To improve spam protection and keep form submissions secure, we’ve upgraded our built-in reCAPTCHA protection to Google reCAPTCHA Enterprise (also known as Google Fraud Defense) 
Affected widgets
- Announcement Bar
- Appointment Booking
- Banner
- Calculator
- Countdown Timer
- Contact Form
- Form Builder
- Subscription Form
- Popup
- Pricing Table
- Slider
- Spinning Wheel
Why did we make this change?
Our forms were already protected with invisible reCAPTCHA, but we wanted to improve protection against more advanced automated spam and abuse attempts.
With reCAPTCHA Enterprise, suspicious submissions can now receive an additional verification step instead of relying only on the background risk analysis.
This helps keep form submissions reliable while reducing the number of unwanted automated messages.
Does this change how forms work?
For most visitors, nothing changes.
reCAPTCHA continues running in the background without requiring any action. If the system detects suspicious activity, visitors may see a short verification challenge before their submission is accepted.
In some environments where reCAPTCHA cannot run (for example, certain srcdoc iframe setups), submissions will still be sent. However, they will be marked as unverified, and automatic replies will be disabled for these submissions.
What about privacy and reCAPTCHA notices?
Starting from April 2, 2026, Google reCAPTCHA changed its role from an independent data controller to a data processor.
In this setup:
- The website owner remains the controller of visitor data
- Elfsight acts as a processor providing the form protection
- Google acts as a sub-processor providing reCAPTCHA Enterprise
Because of this change, visitors are no longer covered by Google’s Privacy Policy and Terms of Use links shown by default in the reCAPTCHA notice.
The reCAPTCHA notice displayed under forms has been updated accordingly.
Do I need to update my Privacy Policy?
Yes.
Since website owners remain responsible for visitor data processing, we recommend adding a section about reCAPTCHA protection to your Privacy Policy.
You can use this text in your Privacy Policy
Spam protection (reCAPTCHA)
To protect our forms from automated abuse and spam submissions, this website uses reCAPTCHA, a service provided by Google LLC (“Google”). reCAPTCHA analyses visitor behaviour to distinguish human users from automated bots. It normally runs in the background and requires no action from you; if a submission appears suspicious, it may ask you to complete a short verification before the form is sent.
For this purpose, reCAPTCHA collects and transmits to Google technical and behavioural data, including your IP address, browser and device characteristics, referring page, and interaction patterns such as mouse movements and time spent on the page. reCAPTCHA also stores a cookie (_GRECAPTCHA) on your device. Google processes this data solely to provide and maintain the service and to keep its security, threat detection and abuse prevention capabilities effective, and may process it on servers located outside the European Economic Area, including in the United States.
We are the controller of this processing. reCAPTCHA is provided to us through our forms provider, Elfsight, which acts as our processor, with Google acting as a sub-processor under the Google Cloud Terms of Service and the Cloud Data Processing Addendum.
The legal basis for this processing is our legitimate interest in protecting this website against spam and automated abuse (Art. 6(1)(f) GDPR).