Collect leads, enquiries and subscribers from your site

Adding a form

Venture → Website tab → the Forms card → Add a form.

A new form defaults to a "Contact us" title, an email field, a Send button and the success message "Thanks — we'll be in touch." Field types available are text, email, tel, textarea and select.

Where submissions go

Pick one destination per form:

Destination	What happens
Your CRM	A contact is created (source: form) with an activity on their timeline. Enquiry-shaped forms also open a deal in the first pipeline stage.
Your support inbox	It becomes a real support thread on the venture's Support tab, and the person is also filed into the CRM.
Your newsletter list	They are subscribed to the venture's default audience.
Your own database	The page posts directly to your Supabase project. It never touches kitty's servers.

Whether a form opens a deal is inferred from its title: quote, contact, enquiry, booking, demo, call, consultation, estimate, hire and order do; newsletter, subscribe, updates and mailing don't.

Where you read them

• CRM tab — contacts, companies and deals, with the submission on the timeline
• Support tab — contact-form enquiries as threads
• Newsletter tab — subscribers

You are not emailed on each submission. Instead a lead.captured event fires, which triggers any webhook you have connected — see automating with the API if you want a Slack ping or a Zap.

Spam protection

Built in, nothing to configure:

• A honeypot field hidden off-screen. A bot that fills it gets a normal success response — telling a bot it was caught only teaches it to avoid the trap next time.
• Rate limits per network: 12 form submissions per 10 minutes, 20 newsletter signups per 10 minutes.
• A 32KB body cap.
• Responses are deliberately uniform: unknown form, duplicate contact and successfully filed all look identical from outside.

One consequence of the honeypot: you cannot name one of your own fields company_website — it is reserved for the trap, and the builder will tell you to rename it.

Unpublishing a form

Delete the form and republish. The endpoint checks that the form is still present in the published site, so an old form's submissions stop being accepted the moment you republish without it. That is the withdrawal mechanism — the tokens themselves do not expire.

Newsletter signups from a published site

Newsletter forms are authenticated by the audience's own unguessable key, so a scraped form cannot be repointed at another venture's list.