Form Abandonment Recovery

Every form on a website has two populations: the people who submit it and the people who start it. The business only ever meets the first group. The second group typed their name, typed their email, got as far as the question about budget or the field asking for a date, and then stopped, interrupted by a phone call, unsure what to put, uncomfortable giving a number, or simply distracted. They leave no trace. As far as the business is concerned they were never there.

This is a larger population than most owners believe, and it is weighted toward the most valuable visitors. Short forms get abandoned by browsers; long forms, quote request forms, application forms, and anything with a conditional second page get abandoned by serious prospects who hit a field they could not answer in the moment. The person who gave you a working cell number and then stalled on "how soon do you need this?" was not a tire-kicker. They were a lead who needed ninety seconds of help.

The leak has a particular shape. The visitor has already handed over contact details (often in the first two fields, because that is how forms are built) and the business discards them because the submit button was never pressed. Meanwhile the ad click that delivered them has been paid for in full. The build below treats every keystroke in a contact field as the capture event, stores what was typed, and follows up on the specific thing the visitor was in the middle of saying. That specificity is what makes the follow-up land: not "we noticed you visited our site", but "you were partway through asking about a kitchen in Chiswick: want me to finish it for you?"

Pipeline and stages

A Form Recovery pipeline, run alongside the normal inquiry pipeline rather than inside it. Partial submissions need their own board because they behave differently from completed inquiries and should never be counted as real leads until recovered.

• Partial Captured: a contact field was completed, the form was not submitted.
• Recovery In Progress: the follow-up ladder is running.
• Re-engaged: the visitor replied, returned to the form, or answered by message.
• Completed by Visitor: they went back and submitted the form themselves.
• Completed by Staff: a team member finished the record by phone or text. This is a different stage on purpose, because it costs labor and you want to see how much.
• Converted to Inquiry: handed over to the main sales pipeline. Terminal here, and this is the only outcome that should be counted as a lead.
• Recovery Failed: full ladder run, no response. Terminal, retained for nurture.
• Invalid or Bot: nonsense data, disposable address, suspected automated fill. Terminal and suppressed.

Calendars

• Recovery Booking Calendar: the calendar linked from every recovery message. 20-minute slots, round-robin, 2-hour minimum notice. Offering a booking is frequently a better recovery path than asking someone to go back and finish a form, because it converts the abandonment into a conversation.
• Callback Window Calendar: short slots for visitors who reply asking to be phoned instead, so the promise has a time attached to it.

Custom fields

These are the heart of the build. The point is to store not just that someone abandoned, but precisely what they had told you.

• Partial Form Name: which form, by its human name.
• Partial Form URL: the page it sat on.
• Partial Resume Link: a prefilled link back to the form carrying the values already entered. The single most important field here.
• Last Field Completed: the name of the final field they filled.
• First Field Abandoned: the field they stalled on. Aggregate this across a month and you have a precise list of which questions are costing you leads.
• Fields Completed Count and Fields Total Count: together these give completion depth, which drives how aggressively you follow up.
• Partial Payload Summary: a readable summary of everything entered, used verbatim in the follow-up copy.
• Abandonment Timestamp: when the last keystroke happened.
• Abandonment Device: Mobile or Desktop. Mobile abandonment clusters at long free-text fields; desktop clusters at sensitive questions.
• Recovery Attempt Count: capped at four by the ladder.
• Recovery Channel Used: SMS, Email, Call, Multiple.
• Recovery Outcome: Completed by Visitor, Completed by Staff, Booked Instead, No Response, Declined, Invalid.
• Partial Contact Validity: Valid Mobile, Valid Email, Both, Neither. Drives which ladder runs.
• Quiet Hours Zone: the visitor time zone.
• Duplicate Of: a reference to an existing contact when the partial matches one, so recovery never cold-pitches a current customer.

