Snaptryx01Data controller
The controller responsible for the processing of personal data described here is Snaptryx, operated by Vitalii Sili, Allgäuer Str. 92, 81475 München, Germany (see our Imprint for full details).
For any question about this policy or your personal data, contact us at privacy@snaptryx.com. We have not appointed a Data Protection Officer, as we do not meet the criteria in Art. 37 GDPR; privacy enquiries are handled by the controller directly.
02Data we collect
Account data: your name, email address and hashed password; your organisation(s) and role; and, for paid plans, billing details processed by our payment provider (we do not store full card numbers).
Usage data: the captures, PDFs, visual-diff runs and monitors you create, including the URLs you submit and the resulting screenshots and documents; render metadata (timestamps, status, sizes); API keys you generate (stored only as a hash); and product events used to operate and secure the service.
Technical data: IP address, device/browser information, and log data generated when you use the service or its API — used for security, rate-limiting and debugging.
Content you submit: when you ask us to capture or monitor a URL, we fetch that page and store the resulting image/PDF on your behalf. You are responsible for ensuring you are entitled to capture the content you submit.
03How we use your data
To provide the service: authenticate you, render and store captures/PDFs, run visual diffs and monitors, and deliver results and notifications you configure.
To bill and account for usage: meter renders, apply plan limits, and process subscription payments and invoices.
To secure and improve the platform: detect and prevent abuse, enforce rate limits and quotas, diagnose errors, and maintain reliability.
To communicate with you: transactional email (confirmations, password resets, billing, and service notices) and, only where permitted, product updates.
04Legal basis (GDPR Art. 6)
Performance of a contract (Art. 6(1)(b)): operating your account and providing the service you signed up for, including rendering captures and billing usage.
Legitimate interests (Art. 6(1)(f)): securing the platform, preventing abuse, maintaining logs, and basic service analytics — balanced against your rights and interests.
Legal obligation (Art. 6(1)(c)): retaining invoices and tax records as required by law.
Consent (Art. 6(1)(a)): any non-essential cookies or optional communications, where applicable — you may withdraw consent at any time.
06Processors & sub-processors
We use a small number of vetted providers who process data on our behalf under data processing agreements. As of the “last updated” date these include: our payment provider Stripe (subscription billing and payment processing); our email provider Brevo (transactional email delivery); Cloudflare (the Turnstile bot-protection challenge on our contact form, which receives your IP address and browser information when the challenge loads); and self-hosted infrastructure operated by us in Germany for application hosting and object storage.
We keep this list current and require each processor to provide appropriate safeguards. A full, up-to-date sub-processor list is available on request at privacy@snaptryx.com.
07International transfers
Snaptryx is made in Germany and operated on German infrastructure; we keep personal data in Germany (within the EU/EEA).
Where a processor (for example, a payment or email provider) processes data outside the EEA, that transfer is protected by an appropriate safeguard under Chapter V GDPR — typically the European Commission’s Standard Contractual Clauses and, where relevant, supplementary measures.
08Data retention
Captured screenshots in your Library are retained according to your plan’s retention window and then automatically deleted; visual-diff baselines are retained until you delete the project, because a baseline may be compared months later.
Account data is retained for as long as your account is active. After you delete your account or organisation, we remove or anonymise associated data within a reasonable period, except where we must retain certain records (for example, invoices) to meet legal obligations.
Server logs are retained for a limited period for security and debugging and then rotated out.
09Your rights
Under the GDPR you have the right to access your personal data; to have inaccurate data rectified; to have data erased; to restrict or object to processing; to data portability; and, where processing is based on consent, to withdraw that consent at any time.
Many of these you can exercise directly in the app (edit your profile, delete captures, or delete your organisation). For anything else, contact privacy@snaptryx.com and we will respond within the statutory time limits.
10Security
We apply technical and organisational measures appropriate to the risk: encryption in transit (HTTPS), access controls and least-privilege internal access, encryption of sensitive secrets at rest, hashed passwords and API keys, and protections against server-side request forgery when fetching the URLs you submit.
No system is perfectly secure, but we work continuously to protect your data and to detect and respond to incidents.
11Contact & complaints
For any privacy request or question, email privacy@snaptryx.com.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement. For us that authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach.