Privacy Policy

This Privacy Policy explains what personal information Snapgrove Cast collects, how we use it, who we share it with, and the rights you have over it. It applies to the website at cast.snapgrove.aiand the Snapgrove Cast service (“Service”).

1. Who we are

Snapgrove Cast is operated by 2800977 Alberta Inc., a corporation registered in Alberta, Canada (“we”, “us”, “our”). For all privacy questions or to exercise the rights described below, contact support@snapgrove.ai.

We act as the data controller for personal information collected through the Service.

2. Information we collect

2.1 Information you give us directly

• Account information— your email address, password (stored as a one-way hash by our authentication provider), and any profile information you choose to add.
• Billing information— your payment method is collected and stored by Stripe, our payment processor. We receive only a customer identifier, plan, billing status, and the last four digits of your card. We never see your full card number.
• Content you submit— source URLs (YouTube, TikTok, podcasts), audio or video files you upload, transcripts, jurisdiction and compliance profile selections, and any text you paste into the Service.
• Communications— messages you send to support@snapgrove.ai or via in-product forms.

2.2 Information we collect automatically

• Usage and diagnostic data— pages visited, features used, generation job timestamps, error events, browser type, and approximate region derived from IP address. Used for product improvement and security monitoring.
• Cookies and similar technologies— we use strictly necessary cookies for authentication (Supabase session cookie) and Stripe’s anti-fraud cookies during checkout. We do not use advertising or third-party tracking cookies. We do not run analytics that build cross-site profiles of you.

2.3 Information from third parties

• Stripe— payment status, subscription state, invoice history.
• Anthropic, AssemblyAI— usage metrics returned to us when we call their APIs on your behalf. These providers do not send us additional personal information about you.

3. Information we explicitly do not want and refuse to process

The Service is notdesigned to receive protected health information (“PHI”) or any other category of patient or client data protected by HIPAA, PHIPA, the Alberta Health Information Act, PIPEDA Article 5, GDPR Article 9 (special-category health data), the UK Data Protection Act, or any equivalent regime in your jurisdiction.

Our Acceptable Use Policy prohibits you from submitting:

• Patient names, MRNs, dates of birth, addresses, or contact details
• Photographs or videos of identifiable patients
• Lab values, vital signs, diagnoses, or treatment notes tied to an identifiable person
• Any other information that would identify, or could reasonably be combined with other information to identify, a patient or client

If you submit such information, you do so in breach of these terms. We will terminate your account immediately, with no refund, and may report the breach to your professional licensing body if required by law or by that body’s rules.

4. How we use your information

We use personal information to:

• Provide and operate the Service (run generation jobs, store outputs, return results to you);
• Authenticate you and protect your account;
• Process payments and manage subscriptions;
• Send transactional emails (magic links, receipts, trial reminders, security alerts, operator-driven account communications);
• Provide customer support;
• Improve the Service through aggregated, de-identified usage analysis;
• Detect, prevent, and respond to fraud, abuse, security incidents, and violations of our terms;
• Comply with legal obligations (tax, anti-fraud, lawful requests from authorities).

We do not:

• Sell your personal information to anyone, ever;
• Use your content or generated outputs to train any machine learning model;
• Share your information with advertisers or data brokers;
• Use your information for any purpose materially different from those listed above without first asking you.

5. Legal bases (for users in the EEA, UK, and Switzerland)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract— to provide the Service you signed up for (Article 6(1)(b));
• Legitimate interests— for security monitoring, fraud prevention, and product improvement, balanced against your rights (Article 6(1)(f));
• Legal obligation— to comply with tax, accounting, and lawful access requests (Article 6(1)(c));
• Consent— for any future use we explicitly ask you to opt into (Article 6(1)(a)).

You can object to processing based on legitimate interests at any time by contacting support@snapgrove.ai.

6. Who we share information with (subprocessors)

We share personal information only with the following service providers, each under a written data processing agreement that restricts their use of your information to providing services to us:

We may also share information:

• With law enforcement or other authorities when required by law or to protect rights, property, or safety;
• With a successor entity in connection with a merger, acquisition, or sale of assets, with notice to you;
• With your consent, for any other purpose.