Tags

• partial-submission: applied to every contact created this way, and the marker that keeps partials out of your real lead counts.
• partial-deep: more than half the fields completed. These get the fastest and most personal follow-up.
• partial-shallow: contact details only. Lighter touch, longer waits.
• recovery-running, recovery-succeeded, recovery-failed.
• recovery-booked-instead: the visitor skipped the form and took an appointment. Worth tracking separately because it is often the highest-value outcome.
• form-field-friction: applied when the abandoned field matches a known problem field, used to build the case for changing the form.
• suspected-bot, disposable-email, invalid-contact: all hard suppressions.
• existing-customer: applied when Duplicate Of resolves, which switches the copy from sales to service.
• sms-opted-out, email-unsubscribed, do-not-contact.

Forms

• The existing forms, rebuilt on the platform. This is the prerequisite most builds trip over: partial capture requires the form to be a platform form, saving field by field, rather than a third-party embed that only posts on submit. Rebuild the quote request, the contact form, the application form, and any multi-step form. Keep the field order but move every contact field to the top. A form that asks for the phone number last captures nothing from an abandoner.
• Two-step structure on anything longer than five fields: step one is name and one contact method only, step two is everything else. The visitor who completes step one is a captured lead regardless of what happens next, and completion rates on step two are usually higher than on the single long version.
• Short Recovery Form: a stripped-down version of each main form, three fields maximum, linked from the recovery messages. Asking an abandoner to face the same long form again rarely works; asking them three questions does.
• Staff Completion Form: internal, used when someone finishes a partial by phone. Pre-populated with what the visitor already entered so the call starts with "I've got your name and number, I just need two more things."

BO's role and guardrails

• BO handles inbound replies to recovery messages, which is where most of the work actually lands. A visitor who texts back "sorry, got interrupted. What did you need?" gets an answer in seconds rather than when someone next checks the inbox.
• BO can collect the missing fields conversationally, one at a time, and write them to the contact record. This is the most effective recovery path in the whole build: the abandoned form gets completed by text message without the visitor ever returning to the website.
• BO offers the Recovery Booking Calendar whenever the missing information is complicated enough that a conversation beats typing.
• Guardrails: BO never quotes a price, never re-asks a field the visitor already filled, never sends more than one message per inbound reply, and never pretends the business already knows more than the partial record contains.
• BO escalates to a human on any reply expressing annoyance at being contacted, on any complaint, and on any request to be removed. The last of which applies do-not-contact immediately before a human even reads it.
• BO acknowledges the abandonment honestly rather than pretending the form was submitted: "You started filling in the quote form and it looks like it didn't go through" is both true and disarming.

Numbers and channels

• One SMS-capable number for the recovery ladder, the same one used for ordinary inquiry follow-up so replies land in a single conversation thread.
• Authenticated email sending domain for the email arm of the ladder.
• The resume link, which must work on mobile, must not expire too quickly (72 hours is a reasonable window), and must not expose the partial data to anyone who gets hold of the URL without expiring.
• Optional: a retargeting audience fed by partial-submission, so abandoners see the business again while the ladder runs. Use the audience, not the field data, in the ad.

