PaperSurvey.io

Privacy Policy

Effective date: September 3, 2026

Who we are

Mygtukynas, MB ("PaperSurvey", "we", "us"), a company registered in Lithuania, in the European Union, operates the website and service at papersurvey.io and is the controller for the data described below. Data protection questions go to gdpr@papersurvey.io; for anything else, write to hello@papersurvey.io.

Who this policy is for

This policy explains what we do with personal data when you visit our website, create an account or are invited into a team, pay for a subscription, or contact us. For that data we are the controller.

If you filled in a survey made with PaperSurvey, on paper or online, the organisation that created the survey is the controller of your answers. The section on survey respondents below explains what that means.

1. Data we collect

Account data. Name, email address, password (stored as a bcrypt hash), two-factor and passkey credentials, team membership and role, language and time zone, and the settings you choose.

Billing data. Subscription plan and status, invoices, VAT number and billing address, and the identifiers our payment provider assigns to you. Card numbers are entered directly with Stripe and never reach our servers.

Usage and technical data. IP address, browser and device type, pages and features used, timestamps, and server logs. Authentication events (successful and failed logins, password changes, two-factor events) are logged separately for security.

Content you upload. Surveys, scanned or photographed forms, survey responses, exports and integration settings. Where that content contains personal data about other people, we process it as your processor under our Data Processing Agreement, not for our own purposes.

Communications. Emails and support requests you send us, and delivery events (sent, bounced, opened) for emails we send you.

2. Why we use it and on what legal basis

  • Providing the service (accounts, teams, surveys, recognition, exports, integrations), using account, usage and content data. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
  • Billing, invoicing and accounting, using billing data. Legal basis: our contract with you and our legal obligations under Lithuanian accounting law.
  • Keeping the service secure (rate limiting, login logging, blocking abusive sign-ups, bot protection), using usage and technical data. Legal basis: our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).
  • Transactional email (verification, password reset, receipts, processing notices, team digests), using account data. Legal basis: our contract with you. Digests can be switched off in settings.
  • Product news and newsletters, using your email address. Legal basis: consent or legitimate interest. Every message carries an unsubscribe link.
  • Understanding how the website and product are used, using usage data. Legal basis: consent for website analytics where consent is required (EU, EEA, UK, Switzerland), and legitimate interest for in-product usage statistics.
  • Establishing, exercising or defending legal claims. Legal basis: legitimate interest.

We do not sell personal data. We do not give customer content to third parties to train their models, and our AI provider is contractually barred from training on the content we send it.

3. Survey respondents

The organisation that designed the survey decides what to ask, why, and how long to keep the answers. It is the controller; we store and process the answers on its instructions, as its processor. If you want to access, correct or delete answers you gave, contact the organisation that ran the survey. If a request reaches us instead, we forward it to that organisation and help it respond.

Handwritten answers on paper forms are transcribed with the help of an AI model. Only the cropped image of the individual answer field is sent, never the whole page, the processing takes place in the European Union, and the provider does not use the images to train its models. Uncertain readings are held for a person at the organisation that ran the survey to confirm. Our Artificial intelligence section below and our AI Disclosure Statement describe this in full.

4. Service providers we use

We share personal data only with providers that help us run the service, under contracts that bind them to data protection obligations. The current list:

  • DigitalOcean, LLC (EU datacenters): hosting, database, file storage and encrypted backups.
  • Hetzner Online GmbH (EU datacenters): encrypted backups and processing capacity.
  • Google Ireland Limited: AI handwriting recognition through Vertex AI, machine translation of survey text, encrypted backup storage; and Google Analytics website statistics, which load only if you accept analytics cookies and may involve transfer to the United States.
  • Stripe Payments Europe, Limited (Ireland): payment processing and invoicing.
  • ActiveCampaign, LLC, trading as Postmark (United States): transactional email delivery, and receiving scans sent to us by email.

To run the platform itself we also use providers for bot protection on our password reset form, IP reputation checking when an account is registered, and subscription analytics. They receive technical data such as an IP address, browser information or a payment identifier. They never receive survey content or respondent answers.

Integrations you connect yourself, such as Dropbox, Google Sheets, Zapier and webhooks to your own systems, send data to those services on your instruction and under your own agreement with them. You can disconnect them at any time in Settings.

