Privacy policy
Last updated: 8 October 2026
In short: we collect what we need to run StaleSnap for you: your account, the documentation and app addresses you configure, the demo credentials (stored encrypted), the screenshots and captures, and security logs. We do not sell data, we do not use advertising or analytics trackers, and payments are handled by Paddle.
1. Controller
The controller of your personal data is Mateo Castro Souto, a sole trader established in Spain and trading as NexArch, NIF 58021740P, Avenida Cristina 75, 4º B, 15100 Carballo (A Coruña), España. Contact for any privacy matter: support@stalesnap.com. We have not appointed a Data Protection Officer.
This policy covers this website and the StaleSnap service (the “Service”).
2. Data we collect
Account
- Your email address and whether it has been confirmed.
- Your password, stored only as a salted hash (we cannot read it).
- If you enable two-factor authentication: the authenticator key and your recovery codes.
Project configuration
- Project name, the URL of your documentation, the URL of your application, the screen paths you map, excluded paths, the check schedule and the email address that receives alerts.
- The sign-in details of the demo account you provide: sign-in page address, form selectors, username and password. The password is encrypted at rest with keys kept outside the database, is decrypted only right before a capture, every decryption is logged, and it is never shown back to you or written to logs.
- The capture settings (theme, time zone, locale, viewport and browser storage values). Values you mark as secret are encrypted in the same way as the password.
Screenshots, captures and results
- The images found in your documentation, with the page address and alternative text.
- Captures of your application's screens taken by our browser, the differences found, and the results of each check.
These images may show personal data if your documentation or demo account contains it. See section 9.
Billing
We do not receive or store your card or bank details. Paddle, our Merchant of Record, collects your payment and billing information at checkout. From Paddle we receive and store your Paddle customer and subscription IDs, the plan, the subscription status and the trial and billing-period dates. When you open the checkout we send Paddle your email address and your StaleSnap account ID.
Security and technical logs
- Security events such as sign-ins, failed sign-in attempts (including the email address entered), password and two-factor changes, changes to or decryption of stored credentials, and billing events, with the IP address and time.
- Error logs of the Service. IP addresses are also used, in memory, to limit the rate of requests.
Communications
Emails you send us, for example support requests.
3. Cookies
This website and the dashboard only use cookies that are strictly necessary: a session cookie that keeps you signed in (up to 12 hours of inactivity, or 14 days if you choose “remember me”), anti-forgery cookies that protect your requests, and, if you choose it when signing in with two-factor authentication, a cookie that remembers your device. We do not use analytics, advertising or third-party tracking cookies, and this website loads no third-party scripts. The Billing page of the dashboard loads Paddle's checkout script, which may set its own cookies as described in Paddle's privacy notice.
4. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Providing the Service: account, projects, discovery, captures, comparisons, dashboard and alert emails | Account, project configuration, screenshots and results | Performance of the contract (art. 6.1.b) |
| Account emails: confirming your address, password reset, security notices (password changed, account deleted), alerts | Email address | Performance of the contract (art. 6.1.b) |
| Subscriptions and billing through Paddle | Billing data received from Paddle, email, account ID | Performance of the contract (art. 6.1.b); legal obligations on record keeping (art. 6.1.c) |
| Security, abuse and fraud prevention, audit trail | Security logs, IP addresses | Legitimate interest in protecting the Service and our customers (art. 6.1.f) |
| Answering your requests and support | Communications | Performance of the contract (art. 6.1.b) or legitimate interest (art. 6.1.f) |
We do not send marketing emails, we do not sell personal data and we do not make decisions with legal or similarly significant effects based solely on automated processing.
5. Who receives data
- Hosting: Hetzner Online GmbH (Germany), which hosts our servers, database and file storage in the European Union (Germany), as our processor.
- Email delivery: Brevo (Sendinblue SAS, France), which sends account and alert emails, as our processor.
- Paddle (Paddle.com Market Limited), our reseller and Merchant of Record, which processes payment and billing data as an independent controller under its privacy notice.
- Public authorities, when we are legally required to share data.
Our capture browser connects to the documentation and application addresses you configure in order to download images and take captures; those sites receive the requests and, for your application, the demo sign-in details you provided.
6. International transfers
If a provider processes data outside the European Economic Area, we rely on an adequacy decision of the European Commission (for example, for the United Kingdom) or on the Commission's Standard Contractual Clauses.
7. How long we keep data
- Account and project data: while your account exists. Deleting a project deletes its configuration, stored credentials, screenshots, captures and results straight away.
- Check results, captures and difference images: 30 days. The latest result of each screenshot is kept while the screenshot is part of a project.
- Account deletion: you can delete your account yourself in the dashboard (Account → Delete account), after confirming your password (and your two-factor code, if you use it). Deletion is immediate, with no grace period, and cannot be undone: your projects, documentation screenshots, mappings, captures, difference images and check results, the stored demo-account credentials and capture secrets, your password, two-factor settings and recovery codes are erased, and every session is signed out. If you have a subscription, it is cancelled with Paddle first and you are not charged again; if Paddle cannot be reached, nothing is deleted and you can try again. We send one last email to confirm the deletion. You can also ask us at support@stalesnap.com; we then do the same without undue delay and at the latest within one month. What remains afterwards: security log entries (some of them include the email address entered, for example at sign-up or a failed sign-in) until they expire as described below, billing records kept by Paddle as Merchant of Record, and backups until they are overwritten.
- Backups: deleted data can remain in backups until they are overwritten, for at most 30 days.
- Security logs: kept for 12 months and then deleted.
- Billing records: the subscription details we receive from Paddle are deleted with your account. Invoices and payment records are kept by Paddle, the seller, and our own accounting records of Paddle's payouts for the periods required by Spanish tax and commercial law.
8. Security
Measures include: passwords stored as salted hashes; demo credentials and secret capture values encrypted with keys kept outside the database; strict separation between customer accounts; optional two-factor authentication; captures run in a separate browser service with no access to our database; images are only served to their owner after sign-in; and a security audit trail.
9. Data inside your documentation and application
When StaleSnap captures your application or downloads images from your documentation, any personal data that appears in them belongs to you as controller, and we process it on your behalf as a processor only to provide the Service. Please use a demo account with sample data. A data processing agreement is available on request.
10. Your rights
You can ask for access to your personal data, its rectification or erasure, restriction of processing, data portability, and object to processing based on legitimate interest. You can erase your account and its data yourself at any time from the dashboard (see section 7). For everything else, write to support@stalesnap.com; we may ask you to confirm your identity. You can also lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos) or with the supervisory authority of your country.
11. Changes
We will publish any changes on this page and, if they are significant, tell you by email.