1. A visitor arrives on the quote request page from a paid ad on a Tuesday evening. The form is a platform form rebuilt in two steps, with name and mobile in step one.
2. She types her first name and her cell number, then taps through to step two. Step one is saved the moment it is completed, so a contact now exists with partial-submission applied, Partial Form Name set to Quote Request, Partial Form URL recorded, and Abandonment Device set to Mobile.
3. Step two asks for the property type, the scope of work, and a target date. She answers the first two, then reaches the date field, realizes she needs to check with her partner, and closes the tab.
4. The platform records Last Field Completed as Scope of Work, First Field Abandoned as Target Date, Fields Completed Count 4 of 6, and writes Partial Payload Summary as a readable line: "Quote Request: semi-detached, full rewire, target date not given."
5. Because more than half the fields are complete, partial-deep is applied and a card is created in Form Recovery at Partial Captured. A Partial Resume Link is generated, carrying every value she already entered.
6. Validation runs. The mobile is a real mobile, the name is plausible, and no existing contact matches, so Partial Contact Validity is set to Valid Mobile and no suppression tag is applied.
7. Fifteen minutes later (long enough that she is not mid-form, short enough that she remembers) a text arrives: "Hi Sarah, it's {{location.name}}. Looks like your quote request didn't quite go through: we've got the rewire details, just missing your timescale. Pick up where you left off: {{resume_link}}, or just reply with roughly when and I'll finish it off."
8. She replies "probably March". BO reads it, writes Target Date as March, marks the record complete, moves the card to Re-engaged and then to Completed by Staff, and replies: "Got it: March works. That's everything. Someone will come back to you with the quote within one working day."
9. The now-complete inquiry is created in the main sales pipeline, the card in Form Recovery moves to Converted to Inquiry, and Recovery Outcome is set to Completed by Staff with Recovery Channel Used as SMS.
10. The assigned estimator receives a single notification containing the full set of answers and a note that the last field came in by text, so nothing looks half-finished when they call.
11. Had she not replied, the ladder would have continued: an email at four hours quoting her own answers back to her, a second text the next morning offering a short three-field form instead, and an offer of a 20-minute slot on the Recovery Booking Calendar on day three.
12. Had she still not replied, the card would move to Recovery Failed on day five, recovery-failed would be applied, and she would enter the long-cycle nurture list rather than being deleted or called repeatedly.
13. At the end of the month, First Field Abandoned is aggregated across every partial. Target Date accounts for the largest share, so the form is changed: the date field becomes optional with a "not sure yet" option. The next month's abandonment rate on that form drops, which is the structural fix the recovery ladder was only ever compensating for.

1. Partial Capture and Validation

Trigger: a contact field on a tracked form is completed and the visitor becomes inactive for 90 seconds, or leaves the page, without submitting.

Conditions and branches: branch on whether a usable contact method exists, on whether an existing contact matches, and on validity checks. Nothing proceeds until validation has run: recovering junk data is worse than recovering nothing.

• No contact field completed: exit immediately. Record the abandonment against the form for reporting, but create no contact. A page-level abandonment with no identifier is an analytics event, not a lead.
• Contact field completed: create or update the contact. Write Partial Form Name, Partial Form URL, Last Field Completed, First Field Abandoned, Fields Completed Count, Fields Total Count, Partial Payload Summary, Abandonment Timestamp, and Abandonment Device. Apply partial-submission.
• Generate the Partial Resume Link, prefilled with the entered values and valid for 72 hours.
• Depth branch: if Fields Completed Count is at least half of Fields Total Count, apply partial-deep; otherwise apply partial-shallow.
• Validation: check the mobile is a mobile and the email domain resolves. Set Partial Contact Validity. Apply disposable-email on a known throwaway domain, invalid-contact where neither method validates.
• Bot branch: if the form was filled in under 4 seconds, if the name field contains a URL, or if more than three partials have arrived from the same session, apply suspected-bot, move the card to Invalid or Bot, and run nothing further.
• Duplicate branch: if the contact method matches an existing record, write Duplicate Of, apply existing-customer, and route to the service-toned variant of the ladder rather than the sales one.
• Create a card in Form Recovery at Partial Captured for every surviving partial.

Exit: on validation complete. If the visitor submits the form properly within the 90-second window, the partial is discarded entirely and only the real submission is recorded. No duplicates, no recovery message to someone who already finished.

2. Deep Partial Recovery Ladder

Trigger: tag partial-deep applied with Partial Contact Validity of Valid Mobile or Both.

Conditions and branches: every step is gated on quiet hours in the Quiet Hours Zone, on the card not having reached a terminal stage, and on no suppression tag being present.

