Privacy Policy

1. Data Controller

The data controller responsible for the processing of your personal data through the SnapPick web and mobile application is:

If you are located in the European Union or Spain, your data is processed in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

2. Data We Collect

SnapPick does not require account registration and does not collect sensitive personal data. Depending on how you interact with the service, the following data may be processed:

• Technical identifiers: IP address, browser type and version, operating system, device type.
• Usage data: Pages visited, interactions with the recommendation tool, session duration, referring URL.
• Mobile device data: Device model, operating system version, app version, anonymous installation identifier.
• Cookie and tracking data: Only when you have explicitly accepted cookies. See our Cookie Policy for full details.

We do not collect names, email addresses, payment information, or any other directly identifying personal data unless you voluntarily contact us.

3. Purposes and Legal Bases

4. Data Retention

• Server logs (IP, request metadata): Retained for a maximum of 30 days for security and diagnostic purposes, then automatically deleted or anonymised.
• Analytics data (if consented): Retained as configured by the analytics provider (Google Analytics: up to 14 months). You can revoke consent at any time; future collection stops immediately.
• Consent records: Stored locally in your browser (localStorage key snappick_consent) until you clear browser data or change your preference.
• Email correspondence: Retained for as long as necessary to resolve your enquiry and for a maximum of 2 years thereafter.

5. Data Sharing and Third Parties

We do not sell your personal data. We may share data with the following categories of third-party service providers, solely to operate SnapPick:

• Cloud infrastructure: Servers that host the SnapPick API and web application. Data processed on our behalf under data processing agreements (DPA).
• Analytics (conditional on consent): Google Analytics (Google LLC). Google may process data in the United States under Standard Contractual Clauses. See Google Privacy Policy.
• Advertising (conditional on consent): Google AdSense (Google LLC). Enables personalised advertising based on your browsing behaviour. See Google Advertising Policy.

If you deny cookie consent, no analytics or advertising scripts are loaded, and no data is shared with Google for those purposes.

6. International Data Transfers

Some third-party providers (including Google) are headquartered in the United States. Where such transfers occur, they are subject to appropriate safeguards under Chapter V of the GDPR, including Standard Contractual Clauses (SCCs) adopted by the European Commission, or adequacy decisions where applicable.

7. Your Rights

Under the GDPR and LOPDGDD, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): Request confirmation of whether we process your data and obtain a copy.
• Right to rectification (Art. 16 GDPR): Request correction of inaccurate data.
• Right to erasure (Art. 17 GDPR): Request deletion of your data where no legal basis for retention exists.
• Right to restriction (Art. 18 GDPR): Request that processing be restricted while a dispute is resolved.
• Right to data portability (Art. 20 GDPR): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21 GDPR): Object to processing based on legitimate interest at any time.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: You have the right to file a complaint with the Spanish data protection authority (AEPD — Agencia Española de Protección de Datos).

8. How to Exercise Your Rights

To exercise any of the rights listed above, please contact us at:

privacy@snappick.app

Include your request type and sufficient information to identify the data at issue (e.g., IP address, device identifier, or description of the data). We will respond within 30 calendar days as required by the GDPR. No fee applies unless the request is manifestly unfounded or excessive.

9. Security Measures

We implement appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction. These include:

• HTTPS encryption for all data in transit.
• Access controls limiting data access to authorised personnel only.
• Regular security reviews of our infrastructure.
• Automatic log purging within defined retention periods.

No method of transmission over the internet is 100% secure. We strive to use commercially acceptable means to protect your data but cannot guarantee absolute security.

10. Children's Privacy

SnapPick is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at privacy@snappick.app and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or applicable law. When we do, we will revise the "Last updated" date at the top of this page. We encourage you to review this page periodically. Continued use of SnapPick after any changes constitutes acceptance of the updated policy.

12. Contact

For any questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact: