Last modified: Feb 3, 2026 <\/p>\n
You may have landed on this page by clicking on a link from one of our customers or partners websites or you are seeking more information about TrustedForm privacy practices and notice disclosures. This privacy notice is intended to explain how ActiveProspect, Inc (“we”or “our company’s) technology (called “TrustedForm”) is functioning when you visit webforms that use TrustedForm’s services and what data is being collected during your interaction with those webforms, how data is used, and how long it is retained.<\/p>\n
TrustedForm is a Lead certification service that independently verifies the origin of Internet Leads. It helps website owners and customers verify and document consent to assist with complying with privacy regulations as well as helping them verify that leads are authentic.<\/p>\n
<\/p>\n
The TrustedForm service helps website owners and customers document, analyze or archive product or service registrations and the visitor interactions occurring around consent to contact notices, terms and disclosures on webpages. \u00a0 We help customers make more informed and compliant decisions about outreach to individuals who consent to be contacted by email, text message, phone call or postal mail.\u00a0\u00a0\u00a0\u00a0<\/p>\n
<\/p>\n
TrustedForm works through the use of the proprietary JavaScript (“TrustedForm Certify Web SDK”) installed on a web page (link<\/a>), or a software development kit (“SDK”) (“TrustedForm Certify IOS and Android SDK”) installed within a mobile application, or application programming interface (API) requests to retrieve lead data from submissions to a Facebook Lead Ad (“TrustedForm for Facebook Lead Ads”) containing a contact request form. The TrustedForm Certify SDK, TrustedForm Certify IOS and Android SDK, and TrustedForm for Facebook Lead Ads each issue a digital certificate (“TrustedForm Certificate”) that is passed with the Lead as an additional data field. The TrustedForm Certificate includes information about the site visitor who submitted a Lead, the time of visit, and the form visited, including what was presented to the consumer.<\/p>\n TrustedForm is used to independently certify millions of consent to contact lead transactions for our customers every day.\u00a0 For visitors arriving on website webforms that use TrustedForm, the browser will download and run the TrustedForm script from the website shortly after arriving on the page.\u00a0 TrustedForm script\u00a0 does not use, set, save, read or rely on any browser cookie data for its services.\u00a0 The TrustedForm script instructs the browser to begin to share what is being presented on the screen in the DOM (Document Object Mode) framework so the TrustedForm service can recreate the exact elements on the webpage being shown on the visitors browser and all the DOM formatted interactions the visitor has on that webpage.\u00a0 This can include items such as window size of the webpage, the data fields requested, the formatting, the language, text, images, etc.\u00a0 The TrustedForm service receives and archives the visitor’s interaction with the webpage including mouse movements on the page, letters, numbers, symbols typed into webforms.\u00a0 Also received is information the web browser generally shares on every web visit like date, time of visit, the web address (URL), a copy of the website’s content, IP address, browser details, computer operating system and version numbers.\u00a0 This standard browser data is not collected for any profiling or advertising re-identification purposes.\u00a0\u00a0<\/p>\n Website owners install the TrustedForm javascript or related code on mobile app, social media\u00a0 or lead ads where they want to document the visitor interaction, consent, notice language or data entry.\u00a0\u00a0<\/p>\n <\/p>\n The TrustedFrom solution only runs on the specific pages where customers set it to run.\u00a0 The TrustedForm service is only intended to function as a way to help customers capture, document, analyze and archive webforms, mobile app or online lead ad consent-to-contact transactions.<\/p>\n We function as a service provider to customers that use the TrustedForm service.\u00a0 We operate under contracted agreements, terms of service (ToS<\/a>), end user license agreements (EULA)<\/a> and\/or developer documentation<\/a> that lays out data use allowances, data restrictions, data collection, data transfers, data ownership and data security commitments<\/a>.\u00a0 We are not contracted to find or recruit individuals, consumers, business to business customers interested in products or services.\u00a0 We provide cloud base software as a service (SaaS) which customers use for data processing, data analysis, data hosting, data storage, data transfer.\u00a0 Data in the TrustedForm is generally customer owned, customer directed, customer actioned.\u00a0\u00a0<\/p>\n <\/p>\n For European data subjects, the personal data that we collect from you may be transferred outside the European Economic Area (“EEA”). For personal data transferred from the European Economic Area\/European Union, the United Kingdom, or Switzerland, we comply with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF). For more information about our Data Privacy Framework (DPF) commitments, please read the ActiveProspect privacy policy found at https:\/\/activeprospect.com\/privacy-policy\/<\/a><\/p>\n “Webforms” are the boxes, text fields, dropdown, selection menus that you often see on websites asking you to enter your information, such as name, email and\/or phone contact details or other relevant fields if you are interested in learning more about the product or service a company offers.<\/p>\n <\/p>\n Webforms should always ask for and document your consent to be contacted by the company (or affiliated partners) with more information about the product or service by phone, text message, or email.