• Apply recovery-running, move the card to Recovery In Progress.
• Wait 15 minutes. Fifteen is deliberate: sooner reads as surveillance, later and the context has gone. Increment Recovery Attempt Count to 1. Send SMS: "Hi {{contact.first_name}}, it's {{location.name}}. Looks like your {{custom_values.partial_form_name}} didn't quite go through: we've got {{custom_values.partial_payload_summary}}, just missing {{custom_values.first_field_abandoned}}. Pick up where you left off: {{custom_values.partial_resume_link}}, or reply here and I'll finish it off for you."
• Wait 4 hours. If no reply, no resume-link click, and no submission, increment to 2 and send email. Subject: "Your {{custom_values.partial_form_name}}, one field left". Body quotes their own answers back as a short list, then the resume link, then a single line offering to finish it by phone.
• Wait until 09:30 the next working day. Increment to 3. Send SMS offering the easier route instead of the same form: "Morning {{contact.first_name}}, rather than go back to the form, this version is three questions: {{short_form_link}}. Takes about 20 seconds."
• Wait 2 days. Increment to 4. Send the final message, which switches the offer from form to conversation: "Last one from me, {{contact.first_name}}. If it's easier to just talk it through, grab a 20-minute slot here: {{recovery_calendar_link}}. Otherwise I'll stop chasing."
• Wait 2 days. Move the card to Recovery Failed, apply recovery-failed, remove recovery-running, and add the contact to long-cycle nurture.
• Parallel branch: at any point, if the resume link is clicked but the form is still not submitted within 30 minutes, send one extra message: "Saw you had another look: anything in there that's hard to answer? Just reply and I'll sort it." This catches the visitor who hit the same blocking field a second time, which is the most common failure mode.

Stop conditions: form submitted, any inbound reply, booking created, do-not-contact, sms-opted-out, or the contact entering the main sales pipeline by any other route.

3. Shallow Partial Recovery Ladder

Trigger: tag partial-shallow applied.

Conditions and branches: branch on Partial Contact Validity: Both or Valid Mobile runs the SMS-led version, Valid Email only runs the email-only version, Neither exits to Invalid or Bot.

• Wait 1 hour. A shallow partial has given you only contact details, so there is no useful context to reference and less earned permission; a 15-minute message here reads as intrusive.
• Increment Recovery Attempt Count to 1. SMS variant: "Hi {{contact.first_name}}, {{location.name}} here. You started our {{custom_values.partial_form_name}} earlier. Want to finish it, or would you rather just tell me what you need? {{custom_values.partial_resume_link}}"
• Email-only variant: subject "Did you need a hand with this?", one short paragraph, the resume link, and a reply invitation. No images, no branding block. It should read like a person wrote it.
• Wait 1 day. If no engagement, increment to 2 and send one short email offering the three-field Short Recovery Form.
• Wait 3 days. Increment to 3. Final email, with the booking link rather than the form.
• Wait 3 days. Move to Recovery Failed, apply recovery-failed, and add to nurture. Three touches is the ceiling for a shallow partial. These people gave you very little and chasing harder produces complaints, not leads.

Stop conditions: as for the deep ladder. Additionally, exit immediately if existing-customer is applied by a later duplicate check.

4. Inbound Reply Handling and Conversational Completion

Trigger: inbound SMS or email reply from a contact carrying partial-submission and recovery-running.

Conditions and branches: branch on reply intent, classified by BO into: answering the missing field, asking a question, asking for a call, declining, or complaining.

