Tiger Forms includes the tools to help you meet privacy obligations such as GDPR — explicit consent, automatic retention and anonymization, and full integration with WordPress’s built-in personal-data export and erasure.
Where: consent is a field you add to the form; the site-wide controls live in WP Admin → Tiger Forms → Settings → GDPR (and the General tab for retention).
Consent
Add a Consent field (from the builder’s Layout group) so users must explicitly agree before submitting. It renders as a required checkbox whose label can carry a policy link — set the link URL and link text to point at your privacy policy, and it opens in a new tab. With the consent log enabled under Settings → GDPR, the agreement is stored with the entry, so you keep a timestamped record of who consented and when.
Retention & anonymization
Under Settings → General you control how long personal data lives:
- Store submissions — turn this off to run notifications and integrations but keep no personal data; each entry’s field values are redacted right after those workers finish, leaving only a shell row for payment reconciliation and counts.
- Retention days — entries older than N days are deleted automatically by a daily sweep.
- Anonymize after days — older entries have their personal data scrubbed (email, name, IP hash, user agent) while the row is kept for statistics.
The GDPR tab adds its own auto-anonymize after N days control and a data-processing-agreement URL field. All of these default to the pre-existing behavior and are opt-in.
Data export & erasure
Form submissions plug into WordPress’s personal-data exporter and eraser under Tools → Export/Erase Personal Data. When someone files a request keyed to their email, their Tiger Forms entries are included in the export, or handled on erasure — no manual digging. Erasure anonymizes by default rather than hard-deleting: values are overwritten with [redacted], the IP hash is cleared, and uploaded files are removed through the storage cleanup job, which preserves your analytics counts. Both integrations can be toggled on the GDPR settings tab.
Manual cleanup
The form’s Tools page lets you act directly: export all entries as CSV, run a cleanup that clears expired pending submissions and old integration logs, or delete entries outright. Combine these with the automatic sweeps to keep only the data you actually need.
Good practice
- Link your privacy policy next to the consent checkbox.
- Only collect fields you actually need.
- Set a retention or anonymization window so old submissions clear themselves.
Troubleshooting
A data-export or erasure request returned nothing
Matching is by email address, so the request must use the same email the person submitted with. Also confirm the exporter and eraser integrations are enabled on Settings → GDPR — if they’re switched off, Tiger Forms doesn’t register with WordPress’s privacy tools.
Old submissions aren’t being deleted automatically
The retention and anonymization sweeps run on a daily WP-Cron event. On low-traffic sites cron can lag until a page is visited; verify a real value is set for retention or anonymize days (0 means the sweep is off) and that WP-Cron is firing.