Privacy Policy
Last updated: March 30, 2026
This Privacy Policy explains how SnapStatic ("we", "us", "our") collects, uses, and protects
your personal data when you use our website and services, including the website builder at
studio.snapstatic.io and sites published through the platform. We are committed to safeguarding
your privacy in accordance with applicable data protection laws, including the EU General
Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
1. Data Controller
The data controller responsible for processing your personal data is:
SnapStatic
Contact: contact@snapstatic.io
2. Data We Collect
We collect the following categories of personal data depending on how you use our service:
a) Account Data
When you create an account, you authenticate using a third-party OAuth provider (currently
GitHub, Google, or X/Twitter) through our authentication service (Supabase). We receive and
store your email address, display name, and profile avatar URL from the OAuth provider. We
do not receive or store your OAuth provider password.
b) Payment Data
Payments are processed by our third-party payment processor, Lemon Squeezy (Lemon Squeezy LLC).
We do not store your credit card number, bank account details, or other financial credentials
on our servers. Lemon Squeezy may collect payment information, billing address, and transaction
details as described in their
Privacy Policy.
We receive from Lemon Squeezy only the data necessary to verify your subscription status
(customer ID, subscription status, plan type, and billing dates).
c) Usage Data
We may collect non-personally-identifiable information such as pages visited, feature usage,
and error logs to improve the service. This data is processed in aggregate and is not used
to identify individual users. Server logs containing IP addresses are retained for a maximum
of 30 days and are used solely for security monitoring and abuse prevention.
d) Site Content and Media
When you use SnapStatic, your site content (text, configuration, settings) is stored in our
database (Cloudflare D1). Media files you upload (images, documents) are stored in cloud
storage (Cloudflare R2, EU region). This data is associated with your user account and is
not shared with third parties except as necessary to serve your published site to visitors.
e) Contact Form Submissions
If your published site includes a contact form, visitor submissions are stored in our database
and are accessible only to you (the site owner). We do not use submission data for marketing
or share it with third parties. Submissions are retained as long as your site is active and
are deleted when your site or account is deleted.
3. Purpose and Legal Basis
We process your personal data for the following purposes and legal bases under GDPR:
- Contract performance (Art. 6(1)(b) GDPR): To provide the SnapStatic service, manage your account, store and serve your content, and process your subscription.
- Legitimate interest (Art. 6(1)(f) GDPR): To maintain service security, prevent abuse, monitor for Terms of Service violations, and improve the service.
- Legal obligation (Art. 6(1)(c) GDPR): To comply with tax, accounting, or other legal requirements related to payment processing.
4. Bot Protection (Cloudflare Turnstile)
We use Cloudflare Turnstile on selected forms to prevent automated abuse. Turnstile is
cookie-free and only activates when the widget loads or a protected form is submitted.
For verification, Cloudflare may process limited technical data such as IP address, user-agent,
and basic browser signals. This processing is carried out by Cloudflare as our data processor
and is strictly necessary for service security (legitimate interest, GDPR Art. 6(1)(f)).
Cloudflare does not use this data for advertising. See Cloudflare's
Turnstile Privacy Addendum.
5. Third-Party Service Providers
We use the following third-party services (subprocessors) to operate SnapStatic:
- Supabase (Supabase Inc., USA): Authentication and user profile database. Receives: email, OAuth profile data. Privacy Policy
- Lemon Squeezy (Lemon Squeezy LLC, USA): Payment processing, invoicing, and tax compliance as Merchant of Record. Receives: billing and payment data. Privacy Policy
- Cloudflare (Cloudflare Inc., USA): Hosting, content delivery, database (D1), object storage (R2), and bot protection (Turnstile). Receives: site content, media files, technical request data. Privacy Policy
Each provider processes data in accordance with their own privacy policies and applicable
data processing agreements. We only share the minimum data necessary for each provider
to fulfill their function.
6. Analytics on Published Sites
SnapStatic allows site owners to optionally integrate third-party analytics services on their
published sites, including Google Analytics, Plausible, and Umami. When a site owner enables
analytics, the respective provider collects data directly from site visitors.
SnapStatic does not control, process, or store analytics data collected by these third-party providers. The analytics scripts run directly between the visitor's browser and the analytics provider. Site owners are responsible for disclosing analytics tracking to their visitors and obtaining any required consent under applicable privacy laws.
