Privacy Policy

Draft — not yet reviewed. This document was prepared as a starting point and has not been reviewed by a lawyer. Do not rely on it, and do not publish it, until it has been.

Last updated: 4 September 2026

Our role

Submit Kit is a service of STACHOLD GROUP LLC ("we", "us"), operated from PO Box 548, Athens, TX 75751, United States. That company is responsible for the processing described here.

When a visitor submits a form on our customer's website, that customer decides what is collected and why. We act on their instructions to deliver it. Under the UK GDPR and EU GDPR, the customer is the controller and we are a processor.

Form submissions

We process the content of a submission only to deliver it by email. We do not intentionally store submission content after delivery: there is no submissions database and no message queue. Content is never written to our logs, and never included in error reports.

Delivery necessarily involves other providers — Cloudflare, Amazon Web Services, and the customer's own mail provider — each of which processes and retains data according to its own terms.

Operational records

For each request we record a request identifier, the form used, a timestamp, the outcome, and a coarse reason code. We do not record IP addresses; abuse controls use a keyed hash that rotates daily. These records are used for troubleshooting, abuse handling, and capacity planning.

Where it is held

Submit Kit runs on Cloudflare's network and sends through Amazon Web Services in the United States, so a submission is processed in the United States on its way to the recipient's inbox. If you are in the United Kingdom or the European Economic Area, that transfer relies on the standard contractual clauses our providers offer.

How long we keep it

Submission content — nothing to retain: there is no submissions database and no message queue. The delivered email is the only copy, and it belongs to the recipient, not to us.
Operational records — held in Cloudflare's logging and analytics for our account. Their lifetime is set by Cloudflare's retention for those products rather than by a period we choose.
Abuse-control hashes — the key rotates daily, so a hash from one day cannot be matched against the next.

This website

These marketing pages set no analytics or advertising cookies.

Your rights

If you submitted a form on someone's website and want your information accessed, corrected, or erased, contact that website's operator — they hold the delivered email and are the controller. We can help them, but we do not hold a copy to act on.

Contact

STACHOLD GROUP LLC — support@submit-kit.com