\u00a0 “Notice”, “Consent”, “Opt-In” are foundational privacy principles and some data privacy or consumer protection laws require specific language presented during these consent to contact transactions.\u00a0 Often customers that utilize webforms on webpages to sell products and services presented online are often requesting contact information and related details so the interested individual can be contacted by email, phone, text message, mailing address for further communication and allow additional information to be exchanged and requested to help determine product or service applicability.\u00a0 For example you will often see webforms requesting contact or other details from you on websites selling or promoting products or services for your home (home renovation, roof repair, etc.) automobile (purchase or insurance quotes), moving or relocations services (moving companies), financial services (interest in types of loans), insurance (interest in health, home insurance quotes), education or degree certification programs, etc<\/p>\n <\/p>\n TrustedForm helps document the webform data entry with notice and consent language that may have been presented during the data request and data entry transaction.\u00a0 Customers may implement TrustedForm on their Webforms to ensure that interested parties are provided consent to be contacted language meeting various data law requirements.\u00a0<\/p>\n As Service Providers we are processing data provided by customer controlled or directed webpage sources\u00a0 for processing and analysis.\u00a0 Data provided to TrustedForm is customer owned data.\u00a0 We have contracts or service agreements in place which identify our data processing role and purposes.\u00a0 We do not process data, including personal data beyond these agreed purposes.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/p>\n Customers provide data to TrustedForm from their controlled or directed webpages for the intended purposes of documenting and archiving consent to contact transactions as well as data analysis, fraud detection, bot detection, data entry validation.\u00a0 TrustedForm data is regularly used by customers to capture and archive express written consent transactions during website registrations for compliance with data regulations such as the US Telephone Consumer Protection Act (TCPA).<\/p>\n <\/p>\n ActiveProspect does retain rights to analyze and research aggregate or de-identified data for additional insights purposes for continual product functionality improvements, fraud detection, pattern recognition data analytics and insights.\u00a0 Our purpose and use of data is not for any larger personal data or consumer profiling or advertising re-identification purposes.\u00a0<\/p>\n <\/p>\n The data in TrustedForm is not used or processed for any online advertising, retargeting or personal data profiling purposes by ActiveProspect.\u00a0\u00a0\u00a0\u00a0<\/p>\n Data submitted by individuals filling out a webform using TrustedForm is retained for a period of 90 days as standard practice to allow reasonable time for customers to validate, confirm, retain and take action upon the\u00a0 data.\u00a0 “Claiming” a TrustedForm record\u00a0 is the action usually evoked when a customer wants to perform a contact outreach to the individual and ActiveProspect will store the transaction documentation data for a longer period of time for legal and data regulation compliance purposes.\u00a0 The standard or usual period for retention of the transaction data and session replay is 5 years.\u00a0 Customers can request a longer or shorter period of time for data retention but this has to be configured separately.\u00a0 TrustedForm data not claimed in the 90 day period from receipt to submission are marked for deletion in TrustedForm.\u00a0\u00a0\u00a0\u00a0<\/p>\n <\/p>\n Occasionally there are webform submissions using the TrustedForm service where a submit button action is not able to be confirmed.\u00a0 Also there are webform submissions that are abandoned or not fully completed or submitted with a submit web button action.\u00a0 Data entries that fall into either of these categories are only retained for a period of 3 days.\u00a0 This 3 day period is to allow time for possible reconciliation where submit button action is later confirmed or the webform completion is resumed within 3 days and moving it to the claimed data process and the standard 100 day retention period.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/p>\n TrustedForm factors data minimization into its data practices by limiting retention periods of potential abandoned form entries or submission uncertainty events to 3 days by default.\u00a0 Also by default customers have only 90 days in which to claim and archive the TrustedForm transaction data.\u00a0\u00a0<\/p>\n TrustedForm services allow subscribed authenticated customers to request, access, query, check, lookup, compare, certain TrustedFrom data fields for compatible purposes in lead generation optimization analysis related to duplication analysis, fraud detection, and criteria analysis.\u00a0 APIs are used across web connected systems to allow secure, controlled, pre-defined, permissible data lookup, data exchanges (push, pull) or confirmation signals (yes, no, true, false) communicated between systems.<\/p>\n Under California or GDPR in Europe, TrustedForm services to customers would be classified as a “service provider” or “data processor” under CCPA \/ CPRA, GDPR as we are processing customer data under contracted terms and on behalf of customers.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/p>\n We will assist customers that need to perform their own CCPA, CPRA, GDPR data subject rights searches and inquiries on LeadConduit \/ TrustedForm data. Our Privacy Office assists in timely research, fulfillment and response to these data subject requests.