Privacy Policy

This Privacy Policy explains how personal data is processed when you use Snughall, and gives the information required by Articles 13 and 14 of the General Data Protection Regulation (GDPR). The rules for using Snughall are in the Terms of Service.

1. Who is responsible for your data

The controller of your personal data is Paweł Marciniak, running a business as Paweł Marciniak SOLIDCode, ul. Stanisława Lema 15 lok. 30, 80-126 Gdańsk, Poland, NIP 5833421194, REGON 388201516.

For anything about your data, email [email protected], call +48 514 393 722 or write to the address above. We have not appointed a data protection officer.

2. What data we process

• Account: your name, email address, a hash of your password (or, if you sign in with Google or Microsoft, that account's identifier; we do not keep the sign-in tokens it issues), language, avatar and when the account was created. For each sign-in session we store the IP address and browser details, which also protect against abuse.
• Companies and the office: the Companies you belong to and your role, invitations, where you are in the office, your status and when you were last seen, your desk and its decorations, and the content you add: chat messages, notes, whiteboards, information cards and personal details you choose to share and that members of your Company can see (such as your time zone, job title, your town for the weather, a map pin rounded to about 28 km, birthday, or favourite books, games and music).
• People who are invited: the email address given by whoever invites them. A Company can also let people with a verified email address in its own domain join.
• Integrations you connect: the email address of the connected calendar account and free/busy blocks from your Google or Microsoft calendar for the past and next 24 hours (never event titles); your Slack workspace, Slack identifiers and status. These integration tokens are stored encrypted.
• Billing, for Owners who choose a paid plan: name, company name, billing address, VAT or NIP number, email address, and subscription and invoice history. Card details are handled by Stripe and never reach us.
• Technical data: error reports with technical details only, and usage statistics: pages visited and actions in the app, with browser, device and approximate location derived from your IP address, linked to an internal identifier, without cookies.
• Messages you send us, such as support requests and feedback.

3. Why we process it and on what legal basis

• To provide Snughall under the Terms of Service (accounts, Companies, the office, chat and integrations), including service emails such as sign-up confirmation, invitations and security messages: Article 6(1)(b) GDPR.
• To bill paid plans, issue invoices and keep tax and accounting records: Article 6(1)(b) and (c) GDPR.
• To keep Snughall secure, prevent abuse and fix errors: our legitimate interest, Article 6(1)(f) GDPR.
• To understand how Snughall is used and improve it, with self-hosted, cookie-free statistics: our legitimate interest, Article 6(1)(f) GDPR.
• To handle support requests, complaints and withdrawals: Article 6(1)(b), (c) and (f) GDPR.
• To establish, pursue or defend claims: our legitimate interest, Article 6(1)(f) GDPR.

Giving us your data is voluntary, but without an email address we cannot create an account, and without billing details we cannot sell a paid plan. We do not send marketing emails without your consent, and we make no decisions about you based solely on automated processing.

4. Data within a Company

Much of the data in Snughall lives inside a Company: its member list, statuses, chat and office content. Owners and Admins see the Company's members and manage its office, and they choose how long its chat is kept (from 7 days to 10 years, 90 days by default).

When a business uses Snughall for its team, that business decides why and how its members' data is used in its office, and we process that data on its behalf under the Data Processing Agreement, which is part of the Terms of Service for business customers.

To run and support Snughall, our platform administrators can see Companies and their members, suspend accounts and give Companies a plan. Their actions are recorded in an audit log.

5. Who receives the data

We use these providers, who process data for us under contracts:

• OVHcloud (OVH SAS, France): servers and backups, in Frankfurt, Germany.
• Cloudflare, Inc. (USA): domain name service and network protection; traffic to Snughall passes through Cloudflare.
• Postmark (ActiveCampaign, LLC, USA): sending emails, including feedback sent from the app.
• Sentry (Functional Software, Inc., USA): error reports, from which error messages, user identities and IP addresses are removed.
• ifirma (Poland): invoicing and accounting. Invoices to businesses are also sent to the Polish National e-Invoicing System (KSeF).

