Privacy Policy

1. Introduction

This Privacy Policy explains how Snapflow Labs Inc. ("Snapflow", "we", "us"), a Delaware corporation, collects, uses and shares personal data when you visit our websites, join our waitlist, create an account, or use the Snapflow platform (together, the "Service"), and also when we contact you as a prospective customer. It applies where we act as a controller. Where we process personal data contained in content our business customers submit to the platform (for example, names appearing in design documentation), we act as a processor on the customer's behalf, and that processing is governed by our Data Processing Agreement and the customer's own privacy notices. For such requests, contact the relevant customer.

2. Information We Collect

• Account data: name, work email address, company, role, password (stored hashed), profile settings.
• Billing data: once paid plans are enabled: plan, seats, billing address, tax ID where applicable, and transaction history. Card payments will be processed by Stripe; we do not receive or store full card numbers.
• Form and waitlist data: email address, name, company, role and anything you write in our forms, together with the language, the date and whether you agreed to receive marketing communications (that checkbox is optional). To prevent abuse we also keep a hash of your IP address computed with a salt, and your browser's user agent. That hash is pseudonymous data, not anonymous data.
• Prospect data we did not get from you: name, role, company, country, work email address, public LinkedIn profile and public signals about your company, such as the technologies it uses or what it publishes. Section 5 explains where it comes from.
• Email interaction data: when we write to you from our sending platform, we record whether the email was delivered, bounced, was opened or had its links clicked, and whether you unsubscribed or marked it as spam.
• Usage data: on the platform, log data, IP address, device and browser information, features used, and diagnostic events, collected to operate, secure and improve the Service. We do not use analytics on the website; our network provider processes the IP address and technical logs of each visit to deliver the site, protect it and choose the language based on your country.
• Content you submit: design systems, components, tokens, prompts and related material you upload to the platform. We treat this as customer content and process it only to provide the Service.
• Communications: messages you send us via email, forms, WhatsApp, LinkedIn or support channels.
• Cookies: see our Cookie Policy for details of the cookies and local storage we use.

3. How We Use Personal Data

• To provide, operate and secure the Service, including authentication, billing and support.
• To manage the waitlist and onboarding, and to communicate about availability, features and service notices.
• To send you marketing email sequences only if you agreed to them on a form; the confirmation of your request reaches you either way.
• To contact professionals individually, by email or LinkedIn, whose role and company match what we offer (business-to-business prospecting), and to first verify that their work email exists.
• To draft those individual messages with the help of artificial intelligence, based on the contact's professional and public information. A person reviews and sends every message.
• To automatically classify contacts by role and country (segment and email language) and decide which message to send them. This classification has no legal effects and does not significantly affect you, and you can object to it.
• To measure whether our emails are delivered, opened and clicked, and to stop sending after bounces, complaints or unsubscribes.
• To let you opt out at any time: use the unsubscribe link, reply to the email you received or write to carlos@snapflowlabs.com.
• To monitor and improve the performance, reliability and usability of the Service, and to detect, prevent and investigate fraud, abuse and security incidents.
• To comply with legal obligations and enforce our terms.

4. Legal Bases (EEA/UK and Similar Jurisdictions)

Where the GDPR or similar laws apply, we process personal data on the following bases: performance of a contract (providing the Service you signed up for); legitimate interests (securing and improving the Service, preventing form abuse, and contacting professionals individually based on their role and company, with the ability to object at any time), balanced against your rights; consent (marketing email sequences to people who fill in a form, and non-essential cookies if we ever use them), which you may withdraw at any time; and legal obligation (tax, accounting, lawful requests).

5. Data We Did Not Get From You

If we contact you without you having given us your data, we got it mainly from our prospecting on LinkedIn (your public profile and our team's professional contacts), supplemented by your company's website and other public professional sources. We only process professional data (as listed in section 2) and never special categories of data. We tell you about this processing in the first message we send you and, in any case, within one month of obtaining your data. You can ask us at any time which specific source your data came from, object to this processing or ask us to delete it.

6. AI Features and Bring-Your-Own Keys

The platform's generation features can run against AI providers whose API keys the customer connects ("BYO keys"). Prompts and content routed to a customer-configured provider are processed by that provider under the customer's own agreement with it. We do not use customer content or generated output to train generalized machine-learning models without explicit consent.

