Privacy

How Papias uses your information

Last updated 26 October 2026.

Who we are

Papias is run by GESTURELOOP LIMITED (company no. 792165), 44 Cluain Droichead, Sixmilebridge, Co. Clare, V95 HD62, Ireland. Until October 2026 it was called formsage, and links to formsage.yohanun.com keep working. Questions about this statement: contact us, email hello@papias.app, or write to the address above.

Two roles

There are two kinds of information here, and we have a different role for each.

• Accounts. If you make forms, run a competition or play in one, we hold your account. For that we are the data controller: we decide what we keep and why, and this statement is our notice to you.
• Answers. The organisations and people who make forms and run competitions on Papias decide what they ask and why. For the answers you give them, they are the controller and we are their processor: we hold the answers for them, on their instructions, under our data processing agreement. If you have a question about why a form asks something, or want an answer changed or deleted, the organiser is the right place to start, and we’ll help them do it.

What we keep, and why

• Organiser accounts: your name, email address and password (stored scrambled, so nobody can read it, including us), the workspaces you’re in, and the actions you take as an organiser (what you changed and when, kept so changes can be traced). We need these to run your account: that’s the contract between us.
• Competition accounts: your phone number, your name if you’re an admin, and your password (scrambled). Competition entries: your entry names, your picks and the time each was made or changed, results, and whether each entry has been paid for. Same basis: the contract.
• Forms and responses: the forms organisers make, and whatever a form asks, which is up to the organiser. Answers can include files you upload and a signature you draw; only the form’s organisers can download them. Organisers can add a private note to a response and correct an answer; each correction is kept with what it said before. Held for the organiser, as their processor.
• Payments lists: when an organiser uploads their list of competition payments, we keep the names, phone numbers and amounts on it, only so payments can be matched to entries. We never see or handle the payments themselves. Held for the organiser.
• Billing: if a workspace pays for a plan, Stripe holds the card and billing address; we keep only Stripe’s reference numbers, the plan, its status and the invoices. Contract, and our legal duty to keep accounts.
• Emails we send: confirming your address, resetting a password, invitations, billing notices, and each response to a form if its organiser asks for it, and, if the organiser sets it up, a confirmation to the person who filled in their form (sent to the address they gave, from our address with the form’s name, with replies going to the organiser). The only marketing we send is Forms of the week, a weekly email with three good forms and the template behind each, and only if you said yes to it (an unticked box at sign-up, or the Emails card on your workspace page); one click stops it. Links in those emails are one-time and short-lived. In your first week with a confirmed account we also send up to three getting-started emails, each with a one-click link to stop them; they never come again after that week.
• Where people stop: so organisers can see which question loses people, your browser tells us how far through a form you’ve got: a random number for that visit and the furthest question reached, never your answers. Kept 180 days. Our legitimate interest, and the organiser’s, in making forms work; it identifies nobody.
• Keeping out junk: when you send a form your connection’s address is held briefly in memory to stop floods and repeats; it isn’t stored. Sign-in attempts are counted so an account locks for 15 minutes after 5 wrong tries.

We don’t sell information, use it for advertising, or profile anyone.

AI drafting

An organiser can describe a form and have it drafted, or ask for changes in words. The description and the form’s questions go to an AI model (Anthropic’s Claude, through Yohanun, the platform we build on) to produce the draft. Responses to forms are never sent to it, and nothing is used to train anything.

Conversational forms

An organiser can set a form to be answered as a conversation. Then what you type in that chat goes to the same AI model (Anthropic’s Claude, through Yohanun) so it can understand your answers. You are told this at the top of the chat, with a link to fill in the ordinary form instead, where nothing goes to the model. The questions are the organiser’s own words and every answer is checked by Papias before it is kept. Neither Yohanun nor Papias keeps the conversation itself: only the answers you send, like any other response. Nothing is used to train a model. Anthropic’s own handling of what it is sent is set out in its commercial terms.

