Privacy

Last updated October 19, 2026. SpamFlip is operated by MLN Learning LLC.

This notice describes what the service actually does with information. It does not promise that form contents are stored only as hashes.

Account information

When you sign in, we store the email address you enter so we can send a one-time sign-in link and recognize your account. We do not use a password. The session cookie keeps you signed in to the dashboard.

Form submissions

When a form on a customer site is submitted through SpamFlip, we process the fields in order to score the submission and, when the result is clean, send it to the forward address that customer configured.

• The visitor IP address used for scoring is stored as a hash, not as the raw address.
• A submission may also be kept so the site owner can review a quarantined message and release it to their form handler. That copy is encrypted when payload encryption is configured, and submission records expire after about 30 days.
• The email address a visitor types into a customer's form may be included in that stored copy and in the message we forward. It is not limited to a hash.

Contact form

If you write to us through the contact form, we receive the name, email address, and message you submit so we can reply. That address is used as the reply-to on the message. The form does not publish an address for SpamFlip.

Payments

When paid checkout is available, payment details are collected by Stripe, not typed into SpamFlip. We store the Stripe customer and subscription identifiers needed to tell whether an account's plan is active. Amounts are whatever Stripe charges for the prices configured for this service. This page does not list those amounts.

Service providers

We use the following providers to run the service:

• Vercel hosts the application.
• Neon stores account and site records.
• Upstash stores submission records when persistence is configured.
• Resend sends sign-in links and contact-form messages.
• Stripe processes subscription checkout when billing is connected.

When an IP reputation provider is configured, the visitor IP may be sent to that provider for a lookup. Logs record scores, verdicts, and hashed IP prefixes. They are not a place we store the message a visitor typed.

Choices

SpamFlip is not directed at children. We do not sell personal information. To ask a question about this notice, or to ask about account information we hold, use the contact form. Customer sites that embed SpamFlip are responsible for their own notices to their visitors.