SnapStatic uses Cloudflare Web Analytics, a privacy-first, cookieless service. on its own sites (snapstatic.io and studio.snapstatic.io) to collect anonymous, aggregate usage data (page views, referrers, country, browser type). It sets no cookies, performs no cross-site tracking, and does not identify you personally.
7. International Data Transfers
Some of our third-party service providers (Supabase, Lemon Squeezy, Cloudflare) may process
data outside the European Economic Area (EEA), including in the United States. Where data is
transferred outside the EEA, appropriate safeguards are in place, such as EU Standard
Contractual Clauses (SCCs) or an adequacy decision by the European Commission, in accordance
with GDPR Chapter V.
Cloudflare R2 storage used by SnapStatic is configured in the EU region (Western Europe).
8. Data Retention
We retain your data according to the following schedule:
- Account data: Retained while your account is active. Deleted within 30 days of account deletion.
- Site content and media: Retained while your account is active and the site exists. Deleted within 30 days of site or account deletion.
- Contact form submissions: Retained while the associated site is active. Deleted when the site or account is deleted.
- Post-cancellation data: If your subscription expires without renewal, site data is retained for 90 days to allow reactivation, then deleted.
- Payment records: Transaction references and subscription history are retained for 7 years as required by tax and accounting regulations.
- Server logs: IP addresses and request logs are retained for a maximum of 30 days.
- Account deletion logs: A minimal deletion record (timestamp, anonymized identifier) is retained for 12 months for fraud prevention.
9. Your Rights (GDPR)
Under the EU General Data Protection Regulation, you have the right to:
- Access (Art. 15): Request a copy of the personal data we hold about you
- Rectification (Art. 16): Request correction of inaccurate data
- Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten")
- Restriction (Art. 18): Request restriction of processing in certain circumstances
- Data portability (Art. 20): Request your data in a structured, machine-readable format. You can export your site content through the account settings.
- Object (Art. 21): Object to processing based on legitimate interest
- Complaint: Lodge a complaint with a supervisory authority if you believe your rights have been violated
To exercise these rights, contact us at
contact@snapstatic.io. We will respond within
30 days as required by GDPR. We may ask you to verify your identity before processing
your request.
10. Your Rights (CCPA — California Residents)
If you are a California resident, the California Consumer Privacy Act (CCPA) and California
Privacy Rights Act (CPRA) provide you with additional rights regarding your personal
information:
- Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you.
- Right to Delete: You may request deletion of your personal information, subject to certain legal exceptions.
- Right to Opt-Out of Sale: We do not sell your personal information to third parties.
- Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
To exercise these rights, contact us at
contact@snapstatic.io. We will verify your
identity and respond within 45 days as required by CCPA.
11. Children's Privacy
SnapStatic is not directed at children under 16 years of age. We do not knowingly collect
personal data from children under 16. If you are a parent or guardian and believe your child
has provided personal data to us, please contact us at
contact@snapstatic.io and we will promptly
delete the account and associated data.
12. Cookies and Local Storage
SnapStatic uses essential cookies for authentication purposes only (session tokens set by
Supabase). These cookies are strictly necessary for the service to function and do not require
consent under the ePrivacy Directive. We do not use advertising, tracking, or analytics cookies
on the SnapStatic application.
SnapStatic uses browser localStorage to persist editor state (draft content, UI preferences)
between sessions. This data stays on your device and is not transmitted to our servers except
when you explicitly save or publish.
13. Data Security
We implement appropriate technical and organizational measures to protect your personal data,
including:
- Encryption in transit (HTTPS/TLS for all connections)
- Authentication tokens hashed with SHA-256 before storage
- Rate limiting to prevent brute-force and abuse
- Role-based access controls for administrative functions
- Data stored in Cloudflare's infrastructure with enterprise-grade security
No method of transmission or storage is 100% secure. While we strive to protect your data,
we cannot guarantee absolute security.
14. Data Breach Notification
In the event of a personal data breach that poses a risk to your rights and freedoms, we will:
- Notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33
- Notify affected users without undue delay if the breach is likely to result in a high risk to their rights and freedoms, as required by GDPR Article 34
- Document the breach, its effects, and the remedial actions taken
15. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices
or legal requirements. For material changes, we will provide at least 14 days' notice by
updating the date at the top of this page and notifying you through the application or by
email. Continued use of the service after the notice period constitutes acceptance of the
updated policy.
16. Contact
If you have questions about this policy, your data, or would like to exercise your privacy
rights, please contact: contact@snapstatic.io
We aim to respond to all privacy-related requests within 30 days. For complex requests,
we may extend this by an additional 60 days with notice.