Privacy Policy

Snova AB (“Snova”, “we”, “us”) is the data controller responsible for the personal data described in this policy.

• Company: Snova AB, company registration number [ORG-NR]
• Registered address: [STREET ADDRESS], [POSTAL CODE] [CITY], Sweden
• Contact: support@trysnova.com
• Website: www.trysnova.com

We are established in Sweden, so our processing of personal data is governed by the EU General Data Protection Regulation (GDPR) and Swedish data protection law.

This policy covers our website at www.trysnova.com, the Snova application, and the shareable client reports we generate. It applies to visitors to our website, people who create a Snova account, and people whose details appear in a customer’s workspace.

Where a customer uses Snova to process data about their own end users, the customer is the data controller and Snova acts as a data processor on their instructions.

When you visit our website

Our hosting provider processes standard server and connection data (IP address, browser type, pages requested, timestamps) to deliver and secure the site. We also use Google Tag Manager for analytics — see Section 9.

When you create an account

• Name, email address and password (stored only as a salted hash — we never store your password in readable form).
• Optional profile details you choose to add, such as display name, avatar, phone number and bio.
• Organisation and team membership, including invitations you send or accept.

When you use the product

• The websites, domains and brand profiles you add, together with the keywords, competitors, topics and context documents you configure.
• Content you generate or edit in Snova — articles, outlines, calendars, briefs — and the events attached to them, such as when a piece was published.
• The text of pages already published on your website. So we can measure and improve content you wrote before using Snova, we retrieve those pages the same way a search engine would and store their text alongside the rest of your library.
• Performance and visibility data we retrieve on your behalf from Google Search Console and third-party SEO data providers.
• Publicly available information about other websites, including your competitors and sites that link to them, used to produce competitor analysis and link-building suggestions. This is business information about organisations, retrieved from third-party SEO data providers, and we do not seek out personal contact details.
• Credentials you supply to connect a CMS (for example WordPress, Webflow or Framer) or Google Search Console. These are always encrypted before storage — see Section 12.
• Prompts, chat messages and feedback you submit to our AI features.
• Product usage and diagnostic logs used to operate, debug and improve the service.

When you pay for a subscription

Billing is handled by our payment providers. We receive subscription status, plan and invoice metadata. We never receive or store your full card number — card details are collected directly by Stripe.

When you contact us

If you email us, book a demo or use in-app support, we process the contact details and the contents of your message so we can respond.

• To provide, operate and secure the Snova platform and your account.
• To generate content, audits, keyword research, performance reports and AI-visibility insights that you request.
• To produce prioritised recommendations, a growth roadmap and link-building suggestions for your site, and to draft outreach messages for you to review and send yourself. We do not send outreach on your behalf.
• To connect and synchronise the third-party services you authorise, such as Google Search Console or your CMS.
• To process payments, manage subscriptions and prevent abuse of usage limits.
• To provide customer support and respond to your enquiries.
• To send service messages (for example a report being ready) and, where you have opted in, product updates.
• To improve reliability and product quality using aggregated and diagnostic information.
• To comply with legal obligations, such as accounting and tax requirements.

Snova offers an optional integration with Google Search Console so that your reports can show measured search performance instead of estimates. This section describes exactly how we access, use, store, share, protect and delete Google user data. Connecting Google is entirely optional and the rest of Snova works without it.

What we request

When you connect Google Search Console, we ask for the following OAuth scopes and nothing more:

• openid and email — to identify which Google account was connected, so you can see it in your settings and reconnect the right account later.
• https://www.googleapis.com/auth/webmasters.readonly — read-only access to your Search Console properties and their search performance data.

What we access

• The list of Search Console properties available to the connected account, so you can select which one belongs to the site you are tracking.
• The email address of the connected Google account.
• Search Analytics data for the selected property: clicks, impressions, click-through rate and average position, broken down by page, search query and date.

The scope is read-only. Snova never writes to, modifies, or submits anything to your Search Console property.

How we use it

Google Search Console data is used solely to provide the features you asked for: showing how your published articles perform in Google Search, attributing clicks and impressions to individual articles, identifying the keywords your content ranks for, and producing the client reports you generate and share.

