§ 04 — PROJECT 02 / 05 MIDDLEWARE · CLOUDFLARE EDGE · GDPR
▶ LIVE

Webweezl Connect. Forms, bookings, CRM-routing — GDPR-native.

Forms, appointment booking, double-opt-in, CRM routing — one platform. Hosted on Cloudflare's EU edge with native connectors to Pipedrive, HubSpot, Google Sheets, Calendar, Zoom and Teams. Plus a WordPress plugin with Gutenberg, Elementor and Divi support. The glue layer between your touchpoints and your CRM — without Zapier limits.

What you get
Form builder Appointment booking Double-opt-in WordPress plugin Pipedrive · HubSpot · Sheets Calendar · Zoom · Teams Stripe for paid bookings Anti-bot gauntlet
§ NOTES FROM THE WORKBENCH · coming soon
§ THE PROBLEM WHERE YOUR LEAD FLOWS LEAK FOUR LEAKS

Four breaks between touchpoint and CRM.

A lead fills out a form. What happens between that click and the CRM record decides conversion rate, response time, GDPR compliance — and ultimately the sale. Here are the four breaks that sit between form and CRM in almost every SMB setup.

01 · MAILBOX GRAVEYARD

Form submissions land in an inbox.

Standard setup: theme form sends an email to info@. Someone opens the email, copies the data into the CRM, sends a confirmation, books an appointment. Three tools, five clicks, a human in the loop — and one lost lead per day because the email got buried.

02 · TYPEFORM-CALENDLY-MAILCHIMP MIX

Three subscriptions for one lead intake.

Typeform for the form. Calendly for the booking. Mailchimp for double-opt-in. Zapier in between, so they all talk to each other. Four tools, four sub-processors, four audit logs. Each one is fine on its own — together it's expensive, fragile and on the GDPR borderline.

03 · DOI BLIND FLIGHT

Newsletter sign-ups without documented double-opt-in.

If you send marketing emails, you need documented DOI with an audit log — otherwise you have no proof if there's a dispute. Most standard form tools store the DOI click somewhere, but not in a way you can quickly retrieve when a data subject asks.

04 · ZAPIER LIMITS AND COST

Zapier free covers 100 tasks per month.

At medium volume you hit Zapier limits. You upgrade to 750 tasks/month, then 2000, then four-figure annual cost. Plus US hosting on your GDPR sub-processor list. Plus workflows that aren't versionable, aren't testable, aren't production-grade for volume above 1,000 tasks/month.

§ HOW IT WORKS WHAT CONNECT DOES THREE LAYERS

What you actually get.

Connect is three disciplines in one stack: lead intake (forms + booking), GDPR-compliant processing (DOI + audit log), and distribution to your tools (CRM, calendar, video, webhooks). Plus a full WordPress plugin.

01 · INTAKE Forms, booking, entry points Embed · Standalone

Connect replaces Typeform + Calendly with its own form and booking engines. Embedded or standalone, anti-bot protected, with Stripe payments for paid bookings.

Form builder + WP plugin
EMBED · GUTENBERG · ELEMENTOR · DIVI

Form editor with conditional logic, file upload (R2 storage), multi-page forms, B2B org de-dup. Embeddable as a script tag or via the native WordPress plugin (v1.2.3) with shortcodes, Gutenberg blocks, Elementor widget, Divi module. Auto-updater for plugin releases.

Passt für: WordPress sites, custom themes, multi-CMS setups with forms in multiple places.
Appointment booking with conflict check
CALENDAR-NATIVE · TIMEZONE-AWARE

Booking logic with Google Calendar / Microsoft 365 Outlook integration. Slot generation with DST gap handling, conflict check against three sources (existing bookings + external calendar + manual exceptions), buffer times, multi-person booking. Confirmation email with video link (Zoom or Teams).

Passt für: Discovery calls, advisory sessions, onboarding calls, demos.
Stripe-paid bookings
PER-WORKSPACE STRIPE · IDEMPOTENT

Per-workspace Stripe keys (AES-256-GCM encrypted at rest). Paid bookings via Stripe Checkout — coaching sessions, advisory slots, webinars. Idempotent webhook processing (493 lines of webhook handler), no double-booking risk.

Passt für: Coaches, consultants, paid discovery calls, fee-based advisory models.
02 · PROCESSING DOI, routing, audit log GDPR standards

Between lead intake and CRM record, the processing happens. GDPR standards (DOI with three modes, audit log), anti-bot gauntlet, security layer.

Double-opt-in with three modes
GDPR · CONFIGURABLE

Standardized DOI flow: lead fills form → confirmation email → click → record marked DOI-confirmed in the CRM. Three modes configurable per form: formbridge (Connect manages end-to-end), crm (CRM manages, Connect syncs), none (no DOI). With audit log: when was the click, from which IP.

Passt für: Newsletter sign-ups, whitepaper downloads, lead magnets — anywhere GDPR compliance has to be provable later.
Anti-bot gauntlet
HONEYPOT + TIMING + TURNSTILE

Three layers combined: dual honeypot (two hidden fields), 2-second minimum timing (bots fill forms faster than humans), Cloudflare Turnstile (per-workspace BYO since April 2026). Each layer optional. Plus per-isolate rate limiting.