\u00a0\u00a0<\/p>\n <\/p>\n Even though ActiveProspect or TrustedForm is not interfacing with consumers or collecting data on behalf of customers, our privacy office will promptly research and respond to data subject requests.\u00a0 Our email address is privacy@activeprospect.com or by phone 1-512-361-1014.\u00a0\u00a0<\/p>\n <\/p>\n If an individual contacts us about a data subject request we have procedures in place to search our systems for this data.\u00a0 If this data is still available and can be located and attributed to an individual or customer, we contact the customer contact and\/or company legal compliance function informing them of the data subject request, any data we may have and request instructions for action they would like to take on the data.\u00a0\u00a0<\/p>\n <\/p>\n Personal Data Subject requests in which we are the business or data controller like HR data, recruiting data or marketing data we review and research in a similar manner and promptly respond back to the individual informing them of our findings and actions taken on personal data.\u00a0\u00a0\u00a0<\/p>\n ActiveProspect TrustedForm does not sell website webform data or personal data to other parties.\u00a0 We are a service provider processing customer owned or customer directed data under contracted terms and on behalf of customers. \u00a0 We do not sell consent to contact transaction personal data to third parties for any other marketing purposes including online behavioral cross-context behavioral advertising or targeted advertising.\u00a0 TrustedForm’s data intended use is\u00a0 for consent to contact transaction documentation and related data analysis use purposes only.<\/p>\n The TrustedForm is run on customer controlled website webform pages and works to operate and function under the same website technical privacy controls or do not track browser responses that the customer enables and allows on their website \/ domain.\u00a0 The website owner is responsible for the order of script(s) loading and running the TrustedForm script after any website cookie banner (consent management) choices including browsers global privacy control (GPC) configurations or DNT Do Not Track requests, flag or signals.\u00a0 The TrustedFrom script would not respond or act\u00a0 differently based on a browser’s GPC or DNT requests as this would be determined configured by the website owner.\u00a0 TrustedForm data collection and use is not for cross site or online behavioral advertising purposes.\u00a0\u00a0\u00a0\u00a0<\/p>\n We take responsible and reasonable steps to ensure that your data is treated securely and in accordance with this privacy policy. All information you provide to us is stored on monitored servers. We limit access to the information by our own employees, contractors, site service providers and those individuals who are authorized for the proper handling of such information. We request that our third party contractors and site service providers follow similar standards of security and confidentiality.\u00a0 More information about our security controls can be reviewed on our Security Portal at security.activeprospect.com<\/a> .<\/p>\n <\/p>\n Unfortunately, the transmission of information via the internet is not completely secure. Although we will take reasonable steps to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorized access.<\/p>\n TrustedForm website webform data is encrypted in transit using TLSv1.2 (minimum).\u00a0 Data is also encrypted at rest in AWS using AES-256 bit encryption.\u00a0\u00a0\u00a0<\/p>\n TrustedForm also performs a combined one way hash on email and phone number data fields to help enable two party match and verification controls before unlocking full data record fields for analysis .\u00a0<\/p>\n TrustedForm should not be used for sensitive data analysis or collection including HIPAA Protected Health Information or credit card details, or government identification numbers. TrustedForm also has built in controls that allow customers to flag individual webform data fields that they do not want to transmit, stored or viewable in TrustedForm.\u00a0 If there are sensitive data fields that customers need to include for their purposes on their webforms, these fields can be configured in advance during the TrustedForm setup and sensitive data fields will not be transmitted to TrustedForm and replaced with ** characters in session replay and log of events.\u00a0 This feature is called Sensitive Data Field Flagging and setting of this flag is determined by customers.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/p>\n In a session replay, any data field with the Sensitive Data Field Flagging feature enabled play back with\u00a0 ****** marks over the data fields for visual reference these sensitive data fields are flagged, not visible and not saved in TrustedForm.<\/p>\n ActiveProspect attests to a series of security and internal controls continuously monitored throughout the year and independently audited to our SOC2 controls once a year. \u00a0 If you would like to see our security controls, policy procedures outlined please view our Security Portal at security.activeprospect.com\/<\/a>\u00a0\u00a0<\/p>\n <\/p>\nData Collection<\/h1>\n
Technology Application<\/h1>\n
Service Provider Position<\/h1>\n
Webforms\u00a0<\/h1>\n
Data Processing<\/h1>\n
Data Use<\/h1>\n
Data Retention \/ Data Deletion<\/h1>\n
Data Minimization<\/h1>\n
TrustedForm and Application Programing Interfaces (API)<\/h1>\n
CCPA \/ CPRA California \/ GDPR<\/h1>\n
Data Subject Requests\u00a0\u00a0<\/h1>\n
Sale Position in CCPA, CPRA, GDPR<\/h1>\n
GPC Global Privacy Control and DNT Do Not Track Response Position<\/h1>\n
Security<\/h1>\n
Encryption<\/h1>\n
Hashing<\/h1>\n
Sensitive Data Field Flagging<\/h1>\n
Data Obfuscation\u00a0<\/h1>\n
SOC2 Security Controls and External Audits<\/h1>\n