1Who is responsible for your data
Zenous Technology LLC, 600 Broadway, Ste 200 #6503, Albany, NY 12207, United States ("Snippt", "we") is the controller of the personal data described in this policy. Privacy questions and requests: support@snippt.ai. If you are in the European Union, United Kingdom or Brazil, you also have the right to complain to your data protection authority (for example your national supervisory authority in the EU, the ICO in the UK, or the ANPD in Brazil).
2What we collect
What you give us
- Account: email, name, password (hashed), or a Google or Microsoft sign-in identifier; phone number if you verify it.
- Content: the images, videos, audio and text you upload, the prompts you write, and the outputs you generate.
- Consent confirmations: when you use a tool that processes a real person, your confirmation that they consented and are not a minor.
- Payments: handled by our payment processor; we receive your plan, transaction identifiers and the last digits of your card, never the full card number.
- Messages: support conversations, reports and removal requests.
What we collect automatically
- Usage: pages visited, tools used and the steps taken in them, generations run, credits used, errors.
- Device and connection: browser, operating system, IP address, approximate location from the IP, referring page and campaign parameters.
- Cookies and similar technologies: see the Cookie Policy. Google Analytics and Microsoft Clarity run only after you consent.
- Reading statistics (blog, Academy and newsletter pages): how long a page is actively read, how far it is scrolled, whether the end is reached, how much of the audio edition is played, and which links on the page are clicked. Our own script collects this with a random identifier kept in your browser's storage for up to 13 months (not a cookie, and never renewed). We do not store your IP address with it, and we never link it to your account, your email address or your activity on other sites; it is used only for statistics about our pages. It does not run if you choose Essential only in the cookie banner or if your browser sends a Global Privacy Control signal, and you can switch it off at any time by opening any page with ?no-stats=1 at the end of the address (?no-stats=0 switches it back on).
- Newsletter measurement: when we send the newsletter, our email provider tells us whether each email was delivered, opened, bounced or marked as spam, and which links were clicked, with the time and the browser and IP address of the click. We use this to count real readers per issue and per section, to filter out the automatic clicks made by email security scanners, and to stop sending to addresses that bounce or complain. Links to snippt.ai in our emails carry tags naming the issue and the section. If you answer "Was this worth the read?", your answer is saved with your email address.
- Safety records: refused requests (a short excerpt of the prompt, never the image), enforcement actions and removal requests.
Faces and voices
Photos, videos and recordings of people are personal data, and when a tool processes a face or a voice to swap, animate or clone it, that processing can involve biometric data (a special category under GDPR and equivalent laws, and "sensitive personal information" under California and Brazilian law). We process it only to deliver the tool you chose, on the basis of your explicit consent, given when you use the tool and confirm that the people depicted have consented; you can withdraw it by deleting the content or your account. We do not use faces or voices to identify people, build profiles or train models.
3Why we use it, and on what legal basis
| Purpose | Data | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Run the tools you ask for and deliver outputs | content, prompts, account | Contract (Art. 6(1)(b)); explicit consent for biometric processing (Art. 9(2)(a)) |
| Accounts, plans, credits and payments | account, payment records | Contract; legal obligation for tax and accounting records |
| Keep the Service safe and lawful: screening, abuse prevention, consent records, removal requests, reporting | content, safety records, usage, device | Legitimate interests (Art. 6(1)(f)) and legal obligations, including child-protection and payment-network rules |
| Understand how the tools are used and improve them | usage, device | Consent for analytics cookies; legitimate interests for aggregated statistics |
| Transactional email (receipts, security, changes to terms) | account | Contract; legal obligation |
| Marketing email | account | Consent, or legitimate interests for existing customers about similar services, always with an unsubscribe link |
| Measure what is read and improve the blog, Academy and newsletter | reading statistics; newsletter delivery, open and click events; newsletter answers | Legitimate interests (Art. 6(1)(f)) in anonymous audience measurement of our own pages, which you can refuse at any time; for the newsletter, the consent you gave when you subscribed |
| Attribution of signups to campaigns | campaign parameters, analytics identifier | Consent (cookies) and legitimate interests |
We do not sell your personal data and do not use your content to train AI models. Our providers do not train on your content either, except where a specific model is marked otherwise in the tool and you choose it.