5. International transfers

Your data is stored in the European Union. Some providers listed above are established in the United States; where they process personal data we rely on the European Commission's Standard Contractual Clauses or, where the provider is certified, the EU-US Data Privacy Framework. Copies of the safeguards are available from gdpr@papersurvey.io.

6. Artificial intelligence

Most of the PaperSurvey.io processing pipeline is deterministic. Tick boxes and multiple-choice answers are read by optical mark recognition from the known position of each box on the printed page, and no AI is involved in web survey collection, statistics, charts or exports.

Handwritten answers on scanned paper forms are transcribed with the help of large language models, currently Google's Gemini models accessed through Google Cloud Vertex AI. Only the cropped image of an individual answer field is sent, never the whole page, and the processing takes place in the European Union. Our providers do not use content submitted through their enterprise APIs to train or improve their models. Questions can also be machine-translated using Google Cloud Translation, and an uploaded questionnaire can be converted into a survey by the same provider, both only when a customer starts them.

Every transcription carries a confidence score, and readings below the acceptance threshold are held for a person to confirm rather than being accepted automatically. The original scan is always kept alongside the recognised value, so any answer can be checked and corrected. AI output in PaperSurvey.io is a transcription or an analytical aid, never a decision: the platform does not carry out automated decision-making with legal or similarly significant effects under Article 22 GDPR.

Our AI Disclosure Statement describes this in full and is available on request from gdpr@papersurvey.io.

7. How long we keep data

  • Account data: while your account exists. Where an account has no active subscription and no sign-in or product activity for twelve months, we notify the owner 90, 30 and 3 days in advance and then erase the surveys, responses and uploaded files held under it.
  • Surveys you delete: kept in the trash for 90 days so you can restore them, then removed from production systems. Individual responses, entries and uploaded files you delete are removed straight away and cannot be restored.
  • Closing your account: web survey collection stops and billing ends immediately. Erasure of the surveys, responses, uploaded scans and exports held under the account is carried out on request to gdpr@papersurvey.io and confirmed in writing.
  • Encrypted offsite backups: purged within three months.
  • Invoices and accounting records: as long as Lithuanian accounting law requires.
  • Authentication logs: 24 months. Security logs: 90 days. Email delivery events: 180 days.
  • Support correspondence: as long as needed to handle the request and any follow-up.

8. Cookies and analytics

We use cookies that are strictly necessary for the site to work, such as signing you in, protecting forms and remembering your cookie choice. These cannot be switched off. Analytics cookies stay off unless you turn them on.

We also measure page visits with our own self-hosted analytics, which sets no cookies and is unaffected by your choices.

The cookies we set are listed, with who sets it, how long it lasts and what it does, in our cookie settings. You can change or withdraw your choice there at any time, and it is as easy to refuse as to accept. Some parts of the service will not work without the strictly necessary cookies.

9. Security

Data is encrypted in transit using TLS 1.2 or higher and encrypted at rest. Backups are encrypted with keys whose private half never sits on production servers, and access to your account can be protected with two-factor authentication, passkeys and, for Enterprise Plus customers on annual billing, single sign-on. Our Security Statement describes the measures in more detail. If we learn of a breach affecting your data we will tell you without undue delay.

10. Your rights

You can ask us to access, correct, delete or restrict your personal data, to receive it in a portable format, to object to processing based on legitimate interest, and to withdraw consent at any time. Write to gdpr@papersurvey.io; we may ask you to verify your identity, and we answer within one month. You can also close your account yourself under Settings, Personal.

You have the right to complain to a supervisory authority. Ours is the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt); you may also contact the authority where you live.

California residents: we do not sell personal data, and the rights above are available to you.

11. Children

Our website and accounts are not directed at children under 16, and we do not knowingly collect their data as a controller. Surveys made with PaperSurvey may be completed by children where the organisation running the survey is responsible for doing so lawfully.

12. Changes to this policy

We show the effective date at the top of this page and announce changes by posting the revised policy here. Where a change materially affects how we handle your personal data, we tell account holders in the application or by email, rather than only updating this page.

13. Contact

Mygtukynas, MB, registered in Lithuania, in the European Union.
gdpr@papersurvey.io for data protection, hello@papersurvey.io for everything else. You can also contact us by clicking here.