7. How We Share Personal Data

Service providers (processors and subprocessors): they host, deliver and support the website, the platform and our communications, under contracts that limit their use of data to providing services to us. They are currently the following; changes will be reflected in this list.

• Cloudflare (United States, global network): hosts, delivers and protects the website and the platform; processes the IP address and technical logs of each visit.
• Supabase (United States and Brazil): databases for forms, contacts, prospects and email events, hosted in Oregon (United States) and São Paulo (Brazil).
• Amazon Web Services (United States): compute and storage for the Snapflow platform.
• Resend (United States): sends confirmation and service emails, and sequences to people who agreed to receive them, and reports deliveries, bounces, opens and clicks to us.
• Google Workspace (United States): our email; we send individual prospecting emails and answer your messages from it.
• Google Fonts (United States): delivers the website's typefaces; when loading them, your browser sends your IP address to Google.
• Bouncer (European Union): verifies that a prospect's work email exists before we write to them.
• Anthropic (United States): artificial intelligence model we use to draft prospecting messages.
• Stripe (United States): will process payments once paid plans are enabled.

• Channels you choose: if you write to us on WhatsApp or we talk on LinkedIn, those messages are also processed by Meta (WhatsApp) or LinkedIn under their own terms.
• Professional advisors and authorities: where required by law, legal process, or to protect rights, safety and security.
• Corporate transactions: in connection with a merger, acquisition, financing or sale of assets, subject to appropriate protections.
• We do not sell personal data, and we do not share personal data for cross-context behavioral advertising.

8. International Transfers

Snapflow Labs Inc. is a United States corporation and part of our team works from Chile. Website, form and communications data is stored in the United States and Brazil, and some providers process it in other countries (Bouncer, in the European Union; Cloudflare, across its global network). Where we transfer personal data from the EEA, the UK, Switzerland, Chile or other jurisdictions with transfer restrictions, we rely on appropriate safeguards, in particular the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant), together with supplementary technical and organizational measures.

9. Retention

We keep personal data only as long as needed for the purposes above, with these periods:

• Prospects who have not replied: up to 12 months from the last contact.
• Contacts who replied or filled in a form: up to 24 months from the last interaction.
• Email events, IP hash and user agent: 12 months.
• Account data: for as long as the account exists and up to 90 days after it is closed.
• Billing records: as long as tax and accounting law requires.
• Platform technical logs: up to 90 days.
• Customer content: until deleted by the customer or until the export window following termination described in our Terms of Service ends.
• Unsubscribes and objections: we keep only your email address on a suppression list, so we do not write to you again.

When each period ends we delete or anonymize the data.

10. Security

We apply technical and organizational measures appropriate to the risk, including encryption in transit and at rest, access controls and least-privilege practices, multi-factor authentication for internal systems, logging and monitoring, and regular backups. No system is completely secure; if we become aware of a personal-data breach affecting you, we will notify you as required by applicable law.

11. Your Rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent. If you are in the EEA/UK, you may also lodge a complaint with your supervisory authority. If you are a California resident, you have the rights provided by the CCPA/CPRA, including to know, delete, correct and opt out of "sale" or "sharing" (we do neither), and the right not to be discriminated against for exercising your rights. If you are in Chile, you have the rights of access, rectification, cancellation, opposition and portability provided by Law No. 19.628 and Law No. 21.719, and you may lodge a complaint with the Personal Data Protection Agency (Agencia de Protección de Datos Personales). Wherever you are, you can object to prospecting and to automated classification, and ask us which source your data came from. To exercise any right, reply to the email you received or write to carlos@snapflowlabs.com; we will verify your request and respond within the timeframe required by applicable law.

12. Children

The Service is intended for business users and is not directed to children under 18. We do not knowingly collect personal data from children; if you believe a child has provided us personal data, contact us and we will delete it.

13. Changes to This Policy

We may update this Policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes, notify you by email or in-app before the changes take effect.

14. Contact

Snapflow Labs Inc., a Delaware corporation, 131 Continental Drive, Suite 305, Newark, DE 19713, United States. Privacy inquiries: carlos@snapflowlabs.com.