Passt für: B2B sites with spam risk, lead magnets at high volume, any form setup where fake submissions cost money.
Per-workspace auth + 2FA
PBKDF2 · TOTP · MULTI-WORKSPACE

PBKDF2 auth (100k iterations SHA-256) with httpOnly cookie sessions (7-day TTL). 2FA via TOTP (RFC 6238). Multi-workspace membership per user, clean workspace switching. User-invite flow with token. Super-admin routes for platform management.

Passt für: Agencies running multiple clients in one Connect instance, teams with clear role separation.
03 · DISTRIBUTION CRM, webhooks, mail Native + custom

In the end the data lands where decisions get made — the CRM, the newsletter tool, the Slack channel, the accounting system. Connect knows the standard CRMs natively and routes via webhook to everything else.

Native CRM connectors
PIPEDRIVE · HUBSPOT · GOOGLE SHEETS

Native connector logic. Pipedrive: person/org de-dup, notes, consent tracking, file attachments (263 lines of integration). HubSpot: contacts with field mapping. Google Sheets: OAuth + append. No generic webhook hacks — real CRM integration.

Passt für: Standard CRM setups, SMBs with a clear sales stack.
Calendar + video
GOOGLE · OUTLOOK · ZOOM · TEAMS

Google Calendar (OAuth + conflict query), Microsoft 365 Outlook + Teams (combined 250+ lines of integration), Zoom (meeting CRUD). On every booking: appointment in calendar + video link automatically. On cancellation: clean up automatically.

Passt für: Service providers with high appointment volume, coaches, consultants.
Generic webhooks + connector API
OUT · CRON POLLING · 5-MIN

When the destination isn't a native connector: webhook-out to arbitrary URLs. Plus generic connector API with 5-minute cron polling for pull-based integrations. ActiveCampaign connector currently flagged as a stub (roadmap item).

Passt für: Custom backend systems, in-house CRMs, multi-tool workflows.
§ ARCHITECTURE CLOUDFLARE EDGE · GDPR-NATIVE WORKERS + D1 + R2
▸ THE TECH · IN THE OPEN

Cloudflare edge with GDPR by design.

Webweezl Connect runs entirely on Cloudflare Workers — no own server, no classic hosting, no VM maintenance. Workers run close to the edge (with EU regions), data lives in Cloudflare D1 (SQLite-compatible) and R2 (storage). That gives sub-200ms latency across DACH and deployment in seconds, not minutes.

The GDPR story. Cloudflare offers EU-region routing. Lead data is written to D1, which runs on European edge replicas. Per-workspace Stripe keys are AES-256-GCM encrypted at rest (Web Crypto API). Audit logs for every DOI confirmation with IP, user agent, timestamp — GDPR retention configurable.

What didn't need to be invented. Custom JWT (HS256) via Web Crypto, custom PBKDF2 (100k iterations), custom TOTP (RFC 6238) — all native, no third-party auth libraries. Stripe via direct fetch (no SDK), because the Workers bundle has to stay small. Hono.js as the framework — fast, small, edge-native.

For DACH SMBs that means: low latency, EU region where possible, a clean sub-processor list (Cloudflare as ISO-27001-certified processor, Resend for email). No US cloud in the lead-data path.

  • 01
    Cloudflare Workers + Hono.js Runtime on edge compute, EU region included. Sub-200ms across DACH, deployment in seconds.
  • 02
    Cloudflare D1 (SQLite-compatible) 27 migrations deep, database name formbridge (internal codename). Everything on one layer.
  • 03
    Cloudflare R2 File storage for form uploads (PDF/JPG/PNG with type verification). Auth-gated file viewer.
  • 04
    AES-256-GCM encryption Per-workspace Stripe secrets encrypted at rest via Web Crypto API. Encryption key not recoverable — generated once.
  • 05
    Anti-bot gauntlet Honeypot + 2s timing check + per-workspace Cloudflare Turnstile (BYO). Plus per-isolate rate limiting.
  • 06
    WordPress plugin (PHP 7.4+) v1.2.3 with auto-updater, shortcodes, Gutenberg blocks, Elementor widget, Divi module. Auto-updates opt-in since v1.2.2.
§ WHO IT'S FOR WHERE IT FITS BEST FOUR USE CASES

Who uses Connect to its full potential.

Connect is built for SMBs that take lead flows seriously — and are either too big for Zapier, too GDPR-strict for US tools, or have enough volume that monthly SaaS subscriptions stop justifying themselves.

USE CASE 01

WordPress-heavy SMBs with form chaos

You run a WordPress site, maybe built with Elementor or Divi. Forms in 5–10 places — contact, newsletter, lead magnet, advisory inquiry. Today each one is built with a different plugin or tool. The Connect WordPress plugin bundles them all into one system with a consistent backend.