7. International data transfers

Your information is stored and processed in the United States by our subprocessors. Where you are located in a jurisdiction with a comprehensive privacy law (EEA, UK, Switzerland, Canada, California, and others), we rely on the following safeguards for cross-border transfers:

• The European Commission’s Standard Contractual Clauses, where applicable;
• The provider’s adherence to the EU-US Data Privacy Framework and UK Extension, where the provider is certified;
• Equivalent contractual protections for transfers to or from other regions.

You may request a copy of the relevant safeguards by emailing support@snapgrove.ai.

8. How long we keep your information

• Account data— for as long as your account is active, plus 30 days after closure to allow account recovery, then permanently deleted.
• Generated outputs and source content— retained for as long as your account is active. You may delete individual jobs at any time from the dashboard. After account closure, content is deleted within 30 days.
• Billing records— retained for 7 years to comply with Canadian tax and accounting law.
• Security logs— retained for up to 12 months for fraud and abuse detection, then deleted or anonymized.
• Customer support correspondence— retained for 24 months from your last interaction.

9. Your rights

Depending on where you live, you have some or all of the following rights:

• Access— request a copy of the personal information we hold about you;
• Correction— ask us to fix inaccurate information;
• Deletion— ask us to delete your information, subject to legal retention obligations;
• Portability— receive your information in a structured, machine-readable format;
• Restriction— ask us to limit how we use your information while we consider a request or objection;
• Objection— object to processing based on legitimate interests, including for direct marketing (we do not currently do direct marketing);
• Withdraw consent— where we rely on consent, withdraw it at any time, without affecting prior lawful processing;
• Complain— lodge a complaint with the privacy regulator in your country (in Canada: the Office of the Privacy Commissioner; in the EU: your national supervisory authority; in the UK: the ICO; in California: the California Privacy Protection Agency).

To exercise any right, email support@snapgrove.ai from the email address on your account. We respond within 30 days, free of charge, except where requests are manifestly unfounded or excessive.

10. California, Colorado, and other US state rights

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, or another US state with a comprehensive privacy law, you have the rights listed in Section 9. In addition:

• We do not“sell” or “share” personal information as those terms are defined in the California Consumer Privacy Act (CCPA) or analogous state laws.
• We do not use personal information for cross-context behavioral advertising.
• We do not knowingly collect personal information from children under 16, and we do not use any minor’s information for targeted advertising or profiling.

You may submit a verifiable consumer request by emailing support@snapgrove.ai. We may need to verify your identity by confirming control of your account email.

11. Security

We protect personal information with industry-standard safeguards, including encryption in transit (TLS 1.2+), encryption at rest (where supported by our subprocessors), one-way hashed passwords, role-based database access via Supabase Row Level Security, signed internal API calls between server functions, and a documented incident response process.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and, where required, the relevant regulator within the timelines required by applicable law (72 hours under the GDPR, “without unreasonable delay” under PIPEDA).

12. Children

The Service is intended for adults aged 18 and over. We do not knowingly collect personal information from children under 16. If you believe a child has provided personal information to us, contact support@snapgrove.ai and we will delete it.

13. Automated decision-making

The Service uses large language models to generate content and to flag potential compliance issues. These checks are advisory only — a human (you) reviews and decides whether to use any output. We do not make any automated decision with legal or similarly significant effect about you (no automated account terminations, no automated credit decisions, no automated employment decisions).

14. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email and by in-product notice at least 14 days before they take effect, except where a shorter period is required by law. The most current version is always at cast.snapgrove.ai/legal/privacy.

15. Contact

For any privacy question, request, or complaint, contact:

Snapgrove Cast
2800977 Alberta Inc.
Alberta, Canada
support@snapgrove.ai

If you are in the EEA or UK and we have not resolved your concern, you may also contact your national supervisory authority. We do not currently have an EU representative; if you are in the EU and need one for a specific matter, contact us and we will respond accordingly.