When someone fills in one of your Finocket forms, their answers are personal data that you are responsible for. This page lists, hop by hop, where a form submission is stored and which outside services touch it today, so you can answer a customer or a regulator without guessing.
Where is a form submission stored?
- Database: the Finocket database in Mumbai, India. Submissions, the lead created from them and the consent proof all live there.
- Application servers: the code that receives a submission runs in Mumbai (the
bom1region). A submission is not routed through servers outside India to reach the database.
What does Finocket record with each submission?
- The answers the visitor typed into your fields.
- A consent proof for each channel on the consent block: the time, the page address the form was on, the exact wording the visitor saw, and the network address of the visit, shortened (the last part is dropped). It is what lets you prove an opt-in later.
- On the submission itself, the same shortened network address and the browser details of the visit.
- Any campaign tags (UTM) on the link the visitor arrived by.
Which outside services are involved?
A form that only collects answers uses Finocket's own hosting and database, with one exception: the spam check. When a visitor submits, the page sends Cloudflare Turnstile the visitor's check token and network address so it can say whether they are a person. Cloudflare is not part of Finocket's Mumbai setup, and Finocket has not verified in which country it processes the request. On Finocket's production site the check is required, so every public form submission goes through it. The hidden honeypot field is a second check that runs only on our servers.
Apart from Cloudflare Turnstile, the services below do not receive a submission today unless you set them up, and most cannot be set up yet. Each is listed with its region and status, and this table changes when one becomes reachable.
| Service | Where | What it would see | Status |
|---|---|---|---|
| Cloudflare Turnstile | Outside India | The visitor's check token and network address | Live on every public form submission |
| Razorpay, your own account | India | The payment the visitor makes | Not available yet: switched off, and the form does not start a payment |
| Google Sheets, Slack, Notion, Airtable (export connectors) | Outside India | The answers of the forms you connect, per form, only after you opt in | Not available yet: no screen connects them |
| Your own webhook address | Wherever you point it | Each response for the events you choose | Screen on qa, off until the owner enables webhooks for the workspace |
| Twilio (SMS) and Resend (email), Finocket's own accounts | Provider regions are not stated here yet | The phone number or email a visitor types into a one-time code block, and the code message | Not available yet: the one-time code block is switched off (FORMS_OTP) and needs database changes the owner applies at release |
| Resend, or your SMS or WhatsApp provider | Depends on the provider you use | The message you send to the visitor | Only for messages you choose to send; see Outreach and consent |
What happens when someone withdraws consent?
A person who unsubscribes, or who submits again with the box left unticked, is recorded with their own proof, and marketing messages to them are blocked. See Outreach and consent for how consent states work.