FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Other

Ninja Forms

UnclassifiedOfficial website

Ninja Forms is a drag-and-drop form builder plugin for WordPress, published by Saturday Drive, with add-ons for payments, email marketing and CRM integrations. Submissions are stored in the WordPress database and can be sent to connected services. The core plugin is not a tracker, but forms collect personal data, and some add-ons transfer it to third parties.

Block Ninja Forms until consentScan my site
Overview

What does Ninja Forms do?

Ninja Forms is a long established drag and drop form builder for WordPress, developed by Saturday Drive in California. With more than a million active installations it is used for contact forms, registration, multi step surveys, payment forms and conditional logic flows. Like its competitors it is fully self hosted, which keeps the submission data on the customer WordPress server.

What Ninja Forms does

Ninja Forms renders forms server side, validates inputs, sends notifications and stores entries in the nf3_submissions custom post type. The free version covers basic forms. Premium add ons add multi page forms, conditional logic, file uploads, Stripe, PayPal, Mailchimp, ActiveCampaign, Constant Contact, Salesforce, Zapier, Slack and webhooks integrations.

Data and cookies

Ninja Forms stores the values submitted, the visitor IP (unless anonymised), the user agent and the submission timestamp. It sets only short lived first party cookies for spam protection and multi page form state. The plugin does not set tracking or marketing cookies. The free version sends anonymous usage telemetry to Saturday Drive unless opted out from Ninja Forms > Settings > Misc.

GDPR and ePrivacy implications

The website operator is the data controller for form submissions. Ninja Forms provides built in tools for compliance: a global submission expiration setting (Ninja Forms > Settings > Data), IP anonymisation, the GDPR opt in field, and full integration with the WordPress Personal Data Exporter and Eraser. IP storage must be justified by a clear purpose and limited in time.

Data transfers and add ons

Saturday Drive (US) only receives licence and optional telemetry pings. Each activated add on is a separate sub processor: Stripe and PayPal (US with EU entities), Mailchimp (US, EU US DPF), Constant Contact (US), ActiveCampaign (US), Salesforce (US, EU US DPF), Zapier (US). Each must be listed in your records of processing and contractually covered with a DPA.

Practical compliance steps

Set a submission expiration period appropriate to the form purpose. Enable IP anonymisation. Add the GDPR field with a privacy notice link. Disable usage telemetry. Use Akismet, hCaptcha or Cloudflare Turnstile for spam control without third country transfers. Sign DPAs with each integration. Document the integrations in the records of processing and link them in the privacy notice.

Compliance

Ninja Forms and the GDPR

Legal basis
Performance of a contract or pre contractual measure (Art. 6(1)(b) GDPR) for the form submission itself. Consent (Art. 6(1)(a)) for marketing checkboxes and any active integration that drops a tracking cookie. Legal obligation (Art. 6(1)(c)) for tax related forms.
Risk level
low
Applicable regulations
GDPR, ePrivacy Directive, TDDDG, LSSI CE, CCPA/CPRA, PCI DSS (when payment add ons are used)
Cookies and trackers

What Ninja Forms sets and contacts

Tracking method
Self hosted WordPress plugin. Forms are rendered server side and submissions are stored in the WordPress database. The plugin communicates with Saturday Drive servers only for licence validation, automatic updates and template downloads.
Server location
Plugin developed by Saturday Drive, Carlsbad, California, United States. Form submissions remain on the customer WordPress server. Licence servers and template servers are operated from the United States.
Cookieless mode available
Yes
Data transferred outside the EU
No personal data of form respondents is automatically transferred outside the EU. Only the licence key and the plugin telemetry (if enabled) are sent to Saturday Drive in the United States. Activated add ons (Mailchimp, Salesforce, Constant Contact, Slack) will transfer data to those processors.

Cookies set (2)

NameTypeDurationPurpose
nf_wp_sessionfirst_partySessionIdentifies the visitor session for multi page form state and anti spam.
nf_form_stepfirst_partySessionStores the current page index in multi page forms.

