Privacy Policy
Last Updated: June 9, 2026
Snowball App ApS ("Snowball," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and safeguard personal data, and the rights you have under the EU General Data Protection Regulation (GDPR) and the Danish Data Protection Act (Databeskyttelsesloven). It applies to our website, our web application, and the key-management tools we provide (together, the "Service").
1. Data Controller & Contact
Snowball App ApS is the data controller for the personal data processed through the Service.
CVR: 46547799 · VAT: DK46547799
Address: Marskensgade 4, 1 tv, 2100 Copenhagen, Denmark
Email: hello@snowballapp.com
For any privacy question, or to exercise your rights, contact us at hello@snowballapp.com.
2. The Data We Process & Why
| Category | Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Account & profile | Name, email, password (managed via AWS Cognito), profile picture, organisation membership. | Create and operate your account; authenticate you; provide the Service. | Performance of a contract (6(1)(b)). |
| Billing | Plan, subscription status, and billing identifiers. Card details are entered directly with Stripe and are not stored by us. | Take payment, manage subscriptions, meet accounting obligations. | Contract (6(1)(b)); legal obligation (6(1)(c)). |
| Usage & device | Log data, IP address, browser/device type, and actions taken in the Service. | Security, fraud prevention, debugging, improving the Service. | Legitimate interests (6(1)(f)). |
| Communications | Support messages, and outreach messages you choose to send through the Service. | Provide support and deliver the features you use. | Contract (6(1)(b)); legitimate interests (6(1)(f)). |
| Creator data | Publicly available information about content creators — usernames, display names, public profile details, audience and content statistics, languages, and publicly listed business contact details (including business email addresses). See Section 4. | Provide our creator-discovery, analytics and outreach tools to business customers. | Legitimate interests (6(1)(f)). |
| Website visitors | Cookies and similar identifiers, IP address, pages visited. See Section 9. | Run and secure the website; measure performance. | Consent (6(1)(a)) for non-essential cookies; legitimate interests (6(1)(f)) for essential cookies. |
| Marketing communications | Email address, your consent record (what you opted in to, when, and from where), and whether you open or click our emails. | Send you the newsletter and product updates you asked for; evidence and manage your consent. | Consent (6(1)(a)) — withdraw at any time via the unsubscribe link in every email or in your account settings. |
3. Where Your Data Comes From
- Directly from you — when you create an account, subscribe, contact us, or use the Service.
- Automatically — through your use of the Service (usage, device, and cookie data).
- From public sources and providers — for the creator data in Section 4, collected from public platforms (such as Twitch, YouTube, X, and Steam) and from data providers acting on our behalf.
4. Creators & Publicly-Sourced Data
A core function of the Service is to help games studios discover and contact relevant content creators. To do this, we process limited personal data about content creators that is publicly available on platforms such as Twitch, YouTube, X, and Steam — for example public usernames, display names, audience and content statistics, languages, and publicly listed business contact details.
We rely on our legitimate interests (and those of our business customers) to operate a business-to-business creator-discovery and outreach tool (GDPR Art. 6(1)(f)). We have weighed those interests against the rights and freedoms of creators and limit our processing to data that is already public and professional in nature. We do not knowingly collect special categories of data.
If you are a creator, you have the right to object to this processing and to request erasure of your data. Contact us at hello@snowballapp.com and we will action your request and, where you ask us to, suppress your details from future collection.
5. Sharing & Sub-processors
We do not sell personal data. We share data only with the service providers ("sub-processors") that help us run the Service, each bound by a data-processing agreement and permitted to use the data only on our instructions:
| Sub-processor | Purpose | Hosting location | Transfer safeguard |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Cloud hosting and compute, file storage, transactional email, authentication, and encryption. | United States (us-east-1) | SCCs + EU–US Data Privacy Framework |
| MongoDB, Inc. (Atlas) | Managed database hosting. | United States | SCCs + EU–US Data Privacy Framework |
| Stripe Payments Europe, Ltd. | Payment processing and subscription billing. | EU / United States | SCCs + EU–US Data Privacy Framework |
| Google Ireland Ltd / Google LLC | "Sign in with Google" authentication; collection of public YouTube creator data via the YouTube Data API; website analytics (Google Analytics); and advertising and conversion measurement (Google Ads), each only where you have consented to the relevant cookies. | EU / United States | SCCs + EU–US Data Privacy Framework |
| Discord, Inc. | Optional Discord integration — only where a customer chooses to connect it. | United States | SCCs + EU–US Data Privacy Framework |
| Brevo (Sendinblue SAS) | Newsletter and marketing-email delivery, double-opt-in confirmation, and consent records — only for people who have opted in. | European Union (France) | Not required — data stays within the EEA |
A current list of sub-processors is maintained and updated as our providers change. We may also disclose data where required by law or to protect our legal rights.
6. International Transfers
We are established in Denmark, but some of our sub-processors host data in the United States. Where personal data is transferred outside the European Economic Area (EEA), we rely on appropriate safeguards — the European Commission's Standard Contractual Clauses (SCCs) and, where the provider is certified, the EU–US Data Privacy Framework — together with additional technical measures such as encryption in transit and at rest.
7. Data Retention
- Account data: for the duration of your account, then deleted or anonymised, except accounting records retained under the Danish Bookkeeping Act (currently five years).
- Usage & log data: typically up to 24 months.
- Creator data: for as long as it is relevant to the Service, and removed on a valid erasure or objection request.
- Marketing data: until you withdraw consent or object.
8. Your Rights
Under the GDPR you have the right to: access and portability; rectification and erasure; restriction of and objection to processing based on legitimate interests (including the creator data in Section 4); withdraw consent at any time; and lodge a complaint with a supervisory authority — in Denmark, Datatilsynet.
To exercise any right, email hello@snowballapp.com. We respond within one month.
9. Cookies
We use strictly necessary cookies to keep you signed in and to keep the Service secure; these are required for the Service to function. Where we use any non-essential cookies (for example analytics), we ask for your consent first and you can withdraw it at any time. You can also control cookies through your browser settings. For full details of the cookies we use and how to manage them, see our Cookie Policy.
Where you consent to analytics and marketing cookies, we also store the resulting analytics identifier (Google Analytics client ID) and — if you arrived via one of our advertisements — the ad-click identifier (gclid) on your customer account, so that sign-ups and purchases can be attributed to the campaign that brought you to us. We delete these identifiers when you withdraw the corresponding consent.
10. Data Security
- Encryption: AES-256 at rest (including envelope-encrypted secrets) and TLS in transit.
- Access control: role-based access and support for multi-factor authentication.
- Monitoring: system monitoring and anomaly detection.
11. Children
The Service is intended for businesses and is not directed at children. We do not knowingly collect personal data from children.
12. Data Breaches
If a personal-data breach occurs, we will notify Datatilsynet within 72 hours where required, and inform affected individuals without undue delay where the breach is likely to result in a high risk to their rights.
13. Changes to This Policy
We may update this Policy from time to time. We will post the updated version and revise the "Last Updated" date above; material changes will be communicated where appropriate.
14. Contact & Supervisory Authority
Questions or requests: hello@snowballapp.com.
Carl Jacobsens Vej 35, 2500 Valby, Denmark
www.datatilsynet.dk
