The problem
Clovvi's website is a fast static site: plain HTML pages generated by a small Node.js script and hosted on Netlify. Static sites are quick and secure, but they have no server of their own, so a contact form has nowhere to send its data.
We wanted three things from every inquiry:
- An email alert right away, so no message waits.
- A row in a Google Sheet, so every lead can be tracked from first contact to a decision.
- No monthly software bill, and no customer data stored in places we do not control.
The tools we used
- Netlify Forms to receive submissions from the website. Netlify detects the form when the site is built and stores each submission.
- A honeypot field for spam. It is a hidden field that people never see. Bots tend to fill it in, and Netlify then rejects the submission. Netlify also screens submissions with its own spam filter.
- Netlify email notifications to send an alert to the business inbox the moment a form is submitted.
- Google Apps Script, a free scripting tool built into Google Sheets, to copy new submissions into the sheet.
- The Netlify API with a personal access token, so the script can read submissions.
How it works
- A visitor fills in the project form on the Contact page and presses Send.
- Netlify checks the submission for spam, stores it and sends the email alert.
- Every 5 minutes, the script in the Google Sheet asks Netlify for recent submissions.
- For each submission it has not seen before, it adds a new row: date, name, contact details, service, project description, timeline and budget range.
- The row starts with the status "New". The sheet colors each status, highlights overdue follow-ups in red and keeps a summary tab with totals by status, service and customer type.
Each submission has a unique ID, and the script records it in the sheet. That way the same inquiry is never added twice, even if the script runs again.
Security choices
Contact data deserves care, even on a small website. We made a few deliberate decisions:
- The Netlify token is not in the code. It is stored in the script's private settings and can be revoked from Netlify at any time. It also has an expiry date.
- The script can only open this one spreadsheet. Google asks for access to "spreadsheets that this application has been installed in" instead of every file in the account.
- Formulas typed into the form are stored as plain text. If someone types a spreadsheet formula into the form, the sheet will not run it.
- The form asks visitors not to send passwords or payment details, and the privacy notice explains where submissions go.
The result
- Inquiries reach the inbox within about a minute and appear in the sheet within 5 minutes.
- Every lead has a status, a follow-up date and notes in one place.
- The monthly software cost is $0. Netlify and Google free-tier limits apply, which is fine for a growing small business.
What we would change for a busier business
Checking every 5 minutes is fine for a small business. A business that needs leads in the sheet instantly, or receives many inquiries a day, can use a webhook instead: Netlify sends each submission straight to a script the moment it arrives. Some hosting plans charge for webhooks, which is why we started with the free approach.
If you want a similar setup for your own website, or need inquiries to flow into a CRM instead of a spreadsheet, tell us about your project.