Privacy Policy

In short: We collect only what we need to run the platform, we never sell your data, and we give you full control over your personal data.

This Privacy Policy describes how Squad AI Inc ("we", "us", "our"), with development services by Gliesereum Ukraine LLC, collects, uses, and protects personal data when you use the Snaga platform, APIs, and related services (the "Platform").

We comply with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), the EU AI Act (Regulation (EU) 2024/1689), the California Consumer Privacy Act (CCPA/CPRA), and other applicable data protection laws.

1. Data Controller

In short: Squad AI Inc decides how your data is used. Gliesereum Ukraine LLC helps us build and run the platform.

Squad AI Inc (United States) is the data controller for personal data processed through the Platform. Gliesereum Ukraine LLC (Ukraine) acts as a data processor, providing development and operational services under a contractual data processing agreement.

Contact: privacy@snaga.ai

2. Data We Collect

In short: We collect your account details, how you use the platform, and the content you create — nothing more.

2.1 Account Data

When you register or sign in, we collect:

Email address and display name;
Authentication tokens (JWT, OAuth) — we never store passwords directly;
Organization and tenant information;
Billing and subscription details (if applicable).

2.2 Usage Data

We automatically collect:

IP address, browser type, and device information;
Pages visited, features used, and interaction patterns;
API request metadata (endpoints, timestamps, response codes);
Agent run metrics (duration, token counts, cost — never prompt content).

2.3 Agent and Workspace Data

When you use the Platform, we process:

Agent configurations (system prompts, tool definitions, model settings);
Session and conversation data (messages, tool call inputs and outputs);
Knowledge base files you upload to workspaces;
Run traces, logs, and evaluation results.

2.4 Data Processed by Your Agents

Your AI agents may process personal data belonging to third parties (your end users, customers, etc.). In this scenario, you are the data controller for that data, and we act as a data processor on your behalf. You are responsible for having a lawful basis for processing and for respecting data subject rights. See our Data Processing Agreement for details.

3. Legal Basis for Processing (GDPR, Article 6)

In short: We process your data because we need it to run the service, keep it secure, follow the law, or because you gave us consent.

We process personal data based on:

Contract performance (Art. 6(1)(b)) — to provide and deliver the Platform services you signed up for;
Legitimate interest (Art. 6(1)(f)) — for security, fraud prevention, analytics, and service improvement;
Legal obligation (Art. 6(1)(c)) — to comply with applicable laws;
Consent (Art. 6(1)(a)) — for optional features, marketing communications, and non-essential cookies.

4. How We Use Your Data

We use your data to:

Provide, maintain, and improve the Platform;
Authenticate users and manage access control;
Process agent runs and route requests to LLM providers;
Monitor system health, security, and abuse prevention;
Generate anonymized, aggregated analytics;
Send transactional notifications (run failures, billing alerts);
Comply with legal obligations and enforce our Terms of Use.

We never use your content, prompts, or agent outputs to train AI models. Your data is processed solely to deliver the Platform services.

5. Third-Party LLM Providers

In short: when your agents run, prompts go to the model provider configured for the run. Unless you supply your own credentials, that is the platform's own. We do not keep copies.

When your agents execute runs, prompts and inputs are sent to the model provider configured for that run — the platform's own, or one you configure with your own credentials. This policy names the category rather than the vendors, because the set changes without the policy changing: the current sub-processors, including the model provider in use, are listed in section 6 of our Data Processing Agreement. We act as a technical intermediary and do not retain copies of prompts or model responses beyond the session or run scope.

Each LLM provider has its own privacy policy and data processing terms. You are responsible for reviewing and accepting those terms. We recommend:

Enabling data opt-out or zero-retention options offered by your LLM provider;
Avoiding sending sensitive personal data (health, financial, biometric) to LLM providers without appropriate safeguards;
Reviewing GDPR adequacy decisions or standard contractual clauses for cross-border transfers.