▶ One form solution instead of five
USE CASE 02

Coaches + consultants with paid discovery calls

You sell discovery calls or first sessions for a fee. Today stitched together with Calendly + Stripe + Mailchimp. Connect bundles it: paid booking with DOI, Stripe Checkout, calendar sync, confirmation email with Zoom/Teams link in one flow.

▶ Paid booking without tool-stack drudgery
USE CASE 03

Growing SMB with Zapier pain

Two years ago you set up a few Zaps. Today you're paying €40+/month for Zapier, three Zaps are broken, nobody dares change anything. Connect bundles it into one platform with documented workflows, audit logs and no monthly task-limit brake.

▶ Consolidating 4 subscriptions into 1
USE CASE 04

Agency building lead setups for clients

You regularly build form-plus-CRM-routing setups for SMB clients. Instead of configuring Typeform + Calendly + Mailchimp + Zapier each time, you use Connect with multi-workspace — one instance, many clients, each client only sees their workspace.

▶ Repeatable setups instead of tool-mix wrangling
§ PRICING CUSTOM · PER CONVERSATION NO STANDARD TIER

We agree pricing based on your setup.

Connect runs as a multi-workspace platform — the question isn't "which tier" but "how many workspaces, how many submissions per month, which integrations, how much onboarding". From there a sensible package emerges — not from a one-size-fits-all table.

CONTACT

Book a 30-minute first call

Free first call — 30 minutes, you tell me what you need, I tell you what makes sense. After that a written proposal with clear pricing. Booking link below:

▸ Get in touch
§ FAQ COMMON QUESTIONS 9 ANSWERS BEFORE YOU INSTALL

What you should know upfront.

The questions that come up again and again in first-call conversations — answered ahead of time.

  1. 01 How is Connect different from Zapier or Make? +

    Three differences: (1) Cloudflare-edge native. Connect runs on Workers (with EU edge regions), not on US cloud. Lower latency, no US sub-processor in the data pipeline. (2) Native CRM connectors instead of generic webhooks. Connect knows Pipedrive, HubSpot, Google Sheets natively — no generic webhook hacks, no field-mapping drudgery. (3) No task limits. Connect doesn't bill per operation count.

  2. 02 Does Connect work with my existing CRM? +

    Native connectors: Pipedrive, HubSpot, Google Sheets. For other CRMs: webhook-out — Connect sends structured JSON payloads to your CRM API, you map the fields. The Webweezl setup service helps with configuration; after that it runs on its own. ActiveCampaign connector currently flagged as a stub (on the roadmap).

  3. 03 Does Connect work with WordPress? +

    Yes — full WordPress plugin (v1.2.3, PHP 7.4+) with shortcodes, Gutenberg blocks, Elementor widget, Divi module. Auto-updater since v1.2.2 (opt-in: users see a notice and have to click). The plugin talks directly to the Connect API.

  4. 04 What about audit log and GDPR compliance? +

    Every form submission, every double-opt-in click, every CRM routing event is recorded with an audit log: timestamp, IP address, user agent, action type. The DOI flow is GDPR-compliant with three modes (formbridge/crm/none). Data-processing-agreement (DPA) as PDF, Cloudflare as ISO-27001-certified processor.

  5. 05 How does the double-opt-in flow work in detail? +

    Lead fills out form → Connect stores the record with status pending_doi → confirmation email sent with unique token → lead clicks → status switches to confirmed, record is forwarded to the CRM. Three modes configurable per form. Anti-spam: unconfirmed records are deleted after a defined period (data minimization).

  6. 06 Can Connect write appointments to my Google Calendar? +

    Yes. Native integration with Google Calendar (OAuth + conflict query) and Microsoft 365 Outlook (combined with Teams). Availability is read from your calendar, booked appointments are written directly back, confirmation email with video link (Zoom or Teams) sent automatically. Slot generation is timezone-aware with DST gap handling.

  7. 07 How fast is the setup if I'm starting from zero? +

    Platform itself: 5 minutes for account creation. First form with CRM routing: 30 minutes (form builder + connector + DOI activation). Complex multi-form setup with industry-specific routing logic: 2–4 hours. The Webweezl setup service covers this — usually 1 working day from brief to live.

  8. 08 What about anti-spam and bot protection? +

    Three layers combined: dual honeypot (two hidden fields in the HTML), 2-second minimum-timing check (bots fill forms faster than humans), Cloudflare Turnstile (per-workspace BYO since April 2026). Each layer can be disabled independently. Plus per-isolate rate limiting for brute-force protection.

  9. 09 Do I get support if something breaks? +

    Yes — Webweezl is a solo agency, so you talk directly to Fawad or a single named contact, not an anonymous support-ticket system with escalation tiers. For emergencies during business hours: response usually within 2–4 hours. Pricing and support level are agreed in the first call.

§ OTHER PROJECTS FOUR REMAIN FIVE PLATFORMS

Five platforms. One hand.

Connect is one of five SaaS products I've built and run myself.

▸ AGENCY

If you want to embed Connect inside a full CRM architecture — with migration and team training — we can look together at CRM & Systems and Marketing Automation.