This agreement is part of the terms of service and binds SnapHost and every customer, for every workspace and personal space in which pages are published, without any further signature. For accounts opened before it was first published it applied from that day: it binds SnapHost to the obligations below and restates the duties the GDPR already places on you as controller. It does not cover your own account details, for which SnapHost is the controller under the privacy policy.

If your organisation needs a signed document for its records, write to privacy@snaphost.ai from the owner’s address with the workspace name. We send this agreement signed by SnapHost; your signatory countersigns the printed copy and returns it. If your organisation must use its own agreement template, that is part of the Enterprise offer.

Ask for a signed copy. The security measures this agreement relies on are on the security page. The terms it is part of are the terms of service; how SnapHost handles your own account data is in the privacy policy.

The processor is SnapHost ehf., identified below. The controller is the customer: the person or organisation that owns the workspace or personal space in which pages are published. Where a page collects data from the people who open it, the customer decides why and how, and is the controller for that data; SnapHost processes it on the customer’s behalf.

Personal data, processing, controller, processor, sub-processor, data subject, supervisory authority and personal data breach have the meanings given in Regulation (EU) 2016/679, the GDPR, as it applies in Iceland through the EEA Agreement. Customer data means the personal data the controller publishes in a page, the people it names as readers, the record of who opened or asked to open a page, and what a page collects. “The terms” means the SnapHost terms of service. “Workspace owner” means the owner of the workspace or, for a personal space, the account holder.

SnapHost hosts the pages the controller publishes, verifies readers by emailing them a code, shows the pages to the readers the controller names, records who opened them, limits repeated attempts, and stores what the pages collect. The processing lasts for as long as the page is on SnapHost and the account is open, then for the retention periods in Annex I. Annex I sets out the categories of data and of data subjects.

SnapHost processes customer data only on the controller’s documented instructions, which are: the terms, this agreement, the settings the controller chooses in the product (who may open a page, for how long, with what protection), and the controller’s written requests for support. SnapHost will not use customer data for any other purpose, will not train models on it, and will not sell it. If SnapHost believes an instruction breaks the law, it will say so before acting. If the law requires SnapHost to process customer data otherwise, it will inform the controller first unless the law forbids it.

One exception, stated so it is not hidden: as its own product analytics, to measure whether pages that are shared get opened, SnapHost records that a reader verified and that a page was served, identified by a keyed hash of the reader’s email that the analytics provider cannot reverse, together with the page’s identifier. SnapHost is the controller for that record under the privacy policy, the analytics provider is SnapHost’s processor for it, and SnapHost uses it for nothing else.

The controller is responsible for the lawfulness of the processing it instructs: for having a legal basis for the personal data it publishes and collects, for informing data subjects, for deciding whether a page may carry special categories of personal data and for having its own basis under Article 9 if it does, and for giving instructions that comply with the law. The controller may instruct SnapHost through the product at any time; export what a page collects through a connected AI tool, up to 5,000 records of a collection in one call, and read all of it in the dashboard; read and copy the reader list from the dashboard, the API or a connected AI tool, and the access log from the dashboard, while the page exists; delete a page; object to a sub-processor under the sub-processor clause; audit under the audit clause; and end the service under the terms.

Only people bound by a duty of confidentiality process customer data at SnapHost, and only when the work requires it. The staff console cannot open a customer’s page: it shows accounts, plans and billing, and every change made in it is written to an audit log. The two founders who hold the storage, database and hosting consoles look at page content only when the controller asks for support in writing.

SnapHost takes the technical and organisational measures Article 32 requires, taking into account the state of the art, the cost, and the nature of the data. They are described on the security page at snaphost.ai/security as reviewed on the date above, which forms part of this agreement as Annex II: encryption in transit and at rest, verification of every reader before a private page is served unless the controller chooses a view password or a one-time link for that page, per-page isolation, an access log, hashed secrets, restricted staff access and defined retention. SnapHost may improve a measure at any time and will not lower the overall level of protection during the term; a change to the security page that would lower it is a change to this agreement under the amendment clause.

