never shown again after you
save it, and is removed from any error message the plugin records.

Terms of service: https://mailchimp.com/legal/terms/
Privacy policy: https://mailchimp.com/legal/privacy/

Slack

Slack is a team messaging service operated by Salesforce. It is used only if you
create an incoming webhook in your own Slack workspace, paste its URL into a
form’s Integrations tab and switch Slack on for that form. It is off by default.
With no webhook URL saved, no form makes any request to Slack.

The URL must be an https://hooks.slack.com/ address; anything else is refused
rather than saved, so the field cannot be pointed at some other server.

What is sent, and when:

• When a visitor submits a form that has Slack enabled: the message you composed
  for that form, which by default is the form’s name followed by the answers.
  Uploaded files and signature images are never posted to Slack; the message
  says how many files were attached and links to the entry in your own
  dashboard instead. The message is posted as plain text, so nothing a visitor
  typed can become a link or a channel mention.
• Nothing is sent at any other time, and the plugin never reads anything back
  out of Slack.

Requests go from your server to https://hooks.slack.com over HTTPS. The webhook
URL is the credential: it is never displayed again after you save it, and it is
removed from any error message the plugin records.

Terms of service: https://slack.com/terms-of-service
Privacy policy: https://slack.com/trust/privacy/privacy-policy

Cloudflare Turnstile

Turnstile is Cloudflare’s privacy-preserving CAPTCHA alternative. It is used only
if you enable it and enter your own Turnstile site key and secret key under
Settings. It is off by default.

What is sent, and when:

• On any page displaying a form: the visitor’s browser loads Turnstile’s widget
  script from challenges.cloudflare.com. Cloudflare receives the visitor’s IP
  address and browser information as part of that request.
• When a visitor submits the form: the challenge token their browser produced,
  together with your secret key, is sent from your server to Cloudflare for
  verification.

Terms of service: https://www.cloudflare.com/website-terms/
Privacy policy: https://www.cloudflare.com/privacypolicy/

Akismet

Akismet is a spam-filtering service operated by Automattic. It is used only if
the Akismet plugin is installed and already set up with its own API key, AND you
tick “Akismet” in a form’s anti-spam settings. It is off by default. This plugin
never asks you for an Akismet key of its own and never stores one: it uses the
key Akismet already holds. With no key present, no request is made.

What is sent, and when:

• When a visitor submits a form that has Akismet enabled: the text values that
  form collected, together with the submitter’s IP address, browser user agent,
  and the address of the page the form was on. Uploaded files and signature
  images are never included. Alongside the submission, the request carries the
  fields the Akismet API defines for a spam check: your site’s address, its
  language and its character set.

Requests go from your server to https://rest.akismet.com over HTTPS, addressed
with your Akismet API key, which is how Akismet identifies the account making
the check. Nothing is sent from the visitor’s browser, and no Akismet script is
loaded on your pages.

If Akismet cannot be reached, or answers with anything other than a verdict, the
submission is accepted. A submission Akismet does call spam is kept as a spam
entry you can review and restore, not deleted.

Terms of service: https://akismet.com/tos/
Privacy policy: https://akismet.com/privacy/

Outgoing webhooks

Not a third-party service, but it does send data off your site, so it is
documented here with the rest.

A form can be given a webhook address under its Integrations tab. There is no
default and no address is built in: it goes wherever you type. When somebody
submits that form, this plugin sends that address a JSON request containing your
site address, the form’s ID and title, the entry ID, the time of submission, the
page the form was on, and the values the visitor entered. If you set a signing
secret, the request is also signed so the receiver can verify it came from you.

Requests go over HTTPS only, and cannot be aimed at addresses inside your own
server’s network. Whoever operates the address you enter decides what happens to
the data once it arrives, under their own terms and privacy policy. Remove the
address to stop the sending.