Privacy & security
Your visitors’ details, kept the way you’d want them kept.
You decide what happens to what your visitors send; speir handles it on your behalf. It stores as little as it can, encrypts what it stores, and deletes it on time.
In short
- Every enquiry encrypted under its own key
- Deleted on the schedule you choose
- Hosted in Helsinki, with EU sub-processors only
- No cookies, no trackers, no CAPTCHA widget
What’s stored
Only what your form sends, plus what speir needs to screen it and deliver it.
| What | How | Kept |
|---|---|---|
| Name, email, phone, message and your form’s own fields | encrypted under that enquiry’s own key | Your retention period |
| The visitor’s network address | encrypted never stored as it is: a keyed hash specific to your site, then encrypted | 30 days |
| The browser’s user agent (first 300 characters) | encrypted under that enquiry’s own key | 30 days |
| Arrival time, consent version, reference, spam score | plain so speir can work without decrypting anything | Your retention period |
| A keyed hash of the email address | plain used only to find a person’s enquiries when they ask | Your retention period |
Encrypted one by one
Each enquiry gets its own random key, and its personal fields are encrypted with XChaCha20-Poly1305. That key is itself encrypted by a master key held outside the database. Every value is bound to its site, its enquiry and its field, so it can’t be copied into another row and read there.
Someone holding only the database sees ciphertext. So does anyone holding a backup: backups are encrypted again before they leave the server.
Who can read it
No operator tool shows a personal field. Our staff see counts, statuses and whether deliveries went through. An enquiry is decrypted only to store it, to send it to you, and to export it when you ask us to.
The operator console is reachable only over a private network, with passkey sign-in. Exports and erasures run on the server itself, never through a web page.
How long it’s kept
- 6 monthsby defaultfrom the enquiry’s arrival, unless you choose otherwise.
- 30 days–18 monthsyour choicea fixed period, or a number of days after a trip’s end date, capped so a visitor can’t choose for you.
- 90 daysfor spamkept only to tune the rules, never delivered, then deleted.
A deletion job runs every day. When an enquiry expires it is deleted, not hidden, and its key is deleted with it.
Erasure that reaches the backups
When you ask us to erase a person’s enquiries, by email address or by enquiry, each enquiry is deleted together with its key. Without the key, every remaining copy of the ciphertext is unreadable, including the ones in backups.
Within 17 days, no backup can be read. Keys are backed up separately from the database and for a short time only, so once the last copy of an erased enquiry’s key expires, its backed-up copies can never be decrypted again.
Copies already delivered to your inbox or your own systems are yours to delete. If your site has a webhook, it is sent an enquiry.erased event with the ids, so your systems can follow.
When a visitor asks for their data
Requests to see or erase data are yours to answer, and we carry them out on your instruction: an export of everything held for an email address, or its erasure. We send the result to you, not to the person, and act within 5 working days. Write to privacy@speir.app.
Where it lives
speir runs in Helsinki. Three companies process data for it, all in the EU, and you get 30 days’ notice before that list changes.
- UpCloudHelsinki, FinlandHosts the service and its database, where personal fields are stored encrypted.
- mailbox.orgHeinlein Hosting, Berlin, GermanyRelays the enquiry emails. It keeps no copy of the mail, and deletes its delivery logs after 7 days.
- HetznerStorage in HelsinkiHolds the off-site backups, which are encrypted before upload. It can read none of them.
No tracking
There are no cookies, no third-party scripts and no CAPTCHA widget between your visitors and your form. Logs record events, never personal data, and are kept for 30 days. Metrics count enquiries by site, never by visitor.
The agreement
Every site comes with a data processing agreement built on the European Commission’s standard contractual clauses, with annexes that say exactly what is stored, for how long and by whom. Among other things, it commits us to telling you about a personal data breach within 48 hours of establishing that one has happened.
You receive its numbered version before your site goes live. To read it sooner, write to privacy@speir.app.