Privacy Policy

1Controller

Responsible for data processing on this website:

snaff.ai
Alszeile 93, 1170 Wien, Österreich
hello@snaff.ai

2At a glance

• You can run an analysis without an account.
• We analyze public websites, not people. Web analytics runs without cookies.
• Hosting is in Austria. We never sell data and show no advertising.

3Which data we process

• Website analyses: the URL you enter, host name, page title, scores, check results and time of the analysis. These relate to public websites. Recently analyzed domains and aggregated, anonymous statistics may be shown publicly on snaff.ai.
• Account: email address, password (stored only as a bcrypt hash), plan, monitored domains, settings, branding (name, logo, color) and API keys you create.
• Shared case studies: link code, domain, view count. Anyone with the link can see the case study until you disable it.
• Payments: handled by Stripe. We only store a customer reference, never card data.
• Technical data: IP address, browser and time in the hosting provider's server log files. For abuse protection we keep a hashed IP address for 60 seconds.
• Contact: if you email us: your name, address and message.

4Legal bases

• Contract performance (Art. 6(1)(b) GDPR): analyses, account, plans, reports.
• Legitimate interests (Art. 6(1)(f) GDPR): security, abuse protection, cookieless reach measurement, anonymous statistics.
• Consent (Art. 6(1)(a) GDPR): e.g. connecting Google Search Console.
• Legal obligations (Art. 6(1)(c) GDPR): e.g. retention of invoices.

5Cookies & analytics

We only use technically necessary cookies: a session cookie (sign-in, security) and a language cookie. No advertising or tracking cookies.

For reach measurement we use Matomo on our own server (analytics.2442.io), without cookies and respecting "Do Not Track". The data is not passed on to third parties.

6Service providers & recipients

Depending on the feature you use, we work with these providers. Unless stated otherwise, they only receive the URL or domain being analyzed, no personal data.

• Hosting: easyname GmbH, Vienna, Austria (servers).
• Stripe (payments; receives payment and contact data when you buy a plan).
• Jina AI (rendering of websites that block direct access).
• AI providers (OpenAI, Perplexity, Google Gemini, Anthropic, Mistral, OpenRouter, NVIDIA) for the AI citation test and text features: questions about the domain or brand.
• DataForSEO, Serper.dev, Google Autocomplete for SEO data and keyword ideas: keywords and domains.
• Google Search Console only if you connect it: access token for your property.
• Google favicon service shows small website icons; your browser loads them directly from Google, which sees your IP address.

Some providers are located in the USA. Transfers rely on the EU-US Data Privacy Framework or EU standard contractual clauses.

7Retention

• Analyses of public websites: kept for statistics and progress history.
• Account data: as long as your account exists; deleted within 30 days after deletion of the account.
• Invoices: as required by law (7 years in Austria).
• Abuse-protection hashes: 60 seconds.

8Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and to withdraw consent at any time. Write to hello@snaff.ai; we reply within 30 days.

You can also lodge a complaint with the Austrian Data Protection Authority: www.dsb.gv.at

9Security

Encrypted connections (HTTPS/TLS), passwords as bcrypt hashes, CSRF protection, rate limiting and regular updates.

10Changes

We update this policy when our services change. The current version is always available here.