Core features

Integrations

Every form submission can be sent on to the tools you already use, or to your own backend.

How it works

Add a destination in Settings → Integrations. Each form (see Automations) then sends its submissions to every destination, or to the ones you pick under Send submissions to in the builder. You can add several destinations, including several webhooks, and give each a name. A submission is saved, queued for each destination and delivered in the background, so a slow or failing tool never delays the form a visitor is looking at.

Verified before saving. Adding a destination makes a real, read-only call to the provider, so a wrong key, audience or missing permission is reported while you are looking at it.
Automatic retries. A temporary failure (a timeout, HTTP 429 or a 5xx) is retried after 30 seconds, 2 minutes, 10 minutes, 1 hour and 6 hours, then marked failed. The queue is stored in the database, so a restart does not lose what is waiting. A rejected request (a 4xx) is not retried, since it would be rejected again.
Retry by hand. A failed delivery shows a Retry button in the log and goes back in the queue.
Automatic pause. A rejected credential pauses the destination at once, and five failed deliveries in a row pause it too. The card shows Needs attention and the last error. Submissions that arrive while it is paused wait for it; turn it back on, or edit the credentials, and they are sent.
A delivery log. Each submission and destination appears under Recent deliveries as queued, retrying, delivered, skipped or failed, so did it arrive? always has an answer. The log ages out with your other history.

At least once

A destination that was down gets the submission again later, and a network timeout can hide a success, so a webhook may receive the same submission twice. Every webhook request carries Idempotency-Key (the submission id) so you can skip repeats. Mailchimp, Klaviyo and HubSpot update by email address, so a repeat changes nothing.

Providers

Provider	What you give us	What happens to a submission
`Zapier / Webhook`	The Catch Hook or endpoint URL, and optionally a signing secret.	Posts the submission as JSON (`event`, `submission_id`, `email`, `name`, `phone`, `consent`, `fields`, the `prize` a spin wheel or coupon gave, and the popup, variant and page it came from). With a secret, requests carry `X-Seentics-Signature: sha256=…`, an HMAC of the body. Always sent, with the consent flag in the payload.
`Mailchimp`	An API key (including the -us21 style suffix) and an Audience ID.	Adds or updates the member. Only people who ticked the consent box are sent; others are skipped. Optional double opt-in.
`Klaviyo`	A private API key, and optionally a list ID.	Creates or updates the profile for every submission. With a list: someone who consented is subscribed to email marketing on it; someone who did not is added as a plain member, with no consent recorded.
`HubSpot`	A private app access token.	Creates the contact, or updates it if the email already exists. Sent whether or not the visitor consented, since it is a CRM record and HubSpot has its own subscription controls.

Mailchimp and Klaviyo treat a list subscription as marketing consent, so Seentics only creates one when the visitor actually ticked the consent checkbox on your form. Add a consent line to the form if you want those people synced.

Zapier, your own backend and other webhooks

Create a Zap with the Webhooks by Zapier trigger, choose Catch Hook, and paste its URL into Seentics. Adding it sends one sample submission (seentics-test@example.com, with event: lead.test) so Zapier can learn the field names. Any other service that accepts an HTTPS JSON POST works the same way, including a separate CRM or leads app you run yourself: add its endpoint as a webhook and set a signing secret so it can verify the requests. The URL must be https and must resolve to a public address; internal and private addresses are refused.

Credentials and security

Credentials are encrypted with AES-256-GCM before they are stored, under a key you set in the INTEGRATIONS_ENCRYPTION_KEY environment variable (32 bytes, base64 or hex; generate one with openssl rand -base64 32). A stored value is also bound to its website and destination, so it cannot be copied into another one.
They are never shown again. The dashboard displays only the last few characters of a key. Editing a destination leaves the secret fields empty; leave them blank to keep the saved one.
They are never put in an automation, a log line or an error message.
Without that key, a production server refuses to save credentials and logs an error at start if destinations already exist. Development uses a built-in key and warns about it.
To rotate the key, put the new one in INTEGRATIONS_ENCRYPTION_KEY and keep the old in INTEGRATIONS_ENCRYPTION_KEY_PREVIOUS (comma-separated). Existing destinations keep working; credentials are re-sealed under the new key when next saved.

Give each integration the narrowest permission it needs: crm.objects.contacts.write (and read, to verify) for HubSpot; profiles, lists and subscriptions write for Klaviyo.

What Seentics keeps

A submission is listed on its form's page for 90 days, then deleted. While a delivery is waiting or has failed, the data it needs is held with it so it can be retried; it is cleared once the delivery succeeds, and failed ones are cleared after 30 days.
Seentics is not a contact database. Keep long-term contacts in the destination, such as your email platform or CRM.
The plan limit counts submissions per calendar month. Over it, new submissions are refused until the month rolls over or you upgrade.

Limits

Submissions are delivered as they arrive. Ones from before you added a destination are not back-filled; export them from the form's page as a CSV while they are still stored.
Up to ten destinations per website.
Names are split on the first space into first and last name, since the form collects a single name.
The Send test button sends a sample submission. For list-based tools that adds a test contact (seentics-test@example.com) you can delete afterwards.