Ask Nell

The “Ask Nell” button on this site opens a chat with Nell, our helper. She is an AI agent (Anthropic’s Claude, run by Polycarp, our own agent product) that answers from the pages of this site. What you type to her is sent to Anthropic to produce the reply, and the conversation is kept by Polycarp so that she can follow it and so that a person at hello@papias.app can pick it up if she hands you on; your browser keeps a note of which conversation is yours. On the site she has no access to any account, form or response, so don’t type answers to a form into the chat. When you are signed in to the app, she is told your name and which account you are, and can look up your plan and its usage, your forms’ titles, status and response counts, your own domain’s status and your invoices; she is never shown a response, an answer, a file or a form’s questions. The button is never on a form.

Cookies and your browser

We use a single cookie to keep you signed in. There are no analytics, advertising or tracking cookies, and the site loads nothing from other companies, including its fonts. The one exception is a form whose organiser has added their own Google Analytics or Meta Pixel tag (a paid feature): that tag is theirs, loads from Google or Meta, and is told the form was opened and sent, never what you answered. The organiser is responsible for any consent it needs.

While you fill in a form, your answers so far are kept in your own browser (not a cookie, and never sent to us until you press Send) so a reload doesn’t lose them; they’re cleared when you send it, or when you press Start again. If a form opens by itself in a popup on another site, your browser remembers it did, so it doesn’t again.

Where you came from: when you arrive on this site, your browser keeps a note for the visit (not a cookie) of the page you landed on, the site that linked you here and any campaign tags in the link, including the click id Google puts in the link when you come from one of our ads. Nothing is sent to us until you create a form or sign up; it is then kept with your workspace so we know which pages and places bring people here. If you came from a Google ad, we may tell Google that its click led to a sign-up, and nothing else about you. We also count visits to the site’s pages by day, page and referring site, with no cookie, identifier or address, so no count can be tied to anyone.

Where it goes

Everything is stored on our servers at Hetzner in Helsinki, Finland, with nightly backups kept at Hetzner in Finland too. A few companies help us run the service, and each sees only what its job needs:

• Hetzner Online GmbH (Germany): the servers and backup storage, in Finland.
• Resend: delivers our email, from their EU region. It sees the address and the message.
• Stripe Payments Europe (Ireland): card payments and invoices for paid plans; and, when a form takes a payment, the payment page itself. The card details go to Stripe, not to us; we keep the amount, whether it was paid and Stripe’s reference, with the response. The money goes to the organiser’s own Stripe account.
• Yohanun and Anthropic: the AI drafting above (descriptions and questions only), and what people type on a form its organiser has set to a conversation.
• Polycarp and Anthropic: the chat with Nell above. What you type in the chat, nothing else.
• Public football data (fixturedownload.com and the Fantasy Premier League API): fixtures and results for competitions. Nothing about anyone is sent to them.

Beyond that, an organiser may connect their form to a service of their own choosing: a webhook (a Slack, Microsoft Teams or Discord channel, Zapier, Make, n8n or their own system), a Google Sheet in their own Google Drive, their own analytics tag, or an email address. Your answers to that form go there too, and that service is the organiser’s, under their own terms.

Where a provider is outside the EU, or could be asked for data from outside it, the transfer is covered by the European Commission’s standard contractual clauses in that provider’s terms.

How long we keep it

• Responses: until the organiser deletes them or the form, or closes their account.
• Competitions: while the competition runs, and then for 12 months so results can be checked if a question comes up. After that they’re deleted, or sooner if the organiser asks.
• Accounts: until you close them; we delete within 30 days of being asked. Billing records are kept for as long as the law requires accounts to be kept.
• Backups: up to 12 months. Deleted information lingers there until the backup is overwritten, and is never restored to the live service except to recover from a failure of the service itself.

Your rights

You can ask to see the information we hold about you, to correct it, to delete it, to receive a copy you can take elsewhere, or to object to how we use it. For answers to a form or a competition it’s often quickest to ask the organiser; you can also contact us and we’ll help. We answer within a month. If you’re not happy with how we’ve handled your information, you can complain to the Data Protection Commission (dataprotection.ie).

Children

You must be 16 or over to have an account. Organisers who collect information from children are responsible for the consent that needs.

Changes

When this statement changes in a way that matters, we’ll email account holders; small corrections just update the date at the top.