Where do contact-form messages go, and can I reduce spam?

When a shopper submits a contact tab, the module validates the name, email and message, then saves the inquiry (with the product and the current shop) so you can read it in the module's Inquiries screen in the back office. It also emails a notification to the recipient address you configure, or falls back to your shop email if none is set. To reduce spam you can enable Google reCAPTCHA (v2 or v3) with your own site and secret keys; if no secret is configured the check is simply skipped. Because inquiries store the shopper's email and message, treat that screen as personal data within your GDPR processes.