Privacy policy

1. Who we are

Snapaclick is operated by Sabtech Limited (company number 10407489, VAT GB326392008), the data controller for this service. Contact: info@snapaclick.com. We are registered with the Information Commissioner’s Office (ICO).

2. What we collect

• Your name and email address — to create your order, send your print code and receipt, and handle support.
• Your photo — the passport-style photo you take or upload.
• Order details — document type, application centre, package and extras, amount paid, print-code and collection status.
• Photo check results — numbers such as head-size ratio and tilt produced by the checks that run on your device (not images).
• Payment information — handled entirely by Stripe. Card details go directly to Stripe and never reach our servers; we keep only Stripe’s payment reference.
• Referral or voucher codes — if you arrived through a partner link or used a code, so we can apply discounts and pay partner commission.
• Technical data — IP address and browser type in short-term server logs, used for security and fraud prevention.
• Your country (suggestion only) — to preselect your country and currency on the order page we use your device’s time zone, read in your browser and never sent to us, or the country our network provider reports for your connection. We do not use precise location and you can always choose a different country.

Orders placed before August 2026 may also include a phone number and an optional government reference number, which we no longer collect.

3. How we handle your photo

• Checked on your device. Face, size, lighting and glasses checks run inside your browser. Your photo is not sent anywhere for these checks.
• Encrypted in transit — twice. Uploads use HTTPS (TLS) plus an additional layer of end-to-end encryption between your browser and our server.
• Encrypted at rest. Stored photos are encrypted with AES-256.
• If you don’t complete payment, your uploaded photo is deleted automatically within 60 minutes.
• After payment, your photo is sent to remove.bg (Kaleido AI GmbH, Austria) to set the official background, then resized to your document’s specification.
• For kiosk printing, the finished photo is kept encrypted until it is printed, and deleted 30 minutes afterwards (so our staff can let you reprint a jammed sheet) — or after 72 hours if not collected.
• Your original photo, for free fixes. After payment we keep the original photo you took (encrypted, separately from the finished one) for 30 days — the period our centres set, never more than 90 days. If the photo needs improving or a print goes wrong, our staff can re-edit it (framing, straightening, colour and lighting) and send you a private link to see, adjust and approve the result, and print it again with a new code — with no new visit and no new payment. It is then deleted automatically; you can ask us to delete it sooner, and staff can delete it at any time. Each edit is kept with the original for the same period.
• Expert check (optional extra): a trained member of our team views your photo to check it against the official rules.
• Support and disputes: while your photo is stored, authorised staff can view it in our secure admin system to resolve questions about rejected photos. Every view is logged.
• We never use your photo for anything else — no marketing, no facial recognition, no AI training.

4. Lawful basis

• Contract (UK GDPR Art. 6(1)(b)) — to provide the service you ordered.
• Explicit consent — for processing your photo, given when you tick the consent box before taking or uploading it. You can withdraw it at any time before your order is complete.
• Legal obligation (Art. 6(1)(c)) — keeping financial records for HMRC.
• Legitimate interests (Art. 6(1)(f)) — security, fraud prevention, suggesting your country and currency on the order page, and anonymous, cookie-free counts of how the checkout is used so we can improve it.

5. How long we keep data

6. Who we share data with

We use carefully selected service providers under data processing agreements. We never sell your data.

• Stripe — payments (PCI DSS Level 1).
• remove.bg / Kaleido AI GmbH — photo background replacement (EU).
• Resend — sending order emails.
• Render — application hosting.
• MongoDB Atlas — database hosting for order records and encrypted print photos.
• Sentry — error monitoring, configured not to collect personal data.
• jsDelivr and Google Cloud Storage — deliver the face-analysis software and models to your browser. Like any website host they see your IP address; your photo is never sent to them.

Some providers are based outside the UK; transfers are protected by the UK International Data Transfer Agreement or adequacy regulations.

7. Cookies & storage

We don’t use advertising, analytics or tracking cookies. Your browser stores a few things locally to make the site work: your document, centre and currency choices for the current tab (session storage — never your name, email or photo; after a payment, its order and payment references are kept for up to 30 minutes so a reload can finish the order), the partner code from a partner’s QR link if you arrived through one (also session storage, for that tab only), our app files for faster loading (a service worker cache, containing no personal data), whether you switched the camera’s auto-capture off (just on/off, in this browser’s local storage, only once you change it — no personal data; clearing this site’s data removes it), and — for staff only — a secure sign-in cookie and whether their alert sound is on. Stripe may set cookies for fraud prevention when the payment form loads, under Stripe’s privacy policy.

8. Security

HTTPS with HSTS, an additional encrypted channel for photos and personal details, AES-256 encryption of stored photos, a strict Content Security Policy, rate limiting and account lockouts, secured staff sign-in with full audit logging, and device-paired print kiosks.

9. Your rights

Under UK GDPR you can ask to access, correct, delete or receive a copy of your data, object to or restrict processing, and withdraw consent. Email info@snapaclick.com — we respond within one month. When you ask us to delete your data, we remove your personal details but must keep the financial record of a payment for the period required by tax law.

If you order a photo for a child, you must be their parent or legal guardian.

10. Complaints

If you’re unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

11. Changes

We’ll post any changes here and update the date above. Significant changes will be emailed to customers with open orders.