How we store and protect it

• Your Google refresh token is encrypted with AES-256-GCM before it is written to our database. It is never stored in readable form.
• Short-lived access tokens are requested on demand and held only in memory — they are never written to our database.
• Retrieved performance data is cached and stored in our database so reports load quickly and historical trends remain accurate over time.
• All data is transmitted over TLS and access is restricted to the systems and personnel that need it to operate the service.

How we share it

We do not sell Google user data and we do not share it with third parties for their own purposes. Search Console figures appear in the client reports you choose to create, and if you share a report link, the performance figures in it are visible to anyone who has that link — see Section 10.

How to disconnect and delete it

You can disconnect Google Search Console at any time from Settings → Domains in Snova, which deletes the stored refresh token and stops all further access. You can also revoke Snova’s access directly from your Google Account permissions page. On disconnection we delete the stored credential; performance data already used in reports you generated is deleted when you delete those reports or your account.

Snova uses third-party large language models to research topics, draft articles and analyse how brands appear in AI assistants. When you use these features, the inputs you provide — such as your brand profile, keywords, topic briefs and prompts — are sent to the AI provider that serves the request so it can generate a response.

We use business or enterprise API tiers, under which providers act as processors on our behalf and do not use the content of API requests to train their models. As stated in Section 6, Google Search Console data is never included in AI training.

We rely on the providers below to run Snova. Each processes personal data only on our instructions and under a data processing agreement.

We may update this list as our infrastructure evolves. Material changes will be reflected here.

We use two categories of cookies:

• Strictly necessary. Session and authentication cookies that keep you signed in and protect against cross-site request forgery. The service cannot function without these.
• Analytics. We load Google Tag Manager on our public website to understand how visitors find and use it. This may set cookies and process your IP address and browsing behaviour.

You can block or delete cookies through your browser settings, and you can opt out of Google Analytics using the Google Analytics opt-out browser add-on. Blocking strictly necessary cookies will prevent you from signing in.

We do not sell your personal data. We disclose data only as follows:

• To the service providers listed in Section 8, acting on our instructions.
• To other members of your organisation in Snova, who can see the workspaces and content shared with them.
• To recipients of client reports you choose to share — see the note below.
• Where required by law, court order or a competent authority, or to establish, exercise or defend legal claims.
• To an acquirer in connection with a merger, acquisition or sale of assets, subject to this policy continuing to apply.

Under Article 6(1) GDPR we rely on the following legal bases:

Some of our providers are located outside the European Economic Area, primarily in the United States. Where we transfer personal data outside the EEA, we rely on the European Commission’s Standard Contractual Clauses, on the EU-US Data Privacy Framework where the provider is certified, and on additional technical measures such as encryption in transit and at rest.

• All traffic is encrypted in transit using TLS.
• Third-party credentials, including CMS logins and Google refresh tokens, are encrypted at rest with AES-256-GCM before being written to the database.
• Passwords are stored only as salted hashes.
• Access to production systems is restricted to personnel who need it, and application access is scoped by organisation and role.
• We set security headers including X-Frame-Options, X-Content-Type-Options and a strict referrer policy.

No system can be guaranteed completely secure, but we work to protect your data using measures appropriate to the risk. If a breach affects your personal data and poses a high risk to your rights, we will notify you and the relevant supervisory authority as required by law.

Under the GDPR you have the right to access your personal data, to have inaccurate data corrected, to have your data erased, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting processing already carried out.

To exercise any of these rights, email support@trysnova.com. We will respond within one month, as required by Article 12 GDPR.

If you believe we have handled your personal data unlawfully, you may lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se, or with the supervisory authority in your country of residence.

Snova is a business product and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this policy as the product and our legal obligations evolve. The “last updated” date at the top always reflects the current version, and we will notify account holders of material changes by email or in the application.

For any question about this policy or how we handle your data, contact us at support@trysnova.com or write to Snova AB, [STREET ADDRESS], [POSTAL CODE] [CITY], Sweden.