Stripe Payments Europe, Limited (Ireland) processes payments and subscriptions and calculates tax. It receives the Company's name and the Owner's email address when the Owner first opens Checkout. For fraud prevention and its legal obligations, Stripe acts as a separate controller under its own privacy policy.

Only if you use them: Google and Microsoft (signing in, calendars) and Slack. If you connect Slack, it receives alerts saying who knocked on your desk, mentioned you or messaged you, with the Company's name, and your Snughall status (including "in a meeting" from your calendar) is written to your Slack status.

When you look something up, our server sends only your search text to OpenStreetMap Nominatim (town search), IGDB by Twitch (games), Open Library (books), and Wikidata and Wikimedia Commons (music). For the weather, our server regularly sends MET Norway the coordinates of your weather location, rounded to about 11 km. Book and game covers and artist photos load from Open Library, IGDB and Wikimedia directly in the browser of whoever views them, which shows those services that person's IP address.

We disclose data to public authorities only when the law requires it.

6. Transfers outside the European Economic Area

Some recipients are based in the United States: Cloudflare, Postmark and Sentry; the Wikimedia Foundation and the Internet Archive (Open Library) when you look things up or view covers and photos; and Google, Microsoft, Slack or Twitch if you use their features. Transfers to them rely on the EU–US Data Privacy Framework where the recipient is certified, or on the European Commission's standard contractual clauses. OpenStreetMap Nominatim is run from the United Kingdom, which the European Commission recognises as providing adequate protection. You can ask us for a copy of these safeguards.

7. How long we keep data

• Account data: until you delete your account. Content you added to a Company (chat messages, notes, whiteboards) stays there without your name until the Company's chat retention or its members remove it; direct messages to you are deleted with your account. If a Company deactivated you, your email address stays on its list of people who cannot rejoin.
• Chat messages: as long as your Company's setting says (from 7 days to 10 years, 90 days by default).
• Calendar free/busy blocks: the past and next 24 hours only. Integration tokens: until you disconnect the integration or delete your account.
• Usage statistics: until you delete your account.
• Billing records and invoices: 5 years from the end of the year in which the deadline for paying the related tax passed, as Polish tax law requires. Invoices sent to KSeF are also kept there by the tax authority for 10 years.
• Error reports: up to 90 days. Server logs, which record no IP addresses: only as long as needed for security and troubleshooting.
• Database backups: deleted after 14 days.
• Support messages: as long as needed to handle them, and then until related claims expire.

8. Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interest. Where processing is based on your consent, you can withdraw it at any time.

You can correct your profile yourself, and delete your account in Account settings (we email you a link to confirm). For anything else, including a copy of your data or objecting to usage statistics, email [email protected]; we reply within one month.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland.

9. Cookies and browser storage

Snughall sets only strictly necessary cookies: the sign-in session cookie, and short-lived cookies (up to 10 minutes) that secure signing in with Google or Microsoft and connecting a calendar or Slack. We use no advertising or analytics cookies, so we do not ask for cookie consent. Cloudflare may set a strictly necessary security cookie.

Your browser's local storage keeps a few preferences on your device: your language, the sidebar's tab and whether it is collapsed, and your choice about desktop notifications. If you set the umami.disabled flag in your browser's local storage, or turn on Do Not Track, your browser sends no page-view statistics; to object to all usage statistics, email us.

Stripe Checkout and the Customer Portal are Stripe's pages and use Stripe's own cookies, described in Stripe's privacy policy.

10. Security

Connections to Snughall are encrypted (HTTPS). Passwords are stored only as hashes, Google and Microsoft sign-in tokens are not kept at all, calendar and Slack tokens are encrypted, and access to our servers is restricted. Logs leave out IP addresses, request bodies and cookies. We take nightly backups of the database.

11. Changes to this policy

We may update this Privacy Policy, for example when Snughall changes or we use a new provider. We publish the new version on this page, and email Users about significant changes before they take effect.