• All paths: immediately move the card to Re-engaged and pause every scheduled step in the active ladder. A visitor who replied and then received the next automated message is the most avoidable failure in this build.
• Answering the missing field: BO writes the value to the correct field, then checks whether anything else is outstanding. If complete, move to Completed by Staff, set Recovery Outcome, create the inquiry in the main pipeline, and reply: "That's everything: thanks {{contact.first_name}}. {{next_step_line}}" If fields remain, BO asks for exactly one more, never two.
• Asking a question: BO answers from the knowledge base if it can, then returns to the outstanding field in the same message. If it cannot answer, escalate with the partial payload attached.
• Asking for a call: offer three slots from the Callback Window Calendar, book the chosen one, apply recovery-booked-instead, and set Recovery Outcome to Booked Instead.
• Declining ("not interested", "changed my mind"): reply once: "No problem at all, {{contact.first_name}}. We'll leave it there." Move to Recovery Failed with Recovery Outcome Declined. Send nothing further, ever.
• Complaining or objecting to contact: apply do-not-contact immediately, suppress every sequence, notify the manager, and send one apology. Do not have BO attempt to retain the person.
• Unclear reply: one clarifying question, then escalate to a human if the second reply is also unclear. Never a third attempt.

Exit: on completion, booking, decline, or escalation. The ladder never resumes once paused by a reply.

5. Staff Completion Path

Trigger: card sits in Recovery In Progress with partial-deep for 24 hours with no engagement, or a staff member claims the card manually.

Conditions and branches: run only for deep partials. Shallow partials do not justify labor.

• Create a task for the assigned user: "Finish partial: {{contact.full_name}}, missing {{custom_values.first_field_abandoned}}", due within 4 working hours, with the Partial Payload Summary in the task body so no preparation is needed.
• Attach the Staff Completion Form, pre-populated with everything already entered.
• On call connected and form completed: move the card to Completed by Staff, set Recovery Channel Used to Call, create the inquiry in the main pipeline, and move the recovery card to Converted to Inquiry.
• On no answer: send SMS from the user's own thread: "Tried to reach you about your {{custom_values.partial_form_name}}, {{contact.first_name}}. Easier by text? Just tell me {{custom_values.first_field_abandoned}} and I'll do the rest." Return the card to Recovery In Progress and let the ladder continue from where it paused.
• Wait 4 hours after the task due time. If the task is still open, reassign it once to the next available user rather than letting it rot with its original owner.
• Cap staff attempts at two calls. Past that the ladder finishes the job or nobody does.

Stop conditions: completion, decline, or card reaching a terminal stage.

6. Form Friction Analysis

Trigger: scheduled, the first working day of each month, covering the previous calendar month.

Conditions and branches: run per form rather than in aggregate. A single combined report hides the one form that is doing the damage.

• Compile per form: submissions completed, partials captured, abandonment rate, and the distribution of First Field Abandoned ranked by volume.
• Compile the abandonment rate split by Abandonment Device. A field that abandons on mobile and not on desktop is almost always a layout or keyboard problem rather than a question problem.
• Compile average Fields Completed Count at abandonment, which tells you how far people get before the wall.
• Flag any field accounting for more than a quarter of abandonments on its form and apply form-field-friction to the affected partials, so the next report can show whether a change helped.
• Email the owner and whoever owns the website. Subject: "Form friction: {{worst_form_name}} losing most at {{worst_field_name}}".
• Wait 10 minutes, then create one task per flagged field: "Review {{field_name}} on {{form_name}}, make optional, add an unsure option, or move later in the sequence", due within two weeks.
• Branch: if a form's abandonment rate exceeds the client's agreed threshold two months running, escalate to a rebuild recommendation rather than another field tweak.

Exit: on send and task creation. Reports measured platform data only; it names where people stop, not why, and the recommended action is always a test rather than a conclusion.

7. Recovery Performance Digest

Trigger: scheduled, every Monday at 08:00 for the previous seven days.

Conditions and branches: send only if at least three partials were captured.

• Compile partials captured, split deep and shallow; recoveries by outcome; recovery rate overall and by channel; and the share of recoveries that needed staff labor versus the ones the ladder closed alone.
• Compile the time-to-recovery distribution. If most recoveries happen on the first message, the later steps can be shortened; if most happen on step three, the first message is wrong.
• Compile suppression counts: bots, disposable emails, invalid contacts, and duplicates. A spike in bots usually means a form needs a challenge added.
• Compile the exception list: cards in Recovery In Progress for more than 5 days, cards in Re-engaged with no activity for 48 hours, and any contact that received a ladder message after replying. The last of these is a build defect and should be investigated the same day.
• Email the owner. Subject: "Form recovery: {{recovered_count}} of {{partial_count}} recovered".
• Wait 10 minutes, then create a task for each exception-list item, assigned to the relevant owner and due that day.

