Privacy Policy | Snapway AI

1. Introduction

This Privacy Policy applies to Snapway AI's video, image, audio, design, collaboration, and billing features (the "Service") and works with our Terms of Use.

If a term is capitalized but not defined here, it has the meaning given in our Terms of Use.

2. Data Controller

Snapway AI is responsible for the personal information described in this Policy. Contact us at support@snapway.ai. If an order confirmation or invoice identifies a different Snapway contracting entity, that entity is responsible for the paid account and related records.

Depending on the feature and provider, a third party may act as our processor, our service provider, or an independent controller under its own terms. Sections 7, 9, 10, and 13 provide additional information.

3. Information We Collect

3.1 Information you provide

• Account information. Name, email, password hash (or third-party identity claims if you sign in via Google or another provider), profile photo.
• Billing information. Plan, transaction history, billing address, last-four/issuer of payment card. Full card data is handled by our PCI-compliant payment processor (e.g., Stripe) and is not stored on our servers.
• User Content. Prompts, uploads (images, videos, audio, documents), reference materials, custom avatars, voice samples, character descriptions, edits, and ratings/feedback.
• Communications. Messages you send through in-app chat, support tickets, surveys, or email.

3.2 Information collected automatically

• Usage data. Features used, prompts issued, models invoked, generation parameters, credit usage, success or error events, and project activity.
• Device & technical data. Browser and device information made available in request headers, language, timezone, and performance information needed to deliver or troubleshoot the Service.
• Log data. IP address, request headers, access timestamps, referring URL, trace and request IDs for debugging.
• Cookies and similar. See Section 5.

3.3 Information from third parties

• Authentication providers. If you sign in with Google or another OAuth provider, we receive your name, email, profile photo, and the unique identifier of your account, per the scopes you authorize.
• Optional Pinterest connection. If you connect Pinterest, we store encrypted access and refresh tokens to show your authorized boards and Pins. We request board and Pin previews from Pinterest when you browse them. When you drag a Pin onto the canvas, we import its image as a project asset so you can edit it like other images. The imported image and its Pinterest source link remain in the project after you disconnect. Disconnecting removes the stored tokens.
• Analytics & fraud-prevention providers. Aggregated signals about how the Service is used and reputation signals to detect abuse.

4. Likeness & Voice Content

Some features process images of faces, video of a person, voice recordings, presenter references, or lip-sync inputs ("Likeness Content"). Snapway uses this content to provide the requested creative feature, not to identify or authenticate a person.

• We process Likeness Content only to provide the feature you request, keep the Service secure, comply with law, and resolve support or abuse reports.
• Necessary inputs may be transmitted to the model provider displayed for the feature. Provider retention and processing terms may differ and should be reviewed before using sensitive likeness or voice material.
• We do not sell Likeness Content or use it to identify a person.
• You may delete source assets through available project controls or request account-level deletion through support. Provider copies, backups, fraud-prevention records, and legally required records may follow separate retention periods.
• If a feature is changed to collect a biometric identifier for identification or authentication, we will provide any separate notice and consent process required before that collection.

5. Cookies & Similar Technologies

We use a small number of cookies and browser storage mechanisms:

• Strictly necessary. Authentication state, CSRF protection, session integrity, language preference. The Service cannot function without these.
• Functional. Remembering UI preferences (e.g., dark mode, sidebar state).
• Operational storage. Limited browser storage for workflow state, pending checkout, and reliability. We do not currently load third-party advertising cookies.

You can clear cookies at any time through your browser. Doing so may sign you out and reset your preferences.

6. How We Use Information

We use information to:

• Provide, secure, and operate the Service.
• Run AI inference — including sending prompts and inputs to third-party model providers under contract — to generate the outputs you request.
• Process payments and prevent fraud or abuse.
• Communicate with you about your account, transactional events, product updates, and (with consent where required) marketing.
• Improve the Service through aggregated analytics, qualitative research, and human review of flagged content.
• Enforce our Terms, comply with legal obligations, and respond to lawful requests.

7. Legal Bases (EEA / UK)

If you are in the EEA, UK, or Switzerland, we process your personal data on one or more of the following GDPR legal bases:

• Contract. To deliver the Service to you (Art. 6(1)(b)).
• Legitimate interests. To secure the Service, prevent abuse, develop new features, and conduct aggregated analytics, balanced against your rights (Art. 6(1)(f)).
• Consent. Where required by law — for example, for optional cookies, marketing messages, or a likeness or voice feature that legally requires consent (Art. 6(1)(a) and, if applicable, Art. 9(2)(a)).
• Legal obligation. To comply with applicable laws and lawful requests (Art. 6(1)(c)).

