Privacy
The short version: we do not collect anything about students. No accounts, no names, no emails. Visits are counted, people are not.
If we contacted you about speaking
- Papoty writes on LinkedIn to students, graduates and people in work whose path students would learn from, to ask whether they would record a short video or join a session. If that is how you got here, a separate notice covers you: what we hold about you, where we found it, why, who else sees it, how long we keep it and how to have it deleted.
- In short: your name, profile link, school, year and studies, used only to organise the videos and sessions, never sold or passed on, and deleted the same day you ask.
Optional account (from 18 January 2027)
- Watching Papoty never needs an account. If you are 16 or over, you can create one to get an email when a video or a live session in your fields comes out, and to see those first on papoty.eu. If your alerts are on by 4 February 2027, you also get one email that day, when the first videos come out.
- What it stores: your email address, the fields you are interested in and your role (secondary school student, parent, teacher or counsellor, university student or recent graduate, other); only if you fill them in, your own field (one or two), what you type in an "Other" box, your first name, your school or university and your LinkedIn profile; the dates you created the account, confirmed you are 16 or over, accepted the terms of use and this notice, with their versions, switched the alerts on and last signed in; and which alerts were sent to you, so you never get the same one twice.
- What it never does: no password, no public profile, no messages between users, no advertising, no tracking, nothing shared or sold. Nobody else sees your details, and the emails come only from Papoty. You sign in with a one time code or link sent by email, or with your Google account if you choose. One strictly necessary cookie keeps you signed in for up to 90 days, and a second one lasts ten minutes while you sign in with Google.
- Why: to run your account and send you the alerts you asked for. The optional details are used only to greet you by name in the emails and to see, in totals, which fields and schools Papoty reaches. If you add your LinkedIn profile and you study or have graduated, Papoty may invite you once to share your path in a short video. The legal basis is your consent (Article 6(1)(a) GDPR): to the account when you create it, and separately to the alerts, which stay off until you switch them on. In every email one click turns the alerts off. On your account page you can change your details, download everything stored about you, or delete the account at once, which removes it all.
- If you speak in Papoty videos or sessions, you can keep your private recording page in your account. The account then shows your participation note and your choices as you gave them, and your preview, and lets you ask to change your choices or take your videos down. Your recording link keeps working without an account. A request you send is kept with your speaker ID even if you later delete the account, so that it can be carried out. The notice for speakers covers the rest.
- How long: until you delete it. An account nobody has signed into for 24 months is deleted, with one email a month before.
- Who handles it: Supabase stores it in the EU (Frankfurt) and Resend sends the emails from its EU region (Ireland), both as service providers. If you choose Continue with Google, Google confirms your email address to Papoty and nothing else: no name, photo or contacts. Your Google account itself is covered by Google's own privacy policy. If you are under 16, please do not create an account: everything on Papoty stays open to you without one.
The rules for the account are in the terms of use.
What we store
- Topic requests: the subject, the university if you gave one, your optional note, and the language. Nothing that identifies you is attached. We do not know who sent a request.
- A random identifier kept in your own browser, used only to stop the same browser voting twice on the same request. It never leaves your device except attached to a vote, and it is not linked to any person.
- Details volunteered by people offering to speak: name, email, school, university, programme and year. These are adults who chose to give them by ticking a consent box, and they are never shown on the site. They are stored for us by Supabase, our database provider, and added to our speaker list, which the speaker notice covers.
What we do not store
- No student names, emails or accounts. There is nothing to sign up for.
- No attendance lists, and nothing to sign up for.
- No advertising, no tracking pixels, no third-party trackers, no profiles of anyone. The only measurement is the visit counter described below.
- No visitor logs of our own, and no IP addresses stored by this site.
Measuring visits
- We count page views using the analytics built into Vercel, the company that hosts this site. It sets no cookies and stores nothing on your device, which is why there is still no cookie banner.
- A visitor is recognised by a code derived from the request itself, and that code is regenerated every day. Nobody can be followed from one day to the next, or from this site to any other.
- What we see is a total: which pages were opened, roughly how many people opened them, which country they were in, and what kind of device or browser they used. Never who you are.
- Vercel processes this on our behalf, partly outside the European Union, under the safeguards in its own terms.
Recordings
- Short videos are published only after the speaker has agreed in writing and approved the final cut. No student appears in them.
- Live sessions are never recorded: not the speakers, not the participants, not the chat.
- Questions from students are put in writing and read out without their name.
Asking us to delete something
- Write to the contact address below and we will remove it. Because requests carry no identifier, tell us roughly what it said so we can find it.
- If you have offered to speak and want your details removed, one email is enough and they are deleted.
Who is responsible
- Papoty is run by Antoine Marc Thomas Wenmacker, who is personally the data controller until Papoty becomes an association. Contact: hello@papoty.eu. Postal address on request.
- Speaker signups rest on the consent given by ticking the box. The visit counter rests on our legitimate interest in knowing whether the site is used, and identifies nobody.
- You can ask to see, correct or delete anything we hold about you, or object to how we use it. We answer within thirty days, and delete the same day. If you are not satisfied, you can complain to the Belgian Data Protection Authority (Autorité de protection des données, Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be) or to the authority in your own country.