SNAEB.

Privacy Policy

Last updated 21 August 2026. Working draft — confirmed before launch.

Who we are

SNAEB Ltd (United Kingdom) is the data controller for the SNAEB app and website. Contact: support@snaeb.co.uk.

What we collect and why

  • Account: email, name, password (hashed) — to sign you in and run your membership. Lawful basis: contract.
  • Membership and redemptions: your plan, credits, and each redemption (café, time) — to enforce limits and pay cafés. Lawful basis: contract.
  • Payments: handled by Stripe. We store Stripe identifiers, never card numbers. Lawful basis: contract.
  • Location: only when you allow it, at the moment you generate a code, to check you are near the café. Not tracked in the background. Lawful basis: legitimate interest (fraud prevention).
  • Employer accounts: if your employer provides your membership, your workplace admin sees your name, email and how many drinks you have redeemed — not where or when.
  • Café owners: business and identity details are collected by Stripe for verification under Stripe's own privacy terms.
  • Marketing: only if you opt in; you can opt out in Account → Email preferences at any time.

Who processes it

Supabase (database and authentication, hosted in London), Stripe (payments and café verification), Vercel (hosting), Resend (transactional email), Sentry (error monitoring, no request bodies), Google Maps (café map), Cloudflare (DNS and bot protection). Each acts on our instructions under a data-processing agreement.

Retention

  • Account and redemption records: for the life of your account, then up to 6 years for financial records as UK law requires.
  • One-time codes: deleted within an hour of expiry.
  • Location readings: kept with the code they were minted for and deleted with it.
  • Error logs: 90 days.

Your rights

Under UK GDPR you can access, correct, export or delete your data, object to or restrict processing, and withdraw consent. Email support@snaeb.co.uk; we respond within one month. You can also complain to the ICO (ico.org.uk).

Security and breaches

Data is encrypted in transit and at rest; money and identity checks run on the server only. If a breach affects your personal data we will notify you and the ICO within the legal deadlines.

Cookies

We use only the cookies needed to keep you signed in and remember which view you are using. No advertising or cross-site tracking cookies.