Privacy Policy

Privsnap provides browser-based OCR software. For the purposes of the EU and UK General Data Protection Regulation (“GDPR”), we act as the data controller for the limited personal data described below. You can reach us at support@privsnap.sumku.cc.

We collect only what we need to run accounts, billing, and limits:

• Account information. If you create an account, your name, email address, and a hashed password, together with authentication and session records.
• Subscription and billing data. Your subscription status and the identifiers our payment processor returns. Card details are entered with and held by the processor, not by us.
• Usage limit data. A per-IP daily counter used to enforce the free allowance. It is a number associated with a truncated network address, not with your identity.
• Technical and log data. Standard, short-lived server logs (such as IP address, user agent, and timestamps) generated by our hosting provider for security and reliability.
• Communications. The contents of messages you send to our support address.
• Cookies. A single first-party cookie that keeps you signed in. See our Cookie Policy.

OCR runs entirely in your browser as WebAssembly. Your images, the text extracted from them, the searchable PDFs you export, and the redacted images you create are processed on your device and are never uploaded to, transmitted to, or stored on our servers or any third party. When you close the browser tab, that data is gone. We cannot access it because we never receive it.

We use the limited data we collect to:

• Create and secure your account and keep you signed in.
• Provide, maintain, and improve the Service.
• Process subscriptions and prevent abuse of the free allowance.
• Send transactional email such as verification and password reset (when enabled).
• Respond to your support requests.
• Comply with legal obligations and enforce our Terms of Service.

Where the GDPR applies, we rely on the following legal bases: performance of a contract (to provide the Service and billing your subscription); our legitimate interests (to secure the Service, enforce usage limits, and prevent fraud); compliance with a legal obligation; and your consent, where required (which you may withdraw at any time).

We do not sell your personal data. We share it only with:

• Payment processing. creem.io acts as our merchant of record and processes your billing information under its own privacy policy and terms.
• Email delivery. When verification and reset emails are enabled, they are delivered through Cloudflare Email Sending, which processes the recipient address solely to send the message.
• Hosting and infrastructure. Cloudflare hosts the Service and stores account, session, and subscription records and the usage counter.
• Legal and safety. Authorities or others where required by law, or to protect rights, safety, and the integrity of the Service.
• Business transfers. A successor entity in connection with a merger, acquisition, or sale of assets, subject to this policy.

Our providers may process data in countries other than your own, including the United States. Where required, such transfers are made under appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

We keep account data for as long as your account is active and for a reasonable period afterward to meet legal, tax, and accounting requirements. Session records expire automatically. The daily usage counter expires within about 48 hours. You may request deletion of your account data as described below.

We use industry-standard measures, including encryption in transit, hashed passwords, and access controls, to protect the data we hold. No method of transmission or storage is completely secure, but keeping your images and extracted text on your own device removes the largest category of risk entirely.

Depending on where you live, you may have the right to access, correct, delete, or port your personal data, to object to or restrict certain processing, and to withdraw consent. If you are in the European Economic Area or the United Kingdom, these rights arise under the GDPR. If you are a California resident, the CCPA and CPRA give you rights to know, delete, correct, and opt out of the sale or sharing of personal information; we do not sell or share your personal information as those terms are defined. To exercise any right, email support@privsnap.sumku.cc. We will not discriminate against you for doing so, and you may appeal a decision or lodge a complaint with your local data protection authority.

The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, please contact us and we will delete it.

The Service may link to third-party sites, such as our payment provider. We are not responsible for their privacy practices, and we encourage you to review their policies.

We may update this Privacy Policy from time to time. We will revise the “Last updated” date above and, for material changes, provide a more prominent notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

Questions or requests about this policy or your data? Write to support@privsnap.sumku.cc.

This document is provided as a general template and does not constitute legal advice. Have it reviewed by qualified counsel for your jurisdiction before commercial launch.