1. Plain-English summary
Here's what you actually need to know:
- Most image tools run in your browser. Your photos never leave your device on the free plan unless you choose AI features.
- We do not sell your data. Ever.
- We don't train AI models on your content unless you explicitly opt in.
- You can export or delete your data anytime from your dashboard.
- We use a few essential vendors (payments, AI inference, analytics) listed in §5.
The rest of this document covers the details.
2. What we collect
Information you give us
- Account data: name, email, password (hashed), and your seller type.
- Billing data: for paid plans — processed by our payment provider (we never see your full card number).
- Content: text, images, CSV files you upload or paste into a tool.
- Support correspondence: if you email us or use chat support.
Information we collect automatically
- Usage data: which tools you run, settings you choose, time-of-use — used to improve features and prevent abuse.
- Device data: browser, OS, IP address, language, referring page.
- Cookies and similar technologies (see §6).
Information from third parties
- If you sign in with a third-party identity provider (e.g., Google), we receive basic profile information you authorize them to share.
3. How we use your information
We use your data to:
- Provide, maintain, and improve the Service.
- Process payments and manage subscriptions.
- Send transactional emails (receipts, security alerts, account changes).
- Send product updates and tips if you've opted in — you can unsubscribe at any time.
- Detect and prevent fraud, abuse, and security issues.
- Comply with legal obligations.
We rely on the following legal bases under GDPR (where applicable): contract performance, legitimate interest, your consent, and legal obligation.
4. Image & AI content processing
SnapFBA's image tools fall into two categories:
Client-side tools (free plan)
Tools like the image resizer, compressor, background checker, byte counter, and most calculators run entirely in your browser using WebAssembly and Canvas. Your files do not reach our servers, and we cannot see them.
Server-side tools (AI & bulk)
AI tools (title/bullet/description generators, image enhancer, background remover) and Pro bulk-processing require a server round-trip. When you use these features:
- Inputs are encrypted in transit (TLS) and at rest while being processed.
- Inputs and outputs are retained for up to 24 hours to handle support requests and abuse review, then automatically deleted.
- We use AI providers (currently OpenAI and Replicate — see §5). Those providers may retain inputs briefly per their policies; we do not authorize them to train on your data.
- You can opt in to longer retention for "saved projects" and version history. Saved projects can be deleted from your dashboard at any time.
5. Third-party processors
We use a small set of vendors to operate the Service. Each is GDPR-compliant and bound by a Data Processing Agreement.
- Stripe — payment processing
- OpenAI — AI text generation
- Replicate — AI image processing
- Amazon Web Services — hosting and storage (data hosted in the US, with regional replication in the EU for EU customers)
- Postmark — transactional email
- Plausible Analytics — privacy-focused, cookie-less site analytics
6. Cookies & analytics
We use a small number of cookies:
- Essential — session login (
snapfba_sid), theme preference, CSRF token. Required for the Service to work. - Functional — remember-me, last-used tool settings.
- Analytics — Plausible Analytics, which does not use third-party cookies, fingerprint visitors, or collect personal data.
We do not run third-party advertising or retargeting cookies. You can disable non-essential cookies from your account settings.
7. Data retention
- Account data — kept while your account is active; deleted within 30 days after closure (longer where required by law).
- Image & AI inputs — up to 24 hours unless you explicitly save them as a project.
- Saved projects — kept until you delete them.
- Billing records — kept for 7 years for tax and audit compliance.
- Logs — security and performance logs are retained for up to 90 days.
8. Your rights
Depending on where you live (GDPR, UK GDPR, CCPA/CPRA, etc.), you have the right to:
- Access — get a copy of your data.
- Correct — fix inaccurate data.
- Delete — close your account and delete your data.
- Export — receive your data in a portable format.
- Object & restrict — limit certain processing.
- Opt out — of any marketing emails.
- Withdraw consent — where processing is based on consent.
- Complain — to your local data protection authority.
To exercise these rights, email privacy@snapfba.com or use the controls in your dashboard. We respond within 30 days.
California residents: we do not "sell" your personal information as defined under the CCPA. You have additional rights under the CCPA/CPRA — same email above to request them.
9. Security
We use TLS encryption in transit, AES-256 encryption at rest for stored content, bcrypt password hashing, and role-based access controls. We undergo periodic third-party security review. No system is perfectly secure, so we encourage strong, unique passwords and (when available) multi-factor authentication.
10. International transfers
SnapFBA is operated from the United States. If you access the Service from outside the US, you understand your information may be transferred to and processed in the US. For transfers from the European Economic Area, UK, and Switzerland, we rely on Standard Contractual Clauses.
11. Children's privacy
SnapFBA is not directed to children under 16. We do not knowingly collect data from children. If you believe a child has provided us data, please contact us and we will delete it.
12. Changes to this policy
We may update this policy from time to time. Material changes will be announced by email or in-product 14 days before they take effect. The "Last updated" date at the top reflects the latest revision.
13. Contact our DPO
Privacy questions: privacy@snapfba.com. Postal: SnapFBA, Inc., Attn: Data Protection Officer, 1209 N Orange St, Wilmington, DE 19801, USA.
This policy is provided as a starting point for a SaaS product and does not constitute legal advice. Consult a qualified attorney for your specific situation.