4Who we share it with
To run the Service we use these providers, each bound by a data-processing agreement:
| Provider | What they do | Data | Location |
|---|---|---|---|
| fal.ai | Runs image, video and audio models | uploads, prompts, outputs | USA |
| Anthropic | Text generation and assistants | prompts, text you provide | USA |
| OpenAI | Some image and text models | prompts, images | USA |
| ElevenLabs | Voice generation and cloning | voice recordings, text | USA |
| Cloudflare | File storage (R2), security checks (Turnstile), network | uploads, outputs, IP | USA / EU edge |
| Railway | Application hosting | all service data in transit | USA |
| Neon | Database hosting | account, usage, safety records | USA |
| Payment processor | Subscriptions and payments | payment details, email | USA / EU |
| Resend | Email delivery, and delivery, open and click events for our emails | email address, message content, open and click events (time, link, browser, IP) | USA |
| Google (Analytics 4) | Usage analytics, after consent | usage, device, analytics identifier | USA / EU |
| Microsoft (Clarity) | Session analytics, after consent | usage, device, masked page interactions | USA / EU |
| Google, Microsoft (sign-in) | Optional sign-in | identifier, email, name | USA / EU |
We also disclose data when the law requires it, to respond to valid legal process, to protect people from harm, to enforce our terms, to report apparent child sexual abuse material to NCMEC or national authorities as required, and to payment networks and processors as part of their compliance programs. If Snippt is sold or merged, data transfers with the business under this policy.
5International transfers
We are based in the United States and most providers process data there. For people in the EU, UK and Switzerland we rely on the EU-US Data Privacy Framework (and its UK and Swiss extensions) where a provider is certified, and otherwise on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, with supplementary measures where needed. A list of the mechanism used for each provider is available on request from support@snippt.ai.
6How long we keep it
| Data | Kept |
|---|---|
| Uploads (source images, videos, recordings) | Deleted after processing, at the latest within 48 hours, unless you save them to your library |
| Generated outputs and your library | While your account is active, or until you delete them; free accounts inactive for 12 months are purged |
| Voice clones | Until you delete the voice or your account; consent records for the voice are kept with it |
| Account and plan data | While your account is active, then 30 days |
| Payment and tax records | 7 years, as required by law |
| Usage and error logs | 12 months |
| Reading statistics (blog, Academy and newsletter pages) | 25 months, then deleted; the identifier in your browser is replaced after 13 months |
| Newsletter delivery, open and click events | 25 months, then deleted; answers to "Was this worth the read?" are kept while you are subscribed |
| Safety records (refused requests as short excerpts and hashes, consent confirmations, enforcement actions, removal requests) | 2 years, or longer where a legal obligation, dispute or report requires it; these survive account deletion |
7Your rights
You can access, correct, export and delete your data, restrict or object to some processing, and withdraw consent at any time. In the product: Delete account and data in your profile menu removes your account, library, voices and files and cancels any subscription; Download my data exports your data as a file. For anything else, email support@snippt.ai; we answer within 30 days and may ask you to verify your identity.
European Union, United Kingdom, Switzerland
You have the rights of access, rectification, erasure, restriction, portability and objection under the GDPR and UK GDPR, the right to withdraw consent without affecting earlier processing, and the right to complain to a supervisory authority. We do not make decisions with legal or similarly significant effects on you by automated means.
California and other US states
You have the right to know what personal information we collect, use and disclose, to delete it, to correct it, to limit the use of sensitive personal information (which includes biometric data), and not to be discriminated against for exercising these rights. We do not sell personal information and do not share it for cross-context behavioural advertising. We honour Global Privacy Control signals as an opt-out. Residents of Virginia, Colorado, Connecticut, Texas, Oregon and other states with privacy laws have equivalent rights.
Brazil
Under the LGPD you have the rights of confirmation, access, correction, anonymisation, portability, deletion, information about sharing, and revocation of consent. Requests: support@snippt.ai; complaints: the ANPD.
8Security and breaches
Data is encrypted in transit, passwords are hashed, files are stored privately and served through expiring links, access is limited to staff who need it, and safety records are kept apart from ordinary logs. No system is perfectly secure. If a breach affects your personal data we will notify the competent authority within 72 hours where the law requires it (GDPR, UK GDPR) or the applicable period elsewhere, and tell you without undue delay where the risk to you is high.
9Children
Snippt is for adults. We do not offer the Service to anyone under 18, do not direct it at children, and do not knowingly collect their data. Our tools refuse to process images or voices of minors. If you believe a minor has an account or that a minor's data has been uploaded, contact support@snippt.ai and we will delete it.
10Marketing email
We send product news and offers only if you opted in, or if you are a customer and the message is about similar Snippt services; every message has an unsubscribe link and we honour it at once. Newsletter emails are measured as described in section 2; each one also links to your preferences, where you can switch to the Friday edition only or stop all newsletters. Transactional messages (receipts, security notices, changes to terms, payment problems) are sent to all account holders because the Service needs them. Affiliates who promote Snippt must follow the same rules and disclose their relationship with us.
11Changes to this policy
We update this policy when our tools, providers or the law change. Material changes are announced on the site and by email to account holders before they take effect. The date at the top shows the current version.