GDPR Compliance Centre

Snpurl has been GDPR-compliant since May 10, 2026 the regulation effective date. We view GDPR not as a burden but as a framework for building trust with our European users.

Our engineering and product teams treat data protection by design (Article 25) as a core principle, not an afterthought.

We rely on the following lawful bases under Article 6 GDPR:

• Contract (Art 6(1)(b)): processing necessary to provide the service you subscribed to
• Legitimate interests (Art 6(1)(f)): security monitoring, fraud prevention, product analytics
• Legal obligation (Art 6(1)(c)): tax records, legal compliance
• Consent (Art 6(1)(a)): marketing communications you can withdraw any time

All user data is stored on Snpurl data center. We do not transfer personal data to the USA or other third countries except:

• Stripe (USA): covered by Standard Contractual Clauses (SCCs)
• Sentry (USA): error monitoring anonymised error traces only; covered by SCCs
• Postmark (USA): transactional email email address and metadata only; covered by SCCs

We conduct DPIAs (Article 35) for any new feature or processing activity that may result in high risk to data subjects. Our DPIA register is available to supervisory authorities upon request.

In the event of a personal data breach, Snpurl will:

• Notify the relevant supervisory authority within 72 hours (Article 33)
• Notify affected data subjects without undue delay if the breach poses a high risk (Article 34)
• Document the breach, its effects, and remediation steps
• Conduct a post-incident review within 14 days

If you are not satisfied with our response to a GDPR request or concern, you have the right to lodge a complaint with your local supervisory authority.

• EU: your national Data Protection Authority (find yours at edpb.europa.eu)
• UK: Information Commissioner Office (ICO) at ico.org.uk
• India: CERT-In and forthcoming PDPB Data Protection Board