6. AI-Specific Transparency (EU AI Act)

In short: We are transparent about how AI works on our platform and what your responsibilities are as someone deploying AI agents.

In accordance with the EU AI Act (Regulation (EU) 2024/1689):

System purpose: The Platform enables building and deploying AI agents for business automation, customer interaction, and data processing.
Automated decision-making: Agents may make or assist with decisions. If you deploy agents that make significant decisions affecting individuals, you must implement human oversight mechanisms.
Training data: We do not train AI models. Models are provided by third-party LLM providers.
Logging and accountability: The Platform maintains run traces, audit logs, and feed events for transparency and accountability.
Risk classification: You are responsible for assessing whether your specific agent deployment falls under high-risk categories (Annex III) and ensuring compliance accordingly.

7. Data Sharing and Recipients

In short: We share data only with the partners needed to run the service. We never sell your data to anyone.

We share personal data only with:

Gliesereum Ukraine LLC — development and operational support (data processor, bound by a DPA with EU standard contractual clauses);
LLM providers — as directed by you through your agent configurations;
Infrastructure providers — cloud hosting, CDN, and database services (sub-processors, each bound by a DPA);
Law enforcement — only when required by a valid legal process.

We do not sell personal data. We do not share data with data brokers. Where you consent to optional cookies, Google receives analytics and ad-measurement data as our processor — see the Cookie Policy.

8. International Data Transfers

In short: Your data may be processed in the US and Ukraine. We use standard legal safeguards to protect it during transfer.

Data may be transferred to and processed in the United States and Ukraine. For transfers from the EEA/UK, we rely on:

EU-US Data Privacy Framework (where applicable);
Standard Contractual Clauses (SCCs) approved by the European Commission;
Supplementary technical and organizational measures (encryption in transit and at rest, access controls, pseudonymization).

9. Data Retention

In short: your conversations stay until you delete them. The machine-level record of a run — the step-by-step event log — goes on its own schedule, and the periods below are the ones this deployment actually runs.

Account data: retained while your account is active and for 90 days after deletion;
Conversations and their history: kept until you delete them. An inactive session is marked as expired, which stops it being resumed; the conversation itself is not deleted by that;
Run event logs — the step-by-step machine record behind a run: once a run has finished, its events are deleted about a week later. Events of a run that never finished, and anything the sweep has not reached, expire 90 days after they were written. Streaming fragments, which are the bulk of the volume and carry the same text as the answer, expire within a day. Tenants under a legal hold are skipped;
Feed events: retained for 30 days (automatically deleted via TTL);
Audit logs: retained for 12 months for security and compliance;
Workspace files: retained until you delete them or your account is terminated — no time limit is applied to them;
Billing records: retained as required by tax and accounting laws (typically 7 years).

10. Your Rights

In short: You have full control over your personal data. You can access, correct, delete, or export it at any time.

10.1 GDPR Rights (EEA/UK Residents)

Under GDPR, you have the right to:

Access your personal data (Art. 15) — request a copy of everything we hold about you;
Rectify inaccurate data (Art. 16) — correct any errors in your personal data;
Erase your data (Art. 17) — ask us to delete your personal data ("right to be forgotten");
Restrict processing (Art. 18) — limit how we use your data in certain circumstances;
Data portability (Art. 20) — receive your data in a structured, machine-readable format and transfer it to another service;
Object to processing (Art. 21) — opt out of processing based on our legitimate interest;
Not be subject to automated decisions (Art. 22) — refuse decisions made solely by automated processing that have legal or significant effects on you;
Withdraw consent at any time (Art. 7(3)) — without affecting prior processing;
Lodge a complaint with your local data protection supervisory authority.

