← Strona główna

SnapSort Privacy Policy

Version 1.0 — effective 3 October 2026

This is the English version of the SnapSort Privacy Policy. A Polish version is available at https://www.snapsort.io/polityka-prywatnosci and is provided for users in the Polish market; in the event of any discrepancy between the versions, the Polish version prevails for the purpose of the information duty owed to data subjects in Poland. This Policy also constitutes the privacy notice required under Article 13 GDPR and Articles 19–21 of the Swiss Federal Act on Data Protection (nFADP/revFADP).

§ 1. Introduction

  1. This Privacy Policy (the “Policy”) describes how personal data is processed in connection with the distribution and use of the SnapSort mobile application (the “App”).
  2. The Policy is a document separate from the Terms of Use of the App and is the document referred to in § 9 of the Terms of Use. Definitions used in the Terms of Use apply accordingly.
  3. The fundamental principle of how the App works: patient data, client data and all photographs and Content entered by the User are not collected, transmitted or processed by the Developer. They are stored locally on the User’s Device and synchronised solely with the User’s own private iCloud Drive under their Apple Account. The App also works without an internet connection, and synchronisation takes place once connectivity is restored. See § 4 for details.
  4. The App is not a medical device. It does not perform diagnoses, does not analyse or interpret photographs, does not use artificial intelligence for medical purposes and does not carry out profiling. It serves solely to organise and catalogue photographic documentation.

§ 2. Controller

  1. The controller of the personal data processed within the scope described in § 5 of this Policy is:

    Wojciech Radko
    Correspondence address: c/o JL Consulting Group GmbH #1671, Zürcherstrasse 84, 8852 Altendorf, Switzerland
    Contact e-mail: [email protected]

    (the “Controller” or the “Developer”).

  2. The Controller has not appointed a Data Protection Officer, as the conditions for mandatory appointment under Article 37 GDPR are not met. All matters concerning personal data may be raised at the e-mail address given in paragraph 1.

§ 3. Scope of this Policy

  1. This Policy covers personal data processed by the Controller in connection with: a) making the App available through the App Store; b) handling in-app purchases and subscriptions; c) handling enquiries and support requests addressed to the Controller.
  2. This Policy does not cover the processing of patient data, client data or other User Content — in that respect the controller is the User or the entity on whose behalf the User acts (see § 4).
  3. This Policy does not cover data processing carried out by Apple Inc. (in connection with Apple Accounts, the App Store and iCloud Drive) or by other providers operating under their own privacy policies (see § 8).

§ 4. Patient data and User Content — the Developer is neither controller nor processor

  1. Photographs and all data entered by the User (including patient data, client data, their likeness, names, descriptions, metadata and exported ZIP files) are stored locally on the User’s Device and synchronised solely with the User’s private iCloud Drive under their Apple Account.
  2. The Controller does not have and does not obtain access through the App to that data. The Controller operates no server (backend) on which such data would be collected, stored or processed. The Controller has no access to photographs, patient data, patient names or exported ZIP files.
  3. With respect to the data referred to in paragraph 1, the controller of personal data is the User or the entity on whose behalf the User acts (for example the physician, dentist, orthodontist, clinic or practice). It is that controller who determines the purposes and means of processing and who independently discharges all controller obligations arising under the GDPR and other applicable law, in particular: establishing a legal basis for processing (including health data under Article 9 GDPR), providing the privacy notice to patients, handling data subject requests, and maintaining professional confidentiality.
  4. Because the Controller has no access whatsoever to that data, the Controller is not a processor within the meaning of Article 28 GDPR and does not enter into a data processing agreement with the User — no entrustment of processing takes place.
  5. Once data has been exported to a ZIP file and shared by the User (for example by e-mail, AirDrop or another channel of their choosing), any further processing of that data takes place outside the App and remains outside the control and responsibility of the Controller.

§ 5. Data the Controller actually processes

The Controller processes only the limited set of data necessary to distribute the App and to handle purchases and enquiries. This comprises:

  1. Purchase and subscription data. The App uses Apple’s in-app purchase mechanism (StoreKit) and the RevenueCat subscription management service. Within this scope the following may be processed: a pseudonymous user or device identifier generated for subscription handling, subscription status and history (for example whether a subscription is active, the product type, the renewal date), technical transaction information, and basic device and operating system data. The Controller does not receive full payment details (card numbers and similar) — these are handled by Apple.
  2. Contact data. If the User contacts the Controller (for example a support request or a question), the e-mail address and the content of the correspondence, including any data contained in it, are processed. Please do not include photographs, ZIP exports or other patient or client data in correspondence. If such data is nonetheless sent, the Controller will not use it and will delete it promptly.

The Controller does not process patient data, does not carry out profiling, does not take decisions based solely on automated processing that produce legal effects concerning individuals, and does not use data for tracking-based marketing.

