Privacy Policy

Controller (Imprint)

1. Who we are

Cado Holdings OÜ (“we”) is the controller when you use snaips.com or its services and for Snaips’ own B2B prospect research and direct marketing. We are responsible for processing your personal data under the EU General Data Protection Regulation (GDPR).

2. What data we collect and why

We process information needed to provide our services, operate the website, and carry out the B2B prospect research and direct marketing described below:

• Account data: For example, name and email address if you create an account or are invited to use a service. Required to create the account, sign you in, and communicate with you.
• Service data: Information you submit through the site's forms or services. We process this data only to fulfil the purpose for which it was provided.
• Technical data: IP address and standard server logs. Needed to keep the site secure, troubleshoot errors, and maintain operations.
• Website usage and campaign data: Page views on public marketing pages, referring site, campaign parameters, and successful submission of the contact form. We use this information to evaluate the website and advertising campaigns. Names, email addresses, phone numbers, and messages entered in the form are not sent to analytics or advertising providers.
• Consent records: A random browser-specific identifier, your choice, the time of the choice, language, and the version of the consent notice shown to you. We do not attach an IP address, user account, or contact details to this record.
• AI search audit data. We process the public website content selected for the audit, original HTML, bounded browser-rendered content, approved target context and questions, findings, search samples, source references, and API usage metadata to provide the requested service.
• Order and billing data: when you order the full GEO audit: the company name and VAT number if you give them, and whether your business is outside the EU; the name, billing address and email address you give Stripe at payment; the amount paid, the VAT, Stripe's fee and the payout to our bank account, and the invoice number. We use them to deliver the order, for invoicing, bookkeeping and VAT returns. We never see or store your card details.

B2B prospect research and direct marketing

We research public company websites and other public business and professional sources to identify businesses and relevant contacts for Snaips GEO services. We use this information to introduce GEO services relevant to the business and the contact’s role, and to manage our communications.

We select contact persons based on the relevant connection between their job duties and the services we offer. We record the reasons for the selection and the public sources that support them. Before making contact, we assess that the service offered is materially related to the recipient's job duties and that electronic direct marketing is permitted under the applicable law.

We process company details, the contact’s name, role, employer and published work email, the source URL, collection date and supporting source evidence. We also process website content and GEO findings, assessments of relevance to our outreach, sent messages and contact history, and marketing objections. Publicly available contact details can be personal data.

Sources include company websites and their contact and team pages, public business directories, public search results, and business-search APIs. Website URLs and CSV data may also be imported through administration. The message identifies the specific public source of the contact detail.

A personal message link grants access to the relevant review. We may record when the review is opened, to assess how the service works and how our outreach performs. We do not track email opens. We record actual requested previews, confirmed communications, sales qualification and related orders to manage your requests and assess outreach under our documented legitimate interest. Objection stops marketing.

3. Cookies, analytics, and advertising measurement

We use strictly necessary cookies for sign-in (.AspNetCore.Identity.Application), language preference (.AspNetCore.Culture), CSRF protection, and remembering your advertising-measurement choice (snaips_ads_consent). These cookies are needed to provide requested functions and respect your privacy choice, so they are used without separate consent. The consent choice remains in your browser for 180 days.

We use cookieless Simple Analytics independently of your optional measurement choices, including visits from campaign links. Public marketing pages use standard page measurement. Private cold-email landing and GEO preview pages send only generic page names and allowlisted actions through our server, without private URLs, referrers, recipient identifiers or form contents. Account, agreement and admin pages are excluded. Do Not Track is respected.

Google Ads is loaded on public marketing pages only after separate advertising-measurement permission. Before permission or after refusal we send no optional Google Ads measurement requests. When allowed, Google may set _gcl_ measurement cookies and receive conversion information. Personalized advertising and remarketing remain disabled.

You can change your choice at any time using the Cookie settings button in the site footer. Withdrawing consent disables advertising storage and removes accessible first-party _gcl_ cookies from your browser. More information about Google's use of data: Google Business Data Responsibility.

With your website-measurement permission we collect aggregate page-load, section-reach, active-time and key-action counters, optionally grouped by campaign and content version. We do not store recipient browsing histories, form contents, resource-link tokens, IP addresses or consent identifiers in these counters. Random, unlinked retry receipts prevent duplicate counting. Counters and receipts are deleted after 30 days. Small reporting groups are hidden, although a numeric threshold alone does not establish anonymity. Your service requests and payment records are processed separately.

Custom AI enquiries and the minimum sales assessment are retained for 12 months from submission and then deleted. Access is limited to administrators. You may request erasure earlier. Customer delivery and statutory accounting records follow their separate retention rules. On prospect erasure, historical outreach statistics may be merged into broad totals without dates, campaign or audience identifiers, recipient hashes or recoverable links; late events then remain unattributed.

