A small product, run by one person
FormHeron is built and operated by an individual in India. Not a team, not a startup with a runway — one person who got tired of the same problem and decided to solve it properly.
Why it exists
Every static site eventually needs a contact form, and every contact form eventually needs a backend. The usual answers are all slightly wrong: stand up a server for one endpoint, wire a serverless function you then have to maintain, or hand it to a form service that emails you a copy and calls it done.
That last option is the one most people pick, and it has a specific failure mode. The lead arrives as an email, gets buried under everything else in the inbox, and nobody can answer the only question that matters a week later: did we ever reply to that person? The submission was captured. The lead was still lost.
FormHeron is the version that treats a form submission as a lead rather than a notification. It arrives, it gets filtered for spam before it costs you anything, and then it sits in a pipeline you can actually work — New, Contacted, Won, Lost, with tags and notes and search across every field the visitor filled in.
The second reason is duller and matters more to anyone building for clients. Handling other people’s form submissions means handling other people’s personal data, and most form services make you dig to find out where that data goes. Storing leads in the EU, never keeping raw IP addresses, and offering a signable DPA on the free plan are not upsells here — they are the baseline, because they are what the job actually requires.
What it is not
Being one person means choosing a small number of things and doing them properly. These are deliberate gaps, not a roadmap.
File uploads
Attachments mean storage costs, virus scanning and a much larger abuse surface. A one-person product cannot run that responsibly, so it is not offered at any price.
A drag-and-drop form builder
You already know HTML. FormHeron takes whatever form you have already built and gives it a backend, rather than asking you to rebuild it in someone else's editor.
An autoresponder
Sending mail on your behalf to people who filled in your form is a deliverability and compliance problem worth doing properly or not at all. Currently: not at all.
An uptime SLA
Promising one would be a sales line, not a commitment that could be honoured. The Terms say so plainly instead.
If you need any of those, the comparison pages say which competitor to use instead. That is not modesty — it is cheaper for both of us than a refund.
How it is run
Spam should not cost you money
Submissions caught as spam are stored for review but never counted against your monthly limit and never emailed. A bot flood costs you nothing. Charging for traffic you did not want is a business model, not a feature.
Visitor data belongs to the visitor
Rate limiting uses a salted HMAC of the IP address rather than the address itself, so a database breach exposes no visitor IPs. Retention is capped by plan and enforced by an automated job that hard-deletes — not soft-deletes.
Say where the data lives, before being asked
Leads are stored in Amsterdam. Support operations happen from India. Every sub-processor is listed by name and region. A processor DPA is available on every plan, free included.
Publish the limitations too
No SLA, capped liability, no file uploads, a smaller integration catalogue than the incumbents. All of it is written down, including on the comparison pages, where competitors are credited with the things they genuinely do better.
The honest caveat
FormHeron launched in 2026. It does not have years of production history, a support team, or a phone number. If that is disqualifying for your project, that is a reasonable call to make — and better made now than after migrating. What it does have is a published sub-processor list, Terms that state the limits rather than bury them, and one email address that reaches the person who wrote the code.