Exit: on send and task creation.

8. Suppression and Hygiene Sweep

Trigger: scheduled, daily at 06:00.

Conditions and branches: this workflow exists because a recovery build generates more bad data than any other kind, and bad data in a messaging ladder costs deliverability.

• Find contacts carrying partial-submission created in the last 24 hours with no valid contact method and no engagement. Move to Invalid or Bot, apply invalid-contact, and remove them from every sequence.
• Find partials where a later full submission exists for the same contact and the recovery ladder is still running. End the ladder, merge the records, and move the card to Completed by Visitor. This duplicate case is the most common complaint source in the build.
• Find contacts with three or more partials on the same form inside 48 hours. Apply suspected-bot and suppress, unless a human reply exists on the thread.
• Find email addresses that hard-bounced on a recovery email. Apply invalid-contact, and if no mobile exists, end the ladder rather than continuing to send.
• Find partials older than 90 days in Recovery Failed and clear Partial Payload Summary, Partial Resume Link, and Partial Payload detail, retaining only the aggregate counts needed for the friction report. This is the retention mechanism, and it should be a real scheduled job rather than a policy nobody runs.
• Notify the admin with a one-line count of each action taken. No action list, no detail: just enough to notice an anomaly.

Exit: on completion of the sweep.

A population the business never met becomes visible and, in a meaningful share of cases, contactable. The visitor who typed their cell number and then stalled on a question is no longer lost; they get a message within fifteen minutes referencing exactly what they had already said, and the fastest-closing recovery path (answering the last question by text) does not require them to go back to the website at all.

Lead volume reported from the website goes up without any change in traffic, and the increase is honest because the recovery pipeline is kept separate until a partial actually converts. Just as valuable, the business stops guessing which questions on its forms cost money. First Field Abandoned, aggregated monthly, is a ranked list of friction, and acting on it reduces abandonment at the source rather than recovering it after the fact. Most clients find one field that was quietly destroying a quarter of their inquiries.

There is a discipline change too. Rebuilding forms on the platform with contact fields first and a two-step structure usually lifts straight-through completion on its own, before a single recovery message is sent. The recovery ladder then works on what remains.

Metrics to watch

• Partial capture rate: partials captured per form start. This is new visibility, not a performance number, but you need the baseline.
• Form abandonment rate per form: partials divided by form starts, tracked per form and watched after every field change.
• Recovery rate: partials reaching Converted to Inquiry, divided by valid partials. The headline number.
• Recovery rate by depth: deep versus shallow, which will differ substantially and should drive how much effort each ladder gets.
• Recovery rate by channel: SMS versus email versus call, which tells you where to invest the copy effort.
• Staff-assisted share of recoveries: how much of the result costs labor. Rising means the automated copy needs work.
• Time to first recovery message: should sit reliably at the configured delay; drift means a workflow is queuing.
• Time to recovery: and specifically which ladder step closes the most, which tells you where to shorten or lengthen.
• Top abandoned field per form: the number that drives form changes, reviewed monthly.
• Complaint and opt-out rate on recovery messages: watch this closely. Recovery messaging sits closer to the line than ordinary follow-up, and a rising opt-out rate means the timing or the tone is wrong.
• Suppression volume: bots, disposables, and invalids as a share of partials, which is both a data-quality signal and an early warning on form spam.

