Privacy Policy
1. Who the controller is
Forsnaps AI - Soluções Tecnológicas, Unipessoal Lda (VAT no. 518932494), with registered office at Rua da Igreja Nº99, Varziela, 4650-722 Felgueiras, is the data controller for the personal data collected through the Forsnaps platform, available at forsnaps.com and in the Forsnaps mobile app for Android. For any data protection query, write to info@forsnaps.com.
When a customer company uses Forsnaps to manage its workers and sites, that company is the data controller for its workers' data, and Forsnaps acts as a processor.
2. What data we process and why
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email, company, NIF, phone, country (sign-up) | Creating and managing the account; service communications | Performance of the contract | For as long as the account exists, plus 12 months |
| Worker's professional and identification data (job role, contract, tax number (NIF), social security number, date of birth, address, emergency contact, absences, training, documents) | Human resources management by the customer company | Performance of the contract between the company and the worker | For the duration of the employment relationship, and the applicable statutory periods thereafter |
| Worker's bank details (IBAN and proof of account) | Reimbursement of expenses and payment of wages by the customer company | Performance of the contract between the company and the worker | For the duration of the employment relationship, and the applicable statutory periods thereafter |
| Health data (sickness absences and medical certificates, record of workplace accidents) | Management of absences and occupational safety by the customer company | Compliance with the employer's legal obligations under employment law | For the duration of the employment relationship, and the applicable statutory periods thereafter |
| Precise location (GPS) at the moment the worker clocks in on the mobile app | Confirm presence on site in the attendance record | Compliance with legal obligations to record working time, and the employer's legitimate interest | Together with the clock-in record, for the statutory retention periods of attendance records |
| Clock-in records, hours per site and phase | Attendance, site costing and invoicing | Legal obligation and performance of the contract | 5 years |
| Uploaded files (documents, photographs, expense receipts) | Provide the service requested by the customer | Performance of the contract | For as long as the account exists, or the period set by the customer |
| Conversations with the AI assistant and files attached to them | Respond to requests made to the assistant | Performance of the contract | Period set by the customer; by default, for as long as the account exists |
| Voice recordings (dictating messages to the assistant) | Transcribe the dictated message | Performance of the contract | Not stored: the recording is transcribed on the spot and discarded |
| Mailbox connected to the assistant (emails read and drafted at the user's request, access credentials) | Read, search and draft emails at the user's request | Consent: the connection is made by the user, who can disconnect it at any time | For as long as the mailbox is connected; credentials are stored encrypted |
| Inbox triage (optional): sender, subject, beginning of the text and arrival date of the most recent emails; for each email, a technical identifier, the category (“For today”, “Can wait” or “Noise”) and a short reason written by the assistant | Show first what needs a reply the same day, when the user switches on triage and opens the inbox | Consent: triage is switched on by the user themselves, in the inbox, and can be switched off at any time | The classification, for up to 30 days after each email arrives, or less if the user switches off triage or disconnects the mailbox, or if the account is deleted; the sender's address, the subject and the text are not stored |
| Technical logs (IP address, date, device and browser identification) | Security, abuse detection and fault diagnosis | Legitimate interest | 90 days |
| Billing data | Billing and tax obligations | Legal obligation | 10 years |
Creating an account or signing in with Google or Microsoft. If you use the «Continue with Google» or «Continue with Microsoft» button, we receive your name and email from that company and use them to create your account or to sign you in. We do not receive the password of your account with that company, and we do not send you a confirmation email, because that company has already confirmed the address.
Inbox triage. It is off by default. With triage switched on, whenever the user opens the assistant's inbox, and for as long as it is open, the most recent emails not yet sorted first go through automatic rules (mailing lists, automatic replies, bounce notices, emails already replied to and, in Outlook, the “Other” folder). Only those the rules cannot resolve go to the language model, which receives only the sender, the subject, the beginning of the text and how long ago each email arrived. Triage only reads the mailbox: it does not mark emails as read, move them or delete them. It counts towards the company's AI balance. Only the user can see the triage of their own mail; colleagues and company managers cannot see it.
3. Location in the mobile app
The mobile app only reads the location at the instant the worker taps the button to clock in. There is no continuous tracking, no background tracking and no tracking outside that moment. The permission is requested by the phone's operating system and can be refused or withdrawn at any time in the device settings.
The coordinates collected are attached to the clock-in record and are visible to the employer, which uses them to confirm presence on site. If the worker refuses the permission, they can still clock in, but the record is saved without a location. Location is not used for advertising, is not sold or shared with third parties, and is not combined with data from other apps.
4. Where the data is stored
Data is hosted and processed exclusively in data centres in the European Union. The AI assistant's replies, inbox triage and voice dictation transcription are carried out by European processors, on servers in the European Union, with no retention of requests once answered. There are no transfers of personal data outside the European Economic Area.
5. Processors
We use the following processors, all bound by contract to the same confidentiality and security obligations:
- Hosting and backups, in data centres in the European Union;
- Artificial intelligence model inference and voice transcription, on servers in the European Union, with no retention;
- Sending transactional email;
- Payment processing and issuing of invoices.
6. We do not train models on your data
Your account data, your conversations with the assistant and the files you upload are never used, by us or by our processors, to train, fine-tune or evaluate artificial intelligence models.
7. Your rights
You have the rights of access, rectification, erasure, restriction of processing, data portability and objection, under the General Data Protection Regulation. To exercise them, write to info@forsnaps.com; we reply within one month. If your data was entered by your employer, we forward the request to them, as they are the data controller. You may also lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese data protection authority.
To request deletion of the account and all associated data, simply write to the same address; the steps are at Delete the account.
8. Security
Encryption in transit and at rest, isolation per customer (each company has its own database), strong-password authentication with optional two-factor authentication, encrypted backups in the European Union, access logging and rate limiting of sign-in attempts.
9. Minors
The service is intended for professional use and is not directed at children under 16. We do not knowingly collect data from minors outside a legally permissible employment relationship.
10. Cookies
We use only cookies strictly necessary for the service to work, such as the session and form protection. We do not use advertising or third-party tracking cookies. Website visit statistics are collected in aggregate and without cookies.
11. Usage measurement
We measure use of the service to understand at which step people stop being able to use it — for example, how many create an account, how many go on to use the app and how many are stopped by one of our limits. This measurement covers the website, sign-up and also each customer's workspace.
For each step we record only the step itself, the plan, the date and time, the country and browser type (derived from the IP address and browser user agent, which are not stored), and a technical identifier of the workspace which, on its own, does not identify the customer or the user. Within the app we also record which screens are opened and when: only the area and the screen, never the record shown there or who opened it. We never record content, names, email addresses, tax numbers or any text written by the user. Measurement is carried out on our own servers, in the European Union, without third-party analytics services and without cookies. The legal basis is our legitimate interest in maintaining and improving the service, and the records are retained for 12 months. You may object via the contact given in section 13.
12. Changes to this policy
Material changes are notified by email 30 days in advance. The current version is always available at forsnaps.com/privacidade.
13. Contact
Forsnaps AI - Soluções Tecnológicas, Unipessoal Lda
Rua da Igreja Nº99, Varziela, 4650-722 Felgueiras
info@forsnaps.com