8. AI Model Training

We do not use private prompts or uploads to train a general-purpose foundation model operated by Snapway. When a requested feature uses a third-party provider, that provider processes necessary inputs under its contract, configuration, and published terms. Provider retention or model-improvement practices may differ, so review the information shown for the selected model before submitting sensitive content.

Aggregated, de-identified signals (e.g., counts of clicks per feature, generation latency, error rates, abstracted prompt statistics with personal information removed) may be used to improve the Service.

We will not use private projects in marketing. If you separately authorize a public showcase or case study, the accompanying authorization controls that use and may be withdrawn prospectively.

9. Sharing & Sub-processors

We may disclose personal data to the categories of recipients below as needed for the Service. Their processing is governed by applicable contracts, settings, published terms, and law, depending on their role.

• AI and media providers. Providers may include Google, OpenAI, fal.ai, Runway, Kling, MiniMax, ElevenLabs, APIFrame or Midjourney service providers, DashScope, and providers displayed with a selected model. Necessary prompts and inputs are transmitted to the selected provider.
• Cloud and infrastructure. Hosting, storage, authentication, CDN, and database services may include Supabase, Google Cloud, and Cloudflare.
• Payments. PCI-compliant processors (e.g., Stripe) for plan management, taxation, and transaction history.
• Authentication. Identity providers you choose to sign in with.
• Analytics & error monitoring. Privacy-aware product analytics and error tracking.
• Communications. Email and notification providers for transactional and (where you opt in) marketing messages.
• Professional advisors. Lawyers, auditors, accountants under confidentiality.
• Legal & safety. When required by law, legal process, lawful request, or to protect users, third parties, or the public.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to the same protections described in this policy.

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising as defined under the CCPA.

10. International Data Transfers

Your data may be processed in countries other than where you live, including the United States and countries where selected model providers operate. Provider terms and any applicable contractual or statutory transfer mechanisms govern those transfers. Contact us for information relevant to your account.

11. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described here, including providing the Service, security, billing, legal compliance, dispute resolution, and enforcement. Actual periods depend on the data and provider:

• Account data. While the account is active and afterward for a limited period needed for security, disputes, or legal obligations.
• User Content & Generated Content. Until you delete it, close the account, or the applicable storage window expires, subject to backups and provider retention.
• Likeness Content. Under the same project, deletion, backup, provider, and legal rules that apply to the source asset and resulting project.
• Logs and operational records. For the shortest period reasonably needed for reliability, security, abuse prevention, and legal compliance.
• Billing and consent records. For periods required by tax, accounting, contract, consumer-protection, and evidence-preservation laws.

12. Security

We use reasonable technical and organizational safeguards appropriate to the nature of the Service. Measures may include:

• Encryption in transit and provider-managed encryption at rest where supported.
• Authentication, authorization, and restricted administrative access.
• Logging, rate limits, dependency maintenance, and investigation of suspected abuse or security events.
• Code review and testing appropriate to the change and risk.
• Backups and recovery controls provided by relevant infrastructure services.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the appropriate regulators as required by law.

13. Your Rights

Subject to your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete personal data, subject to legal exceptions.
• Port data to another service in a structured, machine-readable format.
• Restrict or object to certain processing, including processing based on legitimate interests.
• Withdraw consent where consent is the legal basis (without affecting prior lawful processing).
• Lodge a complaint with your local data protection authority.

Submit a request through in-app support or support@snapway.ai. We may need to verify your identity and authority. We will respond within the period required by applicable law and explain any lawful exception.

14. California Privacy Rights

If Snapway is subject to the CCPA for your information and you are a California resident, applicable rights may include:

• The right to know what personal information we collect.
• The right to delete personal information, subject to certain exceptions.
• The right to correct inaccurate personal information.
• The right to opt out of "sale" or "sharing" of personal information. We do not sell or share personal information as defined under the CCPA.
• The right to limit use of sensitive personal information.
• The right not to receive discriminatory treatment for exercising your privacy rights.

We do not knowingly sell or share the personal information of consumers under 16 years of age.

15. Children

The Service is intended for adults who have reached the age of legal majority where they live. We do not knowingly permit children to create accounts. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

16. Global Privacy Control & Do Not Track

We do not currently sell personal information or share it for cross-context behavioral advertising, so a GPC signal does not change those practices. If our practices change or applicable law requires an opt-out response, we will treat a recognized GPC signal as a request for the browser or device that sends it. We do not respond differently to non-standardized Do Not Track signals.

17. Changes to This Policy

We may update this Privacy Policy as the Service evolves. If a change is material, we will update the version date and provide notice as required by applicable law. The updated Policy describes our practices from its effective date; where consent is legally required for a new practice, we will request it separately.

18. Contact

For privacy questions or rights requests, use in-app support or email support@snapway.ai with the subject "Privacy request." Include the account email and request type, but do not send passwords, payment card details, government identifiers, or other unnecessary sensitive information.