Third-party domains contacted (2)

  • ninjaforms.com
  • saturdaydrive.com
Questions

Frequently asked questions about Ninja Forms

Can't find your question? Write to us, we answer fast.

Which cookies does Ninja Forms set?

Ninja Forms only sets short lived first party cookies for spam protection (nf_wp_session) and multi page form state. None is shared with Saturday Drive. The plugin does not set tracking or marketing cookies on the embedding website.

Is consent required to use Ninja Forms?

Consent is not required for a simple contact form processed under Art. 6(1)(b) GDPR. It is required for marketing checkboxes and for any active integration that drops a tracking cookie or transfers behavioural data to a third party (Mailchimp, ActiveCampaign, etc.).

What is the legal basis for processing form data?

Pre contractual measures (Art. 6(1)(b) GDPR) for contact and quote forms. Legal obligation (Art. 6(1)(c)) for tax related forms. Consent (Art. 6(1)(a)) for marketing checkboxes and tracking add ons.

Is form data transferred to the United States?

Submissions remain on your WordPress server. Saturday Drive (US) only receives the licence key and optional usage telemetry. Active add ons (Mailchimp, Salesforce, Constant Contact, Stripe) may transfer entry data to the US under the EU US DPF or SCCs.

Do I need a DPIA for Ninja Forms?

Not for the plugin itself. A DPIA is appropriate for forms collecting special categories of data, automated decisions or high risk profiling. The DPIA covers the form purpose and integrations, not the plugin code.

How do I implement Ninja Forms in a GDPR compliant way?

Enable submission expiration, IP anonymisation and the GDPR opt in field. Disable usage telemetry. Use Akismet, hCaptcha or Cloudflare Turnstile for spam control. Sign DPAs with each integration. Document integrations in the records of processing and link them in the privacy notice.

Which alternatives to Ninja Forms should I consider?

WordPress alternatives include Gravity Forms, WPForms, Fluent Forms (Bangladesh), Forminator (US) and Contact Form 7 with Flamingo. EU first SaaS options: Tally (Belgium), Typeform (Spain), JotForm (US with EU hosting).

How do I update the cookie policy when Ninja Forms changes?

When activating a new integration, update the cookie table, the data transfer section and the list of sub processors in your privacy notice, bump the consent banner version to invalidate older consents, and re run any documented assessment.

Same category

More services: Other

See the whole category

Ignition

Ignition is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Ignition integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Ignition helps organizations maintain robust websites that meet user expectations and technical requirements.

Other

WP Google Map Plugin

WP Google Map Plugin is a mapping and geolocation service that enables websites and applications to integrate interactive maps, location search, and geographic data. It provides customizable displays, geocoding, route planning, and location-based services. WP Google Map Plugin supports real-time tracking, store locators, and geographic analytics. With scalable APIs and extensive documentation, WP Google Map Plugin powers location features for digital projects of any size and complexity.

Analytics

TripIt

TripIt is a versatile web technology that supports digital platforms with specialized functionality and enhanced capabilities. It provides robust tools and services that integrate with modern websites and applications seamlessly. TripIt is designed to improve operational efficiency, user experience, and digital performance. Trusted by developers and businesses alike, TripIt offers reliable solutions that scale with organizational needs and evolving web standards.

Other

Hexia

Hexia is a development framework and toolkit providing developers with a structured foundation for building modern web applications. It offers reusable components, standardized architecture patterns, and comprehensive documentation. Hexia accelerates development through code generation, testing utilities, and build optimization. With an active community and extensive ecosystem, Hexia enables teams to build scalable, maintainable applications following industry best practices.

Analytics

Mapbox GL JS

Mapbox GL JS is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Mapbox GL JS supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Mapbox GL JS ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

TrackJs

TrackJs is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. TrackJs offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, TrackJs empowers organizations to optimize strategy and maximize return on investment.

Analytics

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site