The controller gives general authorisation for SnapHost to use the sub-processors in Annex III. SnapHost has a data processing agreement with each of them, has checked it against this one, and stays fully liable to the controller for their performance. Before adding or replacing a sub-processor, SnapHost will give the workspace owner 30 days’ notice by email and will record the change on the security page and move its review date. The controller may object within that time on reasonable data-protection grounds. SnapHost runs one system and cannot keep one controller’s data off a new sub-processor, so a controller whose objection is not resolved should end the service before the change takes effect, and may do so up to 30 days after, with a refund of any prepaid fees for the period after termination.

Apart from the email provider’s copy of sent messages, held in the United States for 45 days as Annex III states, customer data is stored in the European Union and the application that serves it runs in Frankfurt, with two further qualifications stated in Annex III: the network in front of the application terminates connections worldwide, processing requests in transit under the standard contractual clauses in that provider’s data processing agreement, and the file store’s region is a location hint rather than a guarantee. Where a sub-processor in Annex III processes customer data outside the EU or EEA, or may reach it from outside, the transfer rests on a European Commission adequacy decision as it applies in the EEA, including the EU-US Data Privacy Framework for a provider listed under it, or on the standard contractual clauses in that provider’s own data processing agreement, as Annex III states for each one. If the Framework ceases to apply to a provider, SnapHost will rely on the standard contractual clauses in that provider’s agreement. SnapHost will not transfer customer data outside the EU or EEA on any other basis without the controller’s agreement.

If a data subject writes to SnapHost about customer data, SnapHost will pass the request to the controller without undue delay and will not answer it directly unless the controller asks. For a reader’s proven identity and code rows, which belong to no controller’s workspace, SnapHost answers the reader directly and, on request, revokes the identity so it opens nothing further. SnapHost will help the controller respond to requests under Chapter III of the GDPR, and will help with the controller’s obligations under Articles 32 to 36 (security, breach notification, impact assessments and prior consultation), using the information it has and the product’s own tools: the access log, the export of collected data and the delete.

If SnapHost becomes aware of a personal data breach affecting customer data, it will tell the workspace owner by email without undue delay and in any case within 48 hours, with what is known at that time: what happened, which data and which data subjects are likely affected, the likely consequences, what SnapHost has done and will do, and the SnapHost contact for the incident, which is privacy@snaphost.ai unless the notice names someone else. SnapHost will update that notice as it learns more and will help the controller meet its own notification duties.

The controller can delete a page at any time from the dashboard, export what it collected through a connected AI tool, up to 5,000 records of a collection in one call, read all of it in the dashboard, and read and copy its reader list there, over the API or through a connected AI tool, and its access log there, while the page exists; after a page is deleted, both are available on written request until the workspace is closed. Deleting a page removes its files from storage at once, with a nightly sweep for anything that failed; its record, its list of readers and its access log are removed when the workspace is closed or, for a personal space, when the account is closed. Closing a workspace deletes everything in it, except its logo and brand files, which SnapHost removes by hand on request until a sweep exists. A personal account is closed by writing to privacy@snaphost.ai, and SnapHost deletes it within 30 days. If SnapHost ends the service, however it ends, the controller keeps dashboard access to copy customer data for at least 30 days before deletion, unless the law or the safety of other people prevents it.

Deleted records fall out of the database’s backups within 6 hours, and the email provider’s copy of any message expires after 45 days. After that, neither SnapHost nor a sub-processor holds a copy of customer data beyond the hosting and error logs and the expired code and identity rows listed in Annex I, except where the law requires SnapHost to keep a record, in which case it keeps only that record and only for that purpose.

SnapHost makes available the information needed to show it meets Article 28: this agreement, the security page, the sub-processor register, and written answers to the controller’s reasonable questions. The controller, or an independent auditor it appoints who is bound by confidentiality, may audit SnapHost’s processing of customer data once in any twelve months on thirty days’ notice, during working hours, at the controller’s cost unless the audit finds a material breach of this agreement, in a way that does not expose other customers’ data. An audit required by a supervisory authority, or following a personal data breach affecting the controller’s data, does not count against that limit.