Prerequisites

• The forms must be platform forms. Partial capture requires field-by-field saving, which a third-party embed or a plain HTML form posting on submit cannot provide. Audit every form on the site and plan the rebuild before anything else. This is the work, and underestimating it is why this build slips.
• Agreement to reorder fields so that name and one contact method come first. If the client insists the phone number stays at the bottom, say plainly that the build will capture almost nothing, and either win that argument or do not start.
• A decision on the resume link window. 72 hours is a sensible default; longer increases the chance that a stale link carrying personal data is sitting in an SMS thread.
• An agreed position on how soon is too soon for the first message. Fifteen minutes works for most businesses and feels intrusive for a few; test it rather than assume.
• A named owner for the Recovery In Progress stage and for the monthly friction report. The friction report is where the real value is, and reports without an owner do not get read.
• Honest expectations. Not every partial is recoverable, a shallow partial is barely a lead, and the right response to a bad abandoned field is to fix the field.

Integrations

• Website access to replace existing forms and install the platform form embed, with a tested path for whoever maintains the site to do it again later.
• Google Calendar or Outlook two-way sync for the Recovery Booking and Callback Window calendars.
• Email sending domain authenticated with SPF, DKIM, and DMARC. Recovery email goes to people who did not complete an opt-in, so deliverability is less forgiving than normal and authentication is not optional.
• An SMS-capable number, provisioned and registered.
• Optional: Meta or Google ad platform connection to build a retargeting audience from partial-submission, and Zapier or Make if recovered inquiries need to reach a legacy system.
• A bot challenge on public forms: the build makes form spam visible, and without a challenge the recovery pipeline fills with it.

Number provisioning and messaging compliance

• Provision the SMS number and complete carrier registration before launch. In the US, A2P 10DLC brand and campaign registration is required; start it on day one, because approval takes days and unregistered traffic is silently filtered.
• Consent is the central question in this build and deserves real attention. A visitor who abandoned a form has not pressed submit, so whatever consent language sits next to the submit button has arguably not been given. Put the messaging consent line next to the first contact field, visible before any value is entered, stating plainly that the details may be used to follow up on an incomplete inquiry. Store the timestamp and the exact wording shown.
• Register the campaign use case honestly. This is conversational follow-up on a self-initiated inquiry, not cold outreach, and the sample copy you register should match what the ladder actually sends.
• Implement opt-out handling on every path: STOP, UNSUBSCRIBE, QUIT and variants apply sms-opted-out, end every sequence immediately, and produce exactly one confirmation reply.
• Honor email unsubscribe on the recovery emails even though they are transactional in intent; the recipient's view is what matters, not the classification.
• Quiet hours at 08:00-20:00 in the contact's own time zone, held in Quiet Hours Zone, with no exceptions in this build. Nothing in form recovery is urgent.
• Cap total messages per partial at four, across all channels, and never restart a ladder for the same form and the same contact inside 30 days.

Data protection

• Partial form data is personal data that the person chose not to submit, which makes it a sensitive category operationally even where it is not legally special. Hold it for as long as recovery is plausible and no longer. The 90-day purge in the hygiene sweep is the mechanism, and it should be tested rather than assumed to work.
• Resume links carry prefilled personal data in a URL. Expire them, make them single-contact, and never include them in anything forwarded or screenshotted into a group thread.
• Never partially capture a field carrying special-category information. If a form asks about health, financial detail, ethnicity, or anything comparable, exclude those fields from partial storage entirely and recover using the contact fields alone.
• Make the privacy notice reachable from the form itself and ensure it covers follow-up on incomplete submissions explicitly. "We may contact you about an inquiry you started" is a short sentence and it changes the position considerably.
• Where visitors may be in the UK or EU, document the lawful basis for contacting a non-submitter, keep the marketing consent separate from the recovery contact, and make sure deletion requests clear the partial payload and the resume link as well as the contact record.

None of the above is legal advice. Form recovery sits closer to the consent boundary than most automation, and the rules differ materially by jurisdiction. Confirm the specifics with the client's own counsel before launch, and get the consent wording, the retention period, and the message cap signed off in writing.

Scoping depends mainly on how many forms need rebuilding. Book a call at bookings.appbo.io to work through yours.