10.2 CCPA/CPRA Rights (California Residents)

Under California law, you have the right to:

Know what personal information we collect, the sources, the business purpose, and with whom we share it;
Delete your personal information from our systems;
Opt out of sharing for cross-context behavioural advertising. We do not sell personal information. We do "share" it in the CPRA sense when you accept optional cookies, because Google Ads measurement can recognise your browser across other sites. Three ways to opt out, any of which is enough: choose "Essential only" in the cookie banner, use Change your cookie preferences at any time, or turn on Global Privacy Control in your browser — we honour a GPC signal automatically and it overrides an earlier acceptance;
Non-discrimination — we will never penalize you for exercising your privacy rights;
Correct inaccurate personal information;
Limit use of sensitive personal information to what is necessary for the service.

10.3 How to Exercise Your Rights

To close a Snaga account or request deletion of specific personal data, see delete your Snaga account or data. The instructions include a way to send a request without the app.

Email us at privacy@snaga.ai with your request. We will respond within 30 days (GDPR) or 45 days (CCPA). We may ask you to verify your identity before processing your request.

You can also reach us at privacy@snaga.ai.

11. Security

In short: We use industry-standard encryption, access controls, and monitoring to keep your data safe.

We implement appropriate technical and organizational measures, including:

TLS 1.2 or newer for every connection, and TLS 1.3 wherever your browser or client supports it;
AES-256-GCM encryption, applied before storage, for the secrets we have to be able to read back — agents' private keys and two-factor secrets;
Role-based access control (RBAC) with principle of least privilege;
API key hashing — keys are never stored in plaintext;
Audit logging of all administrative and security-relevant actions;
Regular security assessments and dependency scanning;
Tenant isolation — your data is logically separated from other tenants.

The machines themselves are run by our hosting provider, which is responsible for the physical security of the servers and for the disks underneath them. All data on disk is therefore covered by the provider's own storage protection; we do not hold a customer-managed disk key.

12. Cookies and Tracking

In short: We use a few essential cookies — to keep you signed in, to mark an open session, to remember which company you are in, and to remember your cookie choice. Analytics and ad measurement load only if you accept them.

The Platform uses essential cookies for authentication and the signed-in shell (snaga_auth_token, snaga_session,uarp_active_tenant) and one that remembers your cookie choice (snaga_cookie_consent_v2). The token is HttpOnly; the others carry no secret. If you choose "Accept all" in the cookie banner, we also load Google Tag Manager, which carries Google Analytics 4 and Google Ads measurement. Those set third-party cookies that can recognise your browser across Google's network. Declining, or choosing "Essential only", loads none of it — no analytics or advertising request is made to Google. Signing in with Google is a separate matter: that contacts Google because you chose it. We do not serve ads on the Platform.

For full details, see our Cookie Policy.

13. Children's Privacy

The Platform is not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a minor, we will delete it promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via the Platform or email at least 30 days before they take effect. The "Last updated" date at the top always reflects the most recent revision.

15. Data Protection Officer

For data protection inquiries, contact our Data Protection Officer at: privacy@snaga.ai

16. Snaga Search

In short: We do not record the text of your searches. We keep a usage record that lets us bill you and keep the service working.

This section applies when you search at search.snaga.ai or through the search API, including its MCP server and the endpoints written for Ollama's clients.

Queries. The text of a query is not recorded.

Usage records. For each request we keep the time, the API key (or, for the public page, the network address the request came from, which we use to apply the public limit), the address called, the number of results, the duration and the price. We use them to bill, to enforce rate limits and to keep the service working.

Keys. A key is requested by e-mail; we keep that correspondence to issue and support the key.

The crawler. SnagaBot identifies itself in every request. What it fetches, the rules it follows and how to block it are described at snaga.ai/bot.

Legal basis. Performance of a contract (Article 6(1)(b)) for keys and billing; our legitimate interests (Article 6(1)(f)) in rate limiting, security and keeping the service working.

Retention. Usage records are kept only as long as they are needed for billing, dispute resolution and abuse prevention. To ask for a copy or for deletion, write to privacy@snaga.ai.

17. Contact

Squad AI Inc (USA) — Data Controller
Gliesereum Ukraine LLC (UA) — Data Processor / Development
Email: privacy@snaga.ai