Liability under this agreement is subject to the limits in the terms, which cap SnapHost’s total liability to the controller at the fees the controller paid SnapHost in the twelve months before the claim arose. Nothing in this clause limits either party’s liability to data subjects under Article 82, the right of recourse under Article 82(5), or liability to a supervisory authority. An Enterprise contract may set a different cap, law or venue. This agreement is governed by the law of Iceland and the courts named in the terms. If this agreement and the terms conflict about the processing of customer data, this agreement wins; otherwise the terms apply, and the privacy policy governs the account holder’s own data.

SnapHost may update this agreement to reflect a change in the law or in the service. A change that lowers the controller’s protection is notified by email to the workspace owner and on this page, with the date, with the same right to object and to end the service with a refund of prepaid fees as for a new sub-processor; until the matter is resolved the previous version applies to that controller.

Data subjects

The people the controller names as readers of a page; anyone who opens a page, public or private; anyone who asks for a code or requests access at a page’s gate, whether or not the controller named them; anyone who enters data into a page the controller publishes; the people mentioned in the content of a page.

Categories of personal data

For every open of a page, except a private page opened by its view password alone: the time, network address and browser, with the reader’s email where the reader proved one; for a public page or a one-time link, the open without a name. Access requests: the requester’s email and the message they write. Whatever the controller writes into a page. Whatever a page collects, as the controller designs it.

Special categories

The parties do not intend special categories of personal data (Article 9) to be processed, and SnapHost is not built for protected health information. A controller that nevertheless publishes or collects such data must have its own basis under Article 9.

Nature of the processing

Storage; sending verification emails; delivery to verified readers; logging of access; rate limiting keyed by email and network address; storage of collected records; backup; deletion. The analytics record in the instructions clause is SnapHost’s own.

Purpose

Hosting and sharing the controller’s pages with the people the controller chooses.

Frequency

Continuous, for as long as the page is published.

Duration and retention

Page files: until the page is deleted. Reader list and access log, including opens without a name: until the workspace is closed or, for a personal space, the account. Collected records: until the page or the record is deleted. Verification codes stop working after ten minutes and a reader’s proven identity after 90 days at most; the rows that record them, which carry the reader’s email, are kept past their expiry, unusable and tied to no workspace, until a sweep is added. Single-use links: 15 minutes to use, then a 24-hour session; one-time links: seven days to open, one hour to read; the rows behind single-use links and sessions, with the reader’s email, and behind one-time links, without one: until the workspace is closed or, for a personal space, the account. Access requests, with their message, and the workspace audit log: the same. Database backups: 6 hours. Sent emails at the email provider: 45 days. Rate-limit counters: at most an hour. Hosting request logs, which carry the network address of each request, and error reports: kept by Vercel and Sentry for the periods their plans document; neither carries page content or an email address.

The measures are those described on the security page at snaphost.ai/security as reviewed on 13 October 2026, which forms part of this agreement.

Verified against each provider's data processing agreement, its trust page and the EU-US Data Privacy Framework list on 13 October 2026. The authorisation in the sub-processor clause concerns the rows marked “Your pages and readers”; the rows marked “Account holders only” or “SnapHost’s own record” are listed for completeness, and SnapHost is the controller for that data.

• Vercel (Vercel Inc.)

  Runs the application: the dashboard, the viewer, the API and the scheduled jobs.

  Data

  Everything the application handles while it is served, including pages, reader emails and access records in transit, and its runtime logs, which carry the network address of each request and no email address. The application runs in Frankfurt. The network in front of it is worldwide, as every content delivery network is, and the routing and session code runs there too.

  Whose data

  Your pages and readers

  Region

  Frankfurt (fra1); network edge worldwide

  Transfer basis

  Application in the EU; a reader’s connection ends at the network edge nearest them, under the standard contractual clauses in Vercel’s data processing agreement; Vercel Inc. is on the EU-US Data Privacy Framework for any access from the United States

• Neon (Neon Inc., part of Databricks, Inc.)

