Privacy Policy
Privacy Policy
Last updated: 3 August 2026
1. Data controller
The controller under the General Data Protection Regulation (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2) is:
Conaprojekt, Luka Godnič s.p.
Registered seat: Trstenik 74, 4204 Golnik, Slovenia
Email: info@conasnap.com
Website: conasnap.com
We have not appointed a Data Protection Officer (DPO), as we are not legally required to do so. Please direct privacy questions to the email above.
2. What we collect
We only collect personal data that is necessary to provide and improve the Service and to comply with our legal obligations. Depending on how you use ConaSnap, we may collect:
- Contact data: name, email, company name — when you provide them voluntarily.
- Subscription and billing data: when you subscribe; payment is processed by Stripe. We do not store card numbers. For businesses we collect billing details including the VAT ID.
- Service content: if you use the app, we process voice recordings and their transcriptions, the content and photos of site reports, the approximate location at the time a report is created (solely to retrieve weather information relevant to the construction site), and report recipients.
- Technical data: IP address, browser type, visit time and — with consent only — anonymised analytics.
The Service is not intended for persons under 18 years of age.
3. Legal basis and purposes
We process personal data for the purposes and on the legal bases set out below (Art. 6 GDPR):
Overview by purpose
| Purpose | Legal basis |
|---|---|
| User account and providing the Service | Contract — Art. 6(1)(b) |
| Payments and subscriptions | Contract — Art. 6(1)(b) |
| Accounting and tax records | Legal obligation — Art. 6(1)(c) |
| Security, abuse prevention and improvements | Legitimate interest — Art. 6(1)(f) |
| Analytics | Consent — Art. 6(1)(a) |
| Marketing and optional notifications | Consent — Art. 6(1)(a) |
4. Retention
- Contact data: 12 months from last contact.
- Subscription / contract data: 10 years (accounting law).
- Service content (reports, recordings, transcripts, photographs): for as long as necessary to provide the Service.
- Technical logs: 30 days.
After the subscription ends, service content is deleted or anonymised within a reasonable period, unless a longer retention period is required by law or agreed in a Data Processing Agreement (DPA).
5. Automated decision-making
ConaSnap does not make decisions producing legal or similarly significant effects concerning individuals solely by automated means within the meaning of Article 22 GDPR. Automated processing (transcription, structuring and translation) only produces a draft report, which the user reviews and confirms before it is used.
6. Your rights
Under Art. 15–22 GDPR you have the right to access, rectification, erasure, restriction, portability, objection and withdrawal of consent.
Exercise these by emailing info@conasnap.com; we reply within 30 days.
To delete your account and the associated personal data, see the Account & Data Deletion page.
You also have the right to lodge a complaint with the supervisory authority — the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana (www.ip-rs.si).
7. Who we share data with
We share data with trusted processors who help us run the service:
- Hetzner Online GmbH (Germany) — server and automation hosting.
- NeoServ d.o.o. (Slovenia) — billing and the consent log.
- Supabase Inc. (USA) — database and authentication; data hosted in Frankfurt, Germany (EU).
- Stripe Inc. (USA/EU) — payment processing and tax calculation.
- Resend (USA) — sending reports and authentication emails (e.g. password-reset codes) by email.
- OpenAI (USA) — speech transcription.
- Anthropic PBC (USA) — structuring and translation of report content.
- OpenWeatherMap — weather data.
- Google Ireland Limited (Ireland) — analytics (Google Analytics), consent only; processing may also take place at Google LLC (USA).
- Google Cloud EMEA Limited (Ireland) — business mailbox (support and data subject requests).
All processors are bound by GDPR-compliant agreements. Where personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards in accordance with Articles 44–49 GDPR, including the European Commission's Standard Contractual Clauses (SCCs) or an applicable European Commission adequacy decision (such as the EU–US Data Privacy Framework), where appropriate.
8. Data Processing Agreement (DPA)
If you use the Service as a controller of personal data (for example, a construction company including data about its employees or third parties in reports), a Data Processing Agreement (DPA) under Article 28 GDPR is available on request or as part of our commercial agreement.
You are responsible for the lawful collection of personal data you upload to the Service (for example, photographs of individuals or voice recordings), including ensuring an appropriate legal basis where one is required.
9. Security
- Encryption in transit (TLS) for all communications.
- Per-organisation data isolation (row-level security at the database).
- Access limited to authorised people, with two-factor authentication for internal systems.
- Regular server and application updates.
- Regular backups and disaster-recovery procedures.
10. Cookies
The site uses cookies and similar technologies. Non-essential cookies are only placed after you have given your consent. See the Cookie Policy for details.
11. Changes
We may update this policy from time to time. For material changes we will notify you on the website or by email. The last-updated date is shown at the top.
12. Contact
Email: info@conasnap.com
Registered seat: Trstenik 74, 4204 Golnik, Slovenia