Privacy Policy
Last updated 25 September 2026
This policy explains what personal data 360 Snap collects, why, how long we keep it and the rights you have under the UK GDPR and the Data Protection Act 2018. It covers people who create an account, and visitors to our website and to tours published with 360 Snap.
Who we are
360 Snap is run by Alisson, a sole trader based in the United Kingdom, who is the controller of your personal data. For anything privacy-related, including requests to see or delete your data, email alissonv@gmail.com.
What we collect and why
| Data | Why we use it | Lawful basis |
|---|---|---|
| Name, email address, password (stored only as a secure hash), or your Google sign-in | To create and secure your account and let you sign in | Contract |
| Sign-in sessions: date, IP address and browser type; when you were last active | To keep you signed in, protect accounts from misuse and limit repeated sign-in attempts | Contract; legitimate interests (security) |
| Your tours: names, texts, links to your photos and media, contact details you add to hotspots | To build, store and — when you publish — show your tours | Contract |
| Billing: Stripe customer ID, subscription status, invoice amounts and dates | To take payment and keep accounting records. Card details are handled by Stripe and never reach us. | Contract; legal obligation (tax records) |
| Analytics (only if you accept the analytics cookie): a random visitor ID, pages visited, the site you came from, your country | To understand how many people visit and sign up, so we can improve the service. We don't store your IP address for this. | Consent |
| Emails you send us | To answer you | Legitimate interests |
We don't sell your data, use it for advertising, or make automated decisions about you.
Published tours are public
When you publish a tour, everything in it — photos, texts, links and any contact details you add — can be seen by anyone with the link, and may be found by search engines. You're responsible for having permission to publish the photos and any personal information in them (see our Terms). If you see a tour that includes you or your property without permission, email alissonv@gmail.com and we'll look into it promptly.
Your photos stay on your own hosting
360 Snap doesn't store your photos, videos or documents: tours contain links to files you host elsewhere (for example on your website or a cloud service). When someone views a tour, their browser loads those files directly from that host, which will see the viewer's IP address under its own privacy policy. Embedded YouTube or Vimeo videos work the same way.
Who we share data with
We use these service providers (processors), bound by contracts that protect your data:
- Vercel — website hosting (United States)
- Neon — database hosting on Amazon Web Services (United States)
- Stripe — payments and invoicing
- Brevo — account emails such as password resets (European Union)
Some of these providers are in the United States. Transfers rely on the UK–US data bridge where the provider is certified, or on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. We may also disclose data where the law requires it.
How long we keep it
- Account and tours: until you delete your account (you can do this at any time).
- Sign-in sessions: expire after 30 days.
- Analytics page views: 13 months.
- Payment records: six years after the end of the tax year, as UK tax law requires — after account deletion they are kept without your name or email.
- Deleted data can remain in encrypted database backups for up to 30 days before it is overwritten.
Cookies
| Name | Purpose | Duration |
|---|---|---|
| snap360.session_token | Keeps you signed in (strictly necessary) | 30 days |
| snap360.session_data | Speeds up sign-in checks (strictly necessary) | 5 minutes |
| snap_vid | Analytics — only set if you accept | 1 year |
Your cookie choice itself is remembered in your browser's local storage. You can change it at any time:
Your rights
You have the right to:
- access your data and get a copy of it;
- correct inaccurate data;
- delete your data ("right to be forgotten");
- restrict or object to how we use it;
- data portability — receive it in a machine-readable format;
- withdraw consent (for analytics) at any time.
Signed-in users can download all their data and delete their account themselves from Your account. For anything else, email alissonv@gmail.com. We'll reply within one month and may ask you to confirm your identity. It's free.
If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint or 0303 123 1113. We'd appreciate the chance to put things right first.
Security
Connections are encrypted (HTTPS), passwords are hashed, sign-in attempts are rate-limited, and each account can only reach its own tours. No system is perfectly secure; if a breach ever put your data at risk we would tell you and the ICO as the law requires.
Children
360 Snap is for adults. You must be 18 or over to create an account.
Changes
We'll update this page if our practices change and, for significant changes, let account holders know by email.