Privacy Policy

Snacked is a sales-funnel SaaS operated by SOFTWARY S.R.L., an Italian limited liability company with registered office at Via Giovanni Porzio F11, 80143 Napoli (NA), Italy, VAT number IT10580571213. Contact: [email protected].

For creators(you, the account holder): email, display name, public handle, payment customer id and invoice metadata from our payment partner, plan and subscription status, audit log of plan changes, support correspondence. When you create a funnel, the public pages of your site that you give us are read to describe your offers and your site's look.

For respondents(people who go through a creator's funnel): the answers chosen and the result reached, email and GDPR consent flag only if the creator asks for an email, anonymous session id, country derived from IP (we do not store full IPs in the leads table), user agent, optional UTM parameters set by the creator's share link, a coarse device class (mobile, tablet or desktop) derived from the user agent, and the hostof the referring site when one is present — never the full referring address, so a referring page's own path or search terms are not stored. If the creator installs our sales snippet on their own site, we also receive the purchase that visit led to: the random visit id, and the order id, value and currency the creator chooses to send.

For creator data, we are the data controller. For respondent (lead) data captured through a creator's funnel, the creator is the data controller and Snacked is the data processor — see the Data Processing Agreement (DPA) available on request via [email protected].

Contract performance for the creator account; explicit consent for respondent lead capture (the GDPR consent checkbox at the email gate is mandatory and recorded). Legitimate interest for product analytics and abuse prevention.

Lead data captured by a creator is retained while the parent funnel exists. After a funnel is deleted, leads are kept for 30 days for recovery, then permanently erased by an automated daily job. Account deletion soft-deletes the account for 14 days, then permanently erases all user-owned data. Audit logs and billing records are retained for the period required by tax and accounting law (typically 10 years for invoices in Italy).

We rely on the following providers to operate the service. Each processes personal data only on our instructions and under a compliant data-processing agreement. We may add or change sub-processors over time; this section is updated when we do.

Access, rectification, erasure, restriction, portability, objection — write to [email protected]. Creators can export all their account data from /settings/account. Respondents who want their lead data removed should contact the creator whose funnel they completed (the creator is the data controller for that data); we will assist on request. We respond within 30 days.

We use strictly necessary cookies for authentication and session management. Product analytics (PostHog) runs only after you accept analytics cookies, and the Meta Pixel on our marketing pages only after you accept marketing cookies; until then neither sets anything. Visitors whose location we can't confirm see the banner too. A creator's own tracking pixels (Meta, GA4) run on their funnel only when they configured them and the visitor accepted marketing cookies — the creator's privacy policy governs those. The sales snippet a creator may install on their own site stores only a random visit id in that site's storage. Details in the cookie policy.

Some sub-processors are located outside the EU/EEA. Where this is the case, transfers are protected by Standard Contractual Clauses (SCCs) and adequacy decisions where applicable.

Material changes are posted here with the “Last updated” date refreshed. Substantive changes that affect how we process creator data trigger an email to active creators with at least 14 days notice before they take effect.