Privacy Policy

Last updated: 16 August 2026

This Privacy Policy explains how Snapraven (“we”, “us”, or “our”) processes personal data when you use our website, dashboard, website-audit API, reports, and related services (the “Service”). Snapraven is a service operated by Arif Setyo Wibowo, an individual business operator based in Indonesia. Arif Setyo Wibowo, operating under the Snapraven brand, acts as the controller of the account, billing, usage, and service-administration data described below. Contact us at [email protected].

1. Data we collect

Data you provide

• Account data: Google account identifier, verified email address, display name, profile image, and account role.
• Audit inputs: submitted URL, optional report label, optional agency name, logo URL, accent colour, and scanner/API key-related information.
• Support and abuse data: messages, attachments, contact information, and other information you send when requesting support or reporting misuse.
• Billing data: plan, subscription status, customer and subscription identifiers, and transaction-related metadata received from our payment provider. We do not receive or store complete payment-card details.

Data generated when you use the Service

• Audit data: audit status and timestamps, final score, deterministic findings, selectors and technical details, error messages, and a full-page image used as report evidence.
• Usage records: scanner key identifier, endpoint or operation, submitted URL, timestamp, usage amount, and quota period.
• Technical and security data: IP address, request headers, user agent, timestamps, diagnostic logs, and security or rate-limit events may be processed by our application, hosting provider, proxy, or security services.
• Local browser storage: the dashboard stores a session token and scanner key in your browser’s local storage so you remain signed in and can open your reports. Do not use the dashboard on an untrusted or shared device.

Report-preview URLs may place the scanner key in the URL query string. Such URLs can appear in browser history, server logs, or a recipient’s device if shared. Treat them as secret, share downloaded report files instead, and rotate the key if a key-bearing link is exposed.

Data from target webpages

When you submit a URL, our automated browser accesses the public page and may process content and technical information present there, including text, resource URLs, DOM selectors, console messages, page metadata, and visible page content included in report evidence. A target page may contain personal data. You are responsible for having authority or another lawful basis to submit and process that page.

2. Why and on what basis we process data

We process data to:

• create and secure accounts and authenticate users;
• run requested audits and generate, store, and deliver findings and reports;
• calculate usage, enforce quotas, process subscriptions, and prevent fraud;
• troubleshoot, provide support, maintain reliability, and improve checks;
• enforce our Terms and AUP and investigate security or abuse reports;
• comply with law, lawful requests, and record-keeping obligations; and
• communicate material service, billing, security, or policy notices.

Depending on the context and applicable law, our legal bases include performing our contract with you, taking steps at your request, our legitimate interests in operating and securing the Service, compliance with legal obligations, and consent where consent is required. We do not use audit findings to make decisions that produce legal or similarly significant effects about individuals.

3. How we share data

We do not sell personal data. We may disclose relevant data to:

• Google, for sign-in and identity verification;
• LemonSqueezy or our current merchant/payment provider, for checkout, subscription administration, tax handling, fraud prevention, and payment;
• hosting, database, object-storage, network, and security providers, which process data to run and protect the Service;
• professional advisers and transaction counterparties, subject to appropriate confidentiality obligations; and
• authorities or other parties when required by law or reasonably necessary to protect rights, safety, users, third parties, or the Service.

These providers may process data in countries other than yours under their own legal obligations and our applicable contractual arrangements.

4. Retention

We retain data only for as long as reasonably needed for the purposes described above, taking account of account status, operational needs, disputes, abuse and security prevention, backups, and legal, tax, and accounting requirements.

• Account and subscription records are generally retained while the account is active and afterward where needed for legal or legitimate business purposes.
• Audit URLs, findings, and report evidence are retained to provide audit history until deleted following a valid request, account closure, or a future product retention rule communicated to you.
• Usage and security logs are retained as needed for quotas, billing, support, fraud prevention, and enforcement, then deleted or de-identified when no longer reasonably needed.
• Backup copies may remain for a limited period after deletion and are isolated from ordinary use until overwritten, unless preservation is legally required.

5. Your choices and rights

Depending on applicable law, you may have rights to receive information about processing; access or obtain a copy of your personal data; correct inaccurate data; request deletion; withdraw consent; object to or restrict certain processing; and receive portable data. You may also complain to a competent data-protection authority or seek remedies available by law.

Submit a request to [email protected] from the email associated with your account. We may verify identity and authority before acting. Rights may be limited where an exception applies, including legal retention, security, fraud-prevention, or another person’s rights. Authorized requests concerning personal data appearing in a scanned target page may be sent to [email protected] with the report or URL involved.

6. Security

We use reasonable administrative, technical, and organizational safeguards, including transport encryption, access controls, authentication, encrypted or hashed credentials where applicable, URL safety controls, and restricted storage access. No system is completely secure. You are responsible for keeping your login and scanner key confidential and for promptly reporting suspected compromise.

If a personal-data breach occurs, we will investigate and provide notifications to affected persons and authorities when required by applicable law.

7. International processing

Our providers may process data outside Indonesia or your country. Where applicable law requires safeguards for an international transfer, we will use an available lawful transfer mechanism or other required protection.

8. Children

The Service is intended for business users and is not directed to children. You must be at least 18 or the age of legal majority to create an account. We do not knowingly collect account data from children. Contact us if you believe a child has created an account.

9. Third-party websites and services

The Service accesses URLs selected by users and links to third-party services. Their privacy practices are governed by their own notices. This Policy does not cover data processing independently controlled by a target website, Google, LemonSqueezy, or another third party.

10. Changes to this Policy

We may update this Policy to reflect changes to the Service, providers, or law. We will update the date above and provide reasonable notice of material changes.

11. Contact

Controller and operator: Arif Setyo Wibowo, Indonesia

Privacy and data-rights requests: [email protected]

Target-page privacy or abuse reports: [email protected]