4. Lawful basis for processing

We process your data under the GDPR on these bases:

• Performance of a contract: To deliver the services we provide after an account or equivalent arrangement is in place.
• Legitimate interest: Keeping the site secure and operational, demonstrating consent choices, responding to requests and assessing necessary business communications.
• Snaips' own B2B prospecting and direct marketing: We process public professional contact details on the basis of legitimate interest under Article 6(1)(f) GDPR. Our legitimate interest is to identify companies for which our services are relevant and to market our services to their representatives whose job duties make them suitable recipients. We assess the necessity of processing personal data and the data subjects' rights and interests in a documented legitimate interest assessment.
• Consent: Optional aggregate website measurement and, with separate permission, Google Ads advertising cookies and conversion measurement. You can withdraw either permission at any time without affecting earlier lawful processing.
• Legal obligation: the data of invoices, bookkeeping and VAT returns (the Estonian Accounting Act and Value-Added Tax Act), including the check of a VAT number that reverse charge depends on.

5. How we share your data

We do not sell your personal data. We use the following service providers for the purposes described in this policy:

• Microsoft Azure (EU) — application and database hosting.
• Resend (resend.com) — delivery of transactional email, Snaips B2B marketing messages and related follow-ups, and handling delivery failures and marketing objections. The recipient’s email address and message content are sent to the service.
• Simple Analytics (simpleanalytics.com) — cookieless, aggregated traffic measurement on public marketing pages.
• Google Ireland Limited — Google Ads campaign and conversion measurement according to your consent choice.
• OpenAI — content analysis and OpenAI API web-search sampling for AI search audits, and analysis of companies and public professional contact details, GEO findings and message drafting for B2B prospect research. Processing may include website content, published work contact details, source references and evidence of a person’s role. API requests use store=false.
• Serper — searching for public business and professional information for B2B prospect research. Queries may include a company name, domain and contact name; results include public source URLs and search snippets.
• Google Places API — finding companies through business and location searches when this source is used for prospect research.
• Stripe Payments Europe, Limited (Ireland) — payment processing, invoices and receipts, and payouts to our bank account. Stripe collects the billing details and card details at payment; card details stay with Stripe only.
• apilayer (VatLayer) and the European Commission's VIES register — checking that a VAT number is valid and its registered company name before payment. Only the VAT number is sent for the check.

You can request further information about our service providers, processing countries and applicable transfer safeguards, and a copy of applicable safeguards, from privacy@snaips.com.

Providers may process data outside the EU/EEA under appropriate transfer mechanisms such as the EU Standard Contractual Clauses. We may also disclose data to authorities if required by law.

6. Data retention

We retain account details while your account is active or as required by law. Other categories follow the retention periods described below. You can request deletion of your account and associated data by contacting privacy@snaips.com.

Consent-choice records are retained for three years after the latest change and are then deleted automatically. The browser consent cookie expires after 180 days. Data processed by Google Ads and Simple Analytics is also subject to the retention periods configured by those services.

Raw HTML, rendered DOM, full page text, and other extensive page payloads are deleted 60 days after the audit finishes. Reports, structured findings, necessary short evidence excerpts, approved context and questions, search-sample results and source references, drafts, versions, and usage records have no scheduled expiry. An explicit user or account deletion request, or a binding legal obligation, may also delete these retained reports.

Order, invoice and payment records (company name, VAT number, billing name and address, email address, amounts, VAT and payouts) are kept for seven years from the end of the financial year, as the Estonian Accounting Act requires, and then deleted. These records cannot be deleted on request before that period ends.

B2B prospect research data: We retain prospect contact details, source information, collected website content and contact history for no more than 12 months from collection if no contact has been made, or no more than 24 months from the latest contact. We then delete inactive prospecting data. Information necessary for an active customer relationship or other active cooperation may be retained for the duration of that cooperation. Delivery and billing records for a service requested by a customer follow their separate retention periods. Refreshing a website, a landing-page visit or an internal assessment does not extend prospect-data retention.

Marketing objections: If you object to direct marketing, we delete your other prospecting data but retain the minimum information needed to respect your objection (such as your email address) on our suppression list for as long as necessary to prevent further contact. This may also include the date and reason for the objection and a technical identifier used to prevent recollecting the same prospect and to keep the opt-out link working. The objection stops marketing immediately. If processing is in progress, deletion is completed once it has stopped. Information needed to deliver a service requested by a customer or to meet statutory retention obligations is handled separately.

7. Your rights

Under the GDPR you have the right to:

• Your right to object to direct marketing You can object to the use of your personal data for direct marketing and related profiling at any time, free of charge and without giving a reason. Your data will then no longer be used for those purposes.
• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Erase your data (the "right to be forgotten").
• Restrict or object to certain types of processing.
• Receive a copy of your data in a machine-readable format (portability).

To exercise these rights, or for any questions about this policy, contact privacy@snaips.com.

You also have the right to lodge a complaint with the data protection authority in your country of residence. In Estonia this is Andmekaitse Inspektsioon; in Finland the Office of the Data Protection Ombudsman.

8. Changes to this policy

We update this policy when needed. We notify registered users of material changes by email. The current version is always available on this page, and the date shown at the top reflects the most recent update.