  The database: accounts, workspaces, sites, who may open each page, the access log, and data your pages collect.

  Data

  Account details, reader emails, access records, collected records.

  Whose data

  Your pages and readers

  Region

  Frankfurt (AWS eu-central-1)

  Transfer basis

  Stays in the EU; Databricks, Inc. is on the EU-US Data Privacy Framework for any access from the United States

• Cloudflare R2 (Cloudflare, Inc.)

  Stores the files behind every published page, in a private bucket the browser never reaches directly.

  Data

  Page content and uploaded files. The bucket carries a Western Europe location hint, which Cloudflare honours as a best effort rather than a guarantee; a bucket with a binding EU jurisdiction is on our list.

  Whose data

  Your pages and readers

  Region

  Western Europe (location hint)

  Transfer basis

  Stays in the EU; Cloudflare, Inc. is on the EU-US Data Privacy Framework for any access from the United States

• Upstash (Upstash, Inc.)

  Rate limiting: counts attempts so a code or a password cannot be guessed by brute force.

  Data

  Short-lived counters keyed by a reader email address or a network address, with the page’s identifier, kept for at most an hour; never page content or the code.

  Whose data

  Your pages and readers

  Region

  Ireland (AWS eu-west-1, the primary of a global database with no replicas)

  Transfer basis

  Stays in the EU; Upstash, Inc. is on the EU-US Data Privacy Framework for any access from the United States

• Clerk (Clerk, Inc.)

  Sign-in for account holders, by email code. Readers never sign in here.

  Data

  Account holder name, email and session.

  Whose data

  Account holders only

  Region

  United States

  Transfer basis

  EU-US Data Privacy Framework (listed as Clerk)

• Postmark (AC PM LLC, part of ActiveCampaign, LLC)

  Sends the emails: verification codes and links to readers, invitations, billing notices.

  Data

  Recipient email address and the message, held by the provider for 45 days, its documented default.

  Whose data

  Your pages and readers

  Region

  United States

  Transfer basis

  EU-US Data Privacy Framework (listed as ActiveCampaign, LLC)

• PostHog (PostHog Inc.)

  Product analytics for the marketing site and the dashboard. Shared pages carry no analytics script.

  Data

  Account holder identifier, username and email, and which pages and controls were used. Of a reader, only a keyed one-way hash of the email, made with a secret SnapHost holds and that PostHog cannot reverse, recorded with the page’s identifier when the reader verifies and when the page is served; never the address, the page’s content or the code. That reader record is SnapHost’s own, as the data processing agreement states.

  Whose data

  SnapHost’s own record, derived from a reader

  Region

  Frankfurt (EU cloud)

  Transfer basis

  Stays in the EU; PostHog Inc is on the EU-US Data Privacy Framework for any access from the United States

• Sentry (Functional Software, Inc.)

  Error monitoring, so a failure is seen and fixed.

  Data

  The technical context of an error: request path, browser, the error text. Page content and reader emails are not sent. Error data is stored in Frankfurt; our own Sentry account settings are in the United States.

  Whose data

  Account holders only

  Region

  Frankfurt (EU data residency)

  Transfer basis

  Stays in the EU; Sentry.io is on the EU-US Data Privacy Framework for any access from the United States

• Slack (Slack Technologies Limited (Ireland), part of Salesforce, Inc.)

  Tells the SnapHost team about new sign-ups, plan changes and failures.

  Data

  A new account holder’s name, email, username and plan; a plan change with the account holder’s name and email, the workspace and the amount; failure notices that name a site or workspace by its identifier. Nothing about a reader and no page content.

  Whose data

  Account holders only

  Region

  United States (Slack’s hosting)

  Transfer basis

  EU-US Data Privacy Framework (listed as Salesforce, Inc.)

Not a sub-processor: Braintree (PayPal (Europe) S.à r.l. et Cie, S.C.A.). Takes payment for Pro seats as an independent controller under its own terms, processing account-holder billing data only. Card details go to Braintree directly and never touch SnapHost. It is outside this agreement.