§ 6. Purposes and legal bases of processing

PurposeDataLegal basis (GDPR)
Enabling purchase and handling App subscriptionsdata under § 5(1)Art. 6(1)(b) — performance of a contract
Handling enquiries, requests and technical supportdata under § 5(2)Art. 6(1)(b) and (f) — legitimate interest (managing the relationship with the User)
Compliance with legal obligations (for example tax and accounting) relating to salestransaction dataArt. 6(1)(c) — legal obligation
Ensuring the security, stability and development of the Appdata under § 5(1) and (2)Art. 6(1)(f) — legitimate interest

To the extent the Swiss nFADP applies, processing is carried out on the corresponding bases (conclusion and performance of a contract, legal obligation, and the overriding legitimate interest of the Controller), in accordance with the principles of lawfulness, proportionality and purpose limitation.

§ 7. Retention periods

  1. Data relating to purchases (the annual subscription and the Lifetime purchase) is processed for as long as the entitlement to SnapSort Pro applies, and after it expires, for as long as is necessary for settlement, handling complaints and pursuing or defending claims, as well as for the period required by tax and accounting law.
  2. Correspondence and contact data are retained for as long as is necessary to handle the matter and for the limitation period applicable to any claims.
  3. After those periods expire, the data is deleted or anonymised.

§ 8. Recipients and service providers

  1. The data referred to in § 5 may be entrusted or disclosed to the following: a) Apple Inc. — as the operator of the App Store, Apple Accounts and iCloud Drive. In this respect Apple acts as a separate controller (for Apple Account and App Store transaction data) or as the User’s cloud service provider. Processing by Apple is governed by Apple’s privacy policy: https://www.apple.com/legal/privacy/ b) RevenueCat, Inc. — as a processor acting on the Controller’s instructions for the purpose of handling and managing subscriptions, under a data processing agreement (Data Processing Addendum) forming part of RevenueCat’s terms of service. RevenueCat processes the data described in § 5(1) and has no access to Content or patient data. Processing is governed by RevenueCat’s privacy policy: https://www.revenuecat.com/privacy/ c) accounting, legal or IT service providers — only to the extent necessary and under appropriate agreements.
  2. The Controller does not sell personal data and does not disclose it for tracking-based marketing purposes.

§ 9. Transfers outside the EEA and outside Switzerland

  1. Some providers (in particular Apple and RevenueCat) may process data in the United States or in other countries outside the European Economic Area and outside Switzerland.
  2. Transfers of data to RevenueCat, Inc. (USA) take place on the basis of Standard Contractual Clauses (SCC) adopted by Commission Implementing Decision (EU) 2021/914 (Module Two: controller to processor), incorporated into the data processing agreement concluded with RevenueCat, and, for data subject to the nFADP, on the basis of those clauses as adapted for Swiss law. Apple Inc. processes Apple Account and App Store transaction data as a separate controller, on the terms set out in Apple’s privacy policy.
  3. Information about the safeguards applied can be obtained on request sent to the Controller’s e-mail address.

§ 10. Data subject rights

  1. In respect of data processed by the Controller (§ 5), the data subject has the right to: a) access their data and obtain a copy of it; b) rectification of their data; c) erasure of their data (the “right to be forgotten”); d) restriction of processing; e) object to processing based on legitimate interest; f) data portability — to the extent that processing is based on a contract or consent and is carried out by automated means.
  2. To exercise these rights, please contact the Controller at the e-mail address given in § 2.
  3. Right to lodge a complaint with a supervisory authority: a) in Poland — with the President of the Personal Data Protection Office (PUODO), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, https://uodo.gov.pl; b) in Switzerland — with the Federal Data Protection and Information Commissioner (FDPIC/EDÖB), https://www.edoeb.admin.ch; c) where applicable — with the supervisory authority of the Member State of the data subject’s habitual residence.
  4. Providing data is voluntary but necessary to conclude and perform the contract for the use of the App’s paid features and to handle enquiries; failure to provide it makes those purposes impossible to achieve.

§ 11. Additional information and the Swiss Federal Act on Data Protection (nFADP)

  1. To the extent that the Controller is established or resident in Switzerland, the Swiss Federal Act on Data Protection (nFADP/revFADP) also applies to the processing. Data subjects then have rights corresponding to those described in § 10, and the supervisory authority is the FDPIC (§ 10(3)(b)).
  2. To the extent that the App is offered to individuals located in the European Union, the GDPR applies to the processing irrespective of where the Controller is established (Article 3(2) GDPR).

§ 12. Security

  1. The Controller applies organisational and technical measures appropriate to the limited scope of the data it processes.
  2. The security of photographs and Content stored on the Device and in iCloud Drive is the User’s own responsibility, in accordance with the Terms of Use (securing the Device and the Apple Account, maintaining backups). The Controller has no control over that data.

§ 13. Children

The App is intended exclusively for professional (B2B) use and is not directed at children. The Controller does not knowingly collect children’s data within the scope described in § 5.

§ 14. Changes to this Policy

  1. The Controller may update this Policy, in particular where legislation, service providers or the functionality of the App change.
  2. Users are informed of changes through publication of a new version of the Policy stating its effective date.

§ 15. Contact

Any questions concerning this Policy or the processing of data by the Controller should be sent to: [email protected].