Privacy Policy

1. Controller and contact

The controller for the data described in section 3 ("Data we process to run your account") is APEX SOFT LLC, registration number (EDRPOU) 45699742, registered at 56 Zaporizke Shose, Dnipro, 49040, Ukraine.

For the data described in section 4 ("Customer data"), the roles are reversed: you are the controller of the contacts and conversations inside your workspace, and we act as your processor, on your instructions. Section 10 sets out what that means in practice.

You can reach us about anything in this policy at support@snapper.it.com. We have not appointed a data protection officer; the founder handles these requests personally.

2. The short version

We collect the minimum needed to run the product: an account, the workspace you create, and the WhatsApp, phone and calendar data you deliberately connect to it. We do not run analytics or advertising trackers, we do not build profiles, and we do not sell or rent personal data to anyone.

The rest of this document says the same thing in the detail the law requires.

3. Data we process to run your account

To give you an account and keep it working, we process the following categories of personal data.

• —Identity and account data: your name, email address, a bcrypt hash of your password (never the password itself), your role in the workspace (owner, admin or agent), the profile photo you upload, and the workspace name and logo.
• —Verification and security data: single-use tokens issued for email verification, password resets and invitations, stored as hashes with an expiry.
• —Session data: a signed session cookie (see our Cookie Policy) and the technical request data our hosting provider records to serve and secure the site, such as IP address, user agent and timestamps.
• —Billing data: your plan, and the identifiers Creem gives us for your customer, subscription and transaction records. We hold no card data of any kind — no card number, expiry date, security code or card token. Those are entered on Creem’s checkout and stay with Creem, who is the merchant of record for the sale.
• —Support correspondence: the emails and WhatsApp messages you send us, and our replies.

4. Customer data: what flows through Snapper

Snapper is a tool for handling other people’s conversations, so most of the personal data in the system is not about you — it is about your contacts. When you connect a channel, the following flows into your workspace and is stored in our database and file storage.

This data comes from you and from the services you connect. We do not buy contact data, enrich it from third-party sources, or use it to train machine learning models.

• —Contacts: name, phone number, email address, tags, notes and any custom fields your workspace defines.
• —WhatsApp conversations: the full content of messages sent and received on the numbers you connect, in both directions, with their delivery and read status, reactions and timestamps.
• —Media: photos, voice notes, documents, locations and stickers exchanged in those conversations, stored as files in our blob storage.
• —Pipeline data: boards, cards, comments, activity history, custom field values and workflow rules, including anything your team writes about a contact.
• —Calendar data: when you connect a Google account, the OAuth tokens for it and the events Snapper reads or creates on your behalf.
• —WhatsApp session credentials: the cryptographic material that keeps your connected number logged in, equivalent to a WhatsApp Web session.

5. Why we process it, and on what legal basis

Under Article 6(1) of the GDPR we rely on the following bases.

6. Who else processes the data

We use a small number of sub-processors. Each receives only what its function requires, under a contract that binds it to confidentiality and to processing on our instructions.

Where a sub-processor is outside the European Economic Area, transfers are covered by the European Commission’s Standard Contractual Clauses. Ukraine, where we are established, is not an EEA state; we process data there under the same clauses and safeguards.

7. A word about WhatsApp

Snapper connects to WhatsApp the same way WhatsApp Web does, by pairing with your phone through a QR code. That means messages travel through Meta’s infrastructure exactly as they would if you typed them on your phone, and Meta’s own terms and privacy policy apply to that leg of the journey. We are not affiliated with, endorsed by, or a partner of Meta Platforms.

It also means we hold the session credentials for your connected number for as long as it stays connected. Disconnecting the number in Snapper, or logging the device out from WhatsApp on your phone, invalidates them.

8. Google user data

Connecting a Google account is optional and only powers the calendar features. When you connect one, Snapper requests three scopes and no others: `openid` and `email` to identify the account you connected, and `calendar.events` to read and write events on your own calendars.

What we do with each: the account identity is shown in Settings so you can see which account is linked; calendar events are read to display your agenda inside Snapper, and written when you create a meeting from a card — which is also what mints its Google Meet link. We store the OAuth tokens for the connection and the events we have read or created for that purpose.

Snapper’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy.

Concretely, that means we do not sell this data, do not use it for advertising or to build profiles, do not use it to train machine learning models, and do not let humans read it except with your permission, to resolve a support request you raised, for security purposes, or where the law requires it.

You can end this at any time: disconnect Google in Settings — which revokes the tokens and deletes them — or remove Snapper's access from your Google account at https://myaccount.google.com/permissions.

9. How long we keep it

We keep data for as long as it is needed for the purpose it was collected for, and no longer.

• —Account and workspace data: for the life of the account. Deleting the workspace deletes it — see our Data Deletion policy for exactly what goes and when.
• —Conversations, messages, media, contacts and cards: until you delete them, or until the workspace is deleted.
• —Verification and reset tokens: 24 hours for email verification, 1 hour for password resets, 7 days for invitations; each is single-use and is destroyed once used.
• —Session cookies: 30 days, or until you log out.
• —Backups: rolling backups are retained for up to 30 days, after which deleted data ages out of them too.
• —Accounting records of payments: as long as Ukrainian tax law requires, currently 1095 days from the end of the relevant reporting period.

10. Your rights

If the GDPR applies to you, you have the right to access your data, to have it corrected, to have it erased, to restrict or object to its processing, and to receive it in a portable, machine-readable format. Where processing rests on consent, you may withdraw that consent at any time without affecting what came before.

You can exercise most of these rights inside the product: your profile page edits your identity data, every board exports to CSV, and deleting your workspace erases its contents. For anything else, write to support@snapper.it.com. We answer within 30 days and we do not charge for it.

If you are the contact of one of our customers rather than a customer yourself — that is, if your conversation is being handled inside someone’s Snapper workspace — please direct your request to that business first. They control that data; we will help them act on your request, and we will act ourselves where they do not.

You also have the right to complain to a supervisory authority in the EU or EEA country where you live or work.

11. Our role as processor, and your role as controller

For everything in section 4, you decide what is collected and why, and we only act on your instructions — which are, in practice, the actions you take in the product. In that relationship we commit to: processing customer data only to provide the service; keeping our staff bound to confidentiality; using only the sub-processors listed in section 6 and telling you before that list changes; helping you respond to data subject requests and to security incidents; and deleting or returning customer data when your account ends.

You commit, in turn, to having a lawful basis for the contacts and conversations you bring into Snapper, to telling those people how their data is used, and to honouring their rights. Our Acceptable Use Policy sets out what this rules out in practice.

12. Security

Traffic is encrypted in transit with TLS. Passwords are stored as bcrypt hashes and are never recoverable, by us or by anyone else. Sessions are signed and held in an HttpOnly cookie that JavaScript cannot read. Every database query is scoped to a single workspace, so one customer’s data cannot be read from another’s session. Access to production systems is limited to the people who operate the service.

No system is perfectly secure. If a breach affects your personal data and is likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours of becoming aware of it, and notify you without undue delay where the risk is high.

13. Children

Snapper is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child’s data has reached us, write to support@snapper.it.com and we will delete it.

14. Changes to this policy

When we change this policy we update the date at the top of the page. If a change materially affects your rights or how we use your data, we will tell you by email before it takes effect, so that you have the chance to object or to close your account.