LEGAL DRAFT

Privacy Policy

Version 2026-09-30-v2 · Last updated 30 September 2026

Who handles your data

[BUSINESS LEGAL NAME], registration number [REGISTRATION NUMBER], operates Snagit. This draft explains our current practices; it does not claim legal compliance.

What we collect

For owners and customers we collect name, phone number, email, delivery address, optional vehicle registration, account and sticker settings, order details, verification records, and alert history. For scanners we record scan time, selected reason, and hashed signals derived from IP address, device and browser information. Vehicle SOS also records the scanner's verified number. The scan flow does not request or store precise location.

Why we use it

We use data to activate and operate stickers, send alerts and service messages, deliver and support orders, verify access, prevent abuse and fraud, respond to customers, and maintain accounting and security records.

Affiliate and payout information

If you join the affiliate program, we store your display name, referral code, link activity, attributed orders, commission and withdrawal history, program acceptance, and payout details. Affiliates see only a buyer's first initial in their activity feed. Bank account numbers are used for payouts, are masked in the affiliate portal and withdrawal snapshots, and are available in full only to authorised administrators who process payments.

Private and Public modes

In Private mode the owner's number stays hidden during ordinary alerts. For vehicle tags, the owner can separately enable Emergency SOS; when enabled, a scanner who verifies their own mobile number can see the owner's number, and the scanner's verified number is recorded and shared with the owner. The owner can turn SOS off for each tag at any time. In Public mode the owner has chosen to display their number to anyone who scans. Off mode returns an inactive notice without owner or item details. We do not sell personal data.

Service providers and disclosures

We use Text.lk for verification and private-alert SMS, Notify.lk for customer order and shipping SMS, Koombiyo for courier delivery, PayHere for online payments where enabled, Resend for transactional email, Vercel for website hosting, Supabase for database and backend services, and Meta Pixel only on Google Review Stand product, checkout, and related order pages. WhatsApp may be used when a customer chooses to contact us. Our WhatsApp sales assistant uses Meta’s WhatsApp Cloud API and OpenAI to understand messages and voice notes and help with purchases. Relevant conversation content and order details are processed for this purpose. You can ask for a human or send STOP to stop WhatsApp messages. Conversation history and webhook payloads are retained for up to 90 days by Snagit; necessary order and accounting records follow the separate retention periods below. We share only what is needed for each service.

Processing outside Sri Lanka

Some data is hosted or processed outside Sri Lanka. The current Supabase project uses the ap-southeast-1 region in Singapore, and Vercel and other providers may process data in additional countries under their service arrangements.

Retention

Hashed scanner IP and device fields are anonymised after 12 months. Account data is kept until the owner asks for deletion, subject to safety and legal retention needs. Order records are kept as needed for accounting; when an account deletion is approved, unrelated personal fields are anonymised while minimal accounting records are retained.

Your requests

You may request access, correction, export, or deletion by emailing hello@snagit.ink or messaging +94 76 540 2461. We aim to acknowledge a request within 7 days and complete it within 30 days, or explain why more time or limited retention is required.

Marketing and service messages

Marketing messages are sent only with consent and include an easy opt-out. Essential alerts, verification codes, order updates, security notices, and service or terms changes are service messages and are handled separately.

Sri Lanka's data protection law

Sri Lanka's Personal Data Protection Act No. 9 of 2022, as amended, is being brought into operation in stages. Under the official July 2026 commencement order, key operational provisions are scheduled to begin on 1 January 2027. This policy is a factual service notice and not a claim that Snagit is compliant; legal review and operational readiness are required.

Security and changes

We use access controls, encrypted connections, and server-side secrets, but no online service is risk-free. Updates will be published with a new version and date.

Contact

Email hello@snagit.ink, WhatsApp +94 76 540 2461, or write to 550/06/C, 9th Lane, Janapada Street, Daluwakotuwa, Kochchikade, Sri Lanka.