Who we are and our roles
Q Snag is snagging software for house builders, developers and contractors. We call the organisations that use it customers. Under the GDPR, the role we play depends on whose information it is.
| Information | Decided by | Our role |
|---|---|---|
| Accounts, snaggers, snagging records and notifications held in a customer's developments | The customer | Processor. We handle it only on the customer's instructions, under a contract that meets Article 28 of the GDPR. |
| Sign-in security, running the service, and enquiries sent to us through this website | Q Snag | Controller. |
If you are a site team member or a snagger, the customer that set you up is your first point of contact for questions about its development. We help them answer.
Personal data we process
| Category | What it includes | Where it comes from |
|---|---|---|
| Site team accounts | Name, email address, role. Passwords are kept only as a salted hash and cannot be read back. | The customer's administrator, or you, when you sign in. |
| Snaggers | Name and mobile number, plus an email address if the site team invited you by email. | You, when you open your invite link or scan a door QR code. |
| Snagging records | Developments, units and addresses; plans; snags; photos and any markup; de-snag notes and evidence photos; when each step happened. | People using the app for the customer. |
| Notifications and emails | In-app messages and emails sent by the app, such as invites, assignments and status changes. | Generated by the app from the customer's activity. |
| Sign-in and technical data | A sign-in cookie, and server logs of requests and sent emails, which can include email addresses and IP addresses. | Your device and the app. |
| Enquiries | Your email address and the message you send us. | You. |
If you choose Sign in with Google, Google tells us your email address and whether Google has verified it. We use that only to find the account your site team already set up for that email. We receive nothing else from your Google account. Q Snag's use of information received from Google APIs adheres to the Google API Services User Data Policy.
Why we process it
Each use of personal data needs a lawful basis under Article 6 of the GDPR. We do not rely on consent, and we do not use personal data for marketing, advertising or profiling.
| Purpose | Our role | Lawful basis |
|---|---|---|
| Provide the snagging service: record, assign and fix snags, produce the de-snag record for each home, and send the related emails | Processor | Set by the customer. Typically its legitimate interests in managing and documenting the handover of its homes (Article 6(1)(f)), or performance of a contract with the people it works with (Article 6(1)(b)). |
| Keep the service secure: sign-in, sessions, limits on abuse, and logs | Controller | Our legitimate interests in protecting the service and its users' data (Article 6(1)(f); see also Article 32). |
| Reply to enquiries sent to us | Controller | Legitimate interests in replying (Article 6(1)(f)), or steps you ask us to take before a contract (Article 6(1)(b)). |
| Meet legal obligations, such as responding to a lawful request from an authority | Controller | Legal obligation (Article 6(1)(c)). |
International transfers
App data is stored in Frankfurt, inside the European Economic Area. Some providers are US companies, and Anthropic processes data in the United States when a customer uses the AI features. Where personal data is transferred outside the EEA, we rely on an adequacy decision, such as the EU-US Data Privacy Framework for certified providers, or on the European Commission's standard contractual clauses (Article 46 of the GDPR), as set out in each provider's data processing terms. You can ask us for details of these safeguards.
Automated processing and AI
Two optional features use AI: detecting rooms from a plan image, and drafting snags from a photo of a paper list. Each is switched on per customer and can be switched off. The output is a draft that a person reviews before anything is saved. The images sent are not used by Anthropic to train its models.
We do not make decisions about people by automated means that have legal or similarly significant effects (Article 22 of the GDPR).
How long we keep it
| Information | Kept for |
|---|---|
| Accounts and snagging records | As long as the customer uses Q Snag. When a unit, development or person is deleted in the app, their records and files are removed. When a customer stops using Q Snag, its data is deleted or returned on its request. |
| Backups | Nightly database copies on the server are kept for 14 days. Encrypted off-site copies are kept for 30 days, and a deleted photo leaves them 30 days after deletion. |
| Snagger invite links | They stop working after 30 days if unused. |
| Sign-in session | Up to 90 days, or until you sign out. An admin session also ends after 8 hours without use. |
| Server logs | A short period for security and troubleshooting, then discarded by our hosting provider. |
| Enquiries | As long as needed to reply and keep a sensible record, then deleted. |
Security
We apply technical and organisational measures appropriate to the risk (Article 32 of the GDPR), including:
- Encryption in transit: the app and this website are served over HTTPS only.
- Passwords stored as a salted hash, never in readable form, and two-step sign-in for site team accounts.
- Role-based access, so people see only what their role allows.
- Uploaded files checked for type and size, and stored where they can never be run.
- Rate limits and request checks against abuse.
- Nightly backups, plus hourly encrypted copies stored off-site in the EU.
Our security page has the full list.
If a personal data breach affects data we process for a customer, we tell that customer without undue delay so it can meet its own obligations.
Your rights
Under the GDPR you have the right to access your personal data, have it corrected or erased, restrict or object to its use, receive it in a portable format, and not be subject to solely automated decisions (Articles 15 to 22).
To use any of these, email gearoid@qsnag.com. If your information is in a customer's development, we pass your request to that customer, who decides how to respond, and we help them. For information we control, we reply within one month.
You can also complain to the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland (dataprotection.ie). We would appreciate the chance to put things right first.
Contact and changes
Questions about this notice or your data: gearoid@qsnag.com.
If this notice changes, the date at the top changes with it, and we tell our customers about material changes directly.