Privacy policy

Fillfold lets creators build online forms and turn the answers into PDF documents. This page explains what personal data we handle, why, and what your rights are. Two groups of people are involved: creators (people with a Fillfold account) and respondents (people who fill in a creator’s form).

Who is responsible

• For creators’ account data, [Operator name to be set] (“we”), [postal address to be set], is the controller. Contact: [contact email to be set].
• For what respondents type into a form, the creator who published that form is the controller: they decide what is asked and why. We act as their processor and only store and process the answers on their behalf. If you are a respondent, contact the form’s owner first for access, correction or deletion requests.

What we collect

Creators:

• Email address, name (optional) and password (stored only as a salted hash by our authentication provider).
• If you turn on two-step verification: the authenticator secret and your backup codes (stored only as hashes).
• The forms, document templates, logos and settings you create, and the responses they receive.
• Optionally, your business details (business name, address, VAT number, IBAN, email, phone, website and payment terms). They are used only to print on the documents of your own forms, and are removed when you delete them or close your account. Do not enter anything you would not want to appear on those documents.
• Technical records needed to run the service and keep it secure (for example sign-in events).

Visitors who join the waiting list:

• The email address you enter on the home page, the language of the page you were on, and the time you agreed. We use it to email you once, when paid downloads open, and for nothing else. We are the controller of this data. The legal basis is your consent, which you can withdraw at any time. Write to the contact address above and your address is removed. We delete the whole list once the launch email has been sent.

Respondents:

• The answers you give, and any files you attach (such as a photo, a document or a signature).
• The PDF generated from your answers.
• The language you chose for the form, so your PDF is produced in the same language.
• Your IP address, for abuse prevention only (see below). Forms can ask for anything the creator chooses, including personal or sensitive details: read what a form asks before you answer.

Why, and on what legal basis

• To provide the service to creators (contract).
• To generate and deliver the PDF to the respondent and to the creator (on behalf of the creator).
• To prevent spam, floods and abuse, and to keep the service secure (our legitimate interest).
• To meet legal obligations, such as responding to lawful requests.

We do not sell personal data and we do not use it for advertising or profiling.

IP addresses

When a response is submitted, we store a keyed, non-reversible fingerprint of the IP address next to it, so a creator can see that several responses came from the same source. The IP address itself is kept in a separate table for 30 days and then deleted automatically. Creators never see the IP address, only a count such as “3 responses from the same source within an hour”.

Cookies

We only use cookies that are strictly necessary to keep a creator signed in, and one that remembers the language chosen for the application (ff_lang, kept for one year, holding only a language code such as “fr”). We use no advertising or analytics cookies. Respondents filling in a form are not given any cookie.

Who receives data

• Supabase (database, authentication and file storage). The project is currently hosted in the United States (East); we plan to move it to the European Union before launch and will update this page when we do.
• Anthropic (AI features), only if a creator uses “Describe it and let AI draft it” or “Translate with AI”. The text the creator types as a description, or the form’s own texts to translate, is sent to Anthropic, in the United States, to draft or translate a form. We do not send respondents’ answers, files or documents. We do not keep the description itself; only the form that results from it is stored. Creators should not type personal data about other people into that description.
• Our hosting provider for the application servers: [to be completed at deployment].
• The creator of the form you filled in.
• Authorities, only when the law requires it.

When data is processed outside the European Economic Area, we rely on the safeguards described by our providers (such as standard contractual clauses).

How long we keep data

• Responses, files and PDFs are kept until the creator deletes them or the account is closed. A creator can also choose, for each form, to have responses deleted automatically after 30 days, 90 days, 6 months, 1 year or 2 years. Creators decide how long they need the data they collect and are responsible for that choice.
• Files uploaded but never attached to a submitted response are removed after 24 hours.
• IP addresses are removed after 30 days.
• Your answers and the names of files you attach are stored encrypted, with a key kept apart from the database.
• Archived forms are kept until the creator deletes them permanently.

When data is deleted

When a response is deleted (by the creator, by the automatic deletion above, or because the account is closed), the response, its files and its PDF are removed from our database and from file storage straight away. Files and PDFs are also encrypted before they are stored, so a leftover copy cannot be read without our key. Our database provider keeps routine backups for a limited time; deleted data can remain in those backups until they expire and are overwritten by the provider’s normal rotation, and is not restored into the service except to recover from a failure.

Your rights

Under the GDPR you can ask for access to your data, correction, deletion, restriction, a portable copy, and you can object to certain processing. You can also withdraw consent where we rely on it. Write to [contact email to be set]. You can delete your account and all its data yourself at any time from the Security page of the app; deletion is immediate and permanent. You also have the right to complain to your data protection authority; in Ireland this is the Data Protection Commission (dataprotection.ie).

Security

Data is encrypted in transit. Uploaded files, logos and generated PDFs are additionally encrypted by our application before they are stored, with a key that is kept outside our storage provider, and they are kept in private storage that only the owning creator can open. Access to each creator’s data is enforced by the database itself, and administrator access requires two-step verification. No system is perfectly secure; if a breach affects you we will notify you as the law requires.

Changes

We will update this page when our practices change and show the date above. See also our terms of use.