Privacy policy

Last updated: October 21, 2026.

This policy explains how Shawn Nabizada, sole proprietor, doing business as Snabby Software (registered in Québec as Logiciels Snabby), called “we” here, handles personal information: on our website, when you talk with us about our systems, and in our private client portal. Our business builds custom AI-powered systems for service businesses and runs them every month; our clients use their systems through that portal.

1. Who is responsible

We are a sole proprietorship in Québec. Our person in charge of the protection of personal information is Shawn Nabizada, owner. To reach him, write to contact@snabbysoftware.com.

2. What we collect, and why

When you visit our website: our host, Cloudflare, processes your IP address and basic request details to deliver the site and protect it. We count visits with Cloudflare Web Analytics, which uses no cookies and doesn’t identify you. The site sets no cookie (section 7).
When you book a call or write to us: your name, email address, phone number if you give it, your business’s name, what you tell us in the booking form (including your answers to the short questions before the calendar: your kind of business, your team’s size, what takes the most time and the language for the call), our emails, our notes of the call and, only with your permission, a recording of the call. Why: to answer you, prepare and hold the call, follow up and, if you choose, prepare a proposal.
When you use our business map (coming soon): the free map of where a business loses time and customers. We collect your name, your business’s name, your website address and what that website’s public pages say, your answers to the questions, your email address and, if you tick the box, your consent to follow-up emails. Why: to make the map and send it to you, and, with your consent, to follow up about it. An AI service, Anthropic (United States), reads your answers and your website’s public pages to draft the map, and Amazon Web Services (Amazon SES) sends you the email. We keep your answers until they reach our customer records, which is soon after you finish; the online link to your map works for 30 days. Every follow-up email carries an unsubscribe link.
When we write to your business about our systems: the business contact details that you or your business published, and our emails with you. Why: to offer our systems to your business. Every such email tells you who we are and carries a way to unsubscribe, and you can ask us to stop at any time.
When your business is our client: the names, email addresses and phone numbers of the people we deal with, the signed agreement, your invoices and payments, and your business’s address, which sets the taxes. Your card details are held by Stripe, our payment processor, never by us. Why: to provide your systems, bill for them, and keep the business and tax records the law asks for.
When you sign in to a client portal: your name, email address and language; your password, kept only in a scrambled form we can’t read; your sign-in records (the time, the browser and part of the network address); the devices you approved; security events; your messages with us; and your notice settings. Why: to give you a secure account, protect it, and answer you.
Information about our clients’ customers: when a client’s systems work with personal information about that client’s own customers, for example a name in a note or a person in a photo, we hold it for our client, under our written agreement with them, only to run their systems. Our client is responsible for it. If you are one of their customers, please ask them first; we pass on to them any request we receive.

3. How we use it, and how we don’t

We use personal information only for the purposes in section 2, or for a new purpose you agree to.
We don’t sell personal information, and we don’t use it for advertising.
AI tools help us. In our clients’ systems, AI steps make outputs from what each client gives its system. In our own business, AI helps us sort the emails we receive and draft our replies and proposals; Shawn reads every drafted message before it is sent. Two replies go out automatically, from fixed texts Shawn approved once: the confirmation of an unsubscribe request, and a thank-you when someone tells us they aren’t interested.
No AI reads or answers your messages in a client portal: Shawn answers them himself.

4. Our providers

We use a few providers to run our business. Each receives only what it needs for its task, under a written agreement or its terms of business. Some are located outside Québec.

Provider	What it does for us	Where
Anthropic	The AI steps of our clients’ systems, the business map, and AI drafting in our own business	United States
Amazon Web Services (Amazon SES)	Sends our email notices	Canada (Central) region, Montréal
Cloudflare	Hosts our website and our domain’s name records, and carries some notices from our providers to our own computer	May be processed outside Québec, including in the United States
Google (Google Workspace)	Our email, calendar, documents and electronic signatures	May be processed outside Québec, including in the United States
Stripe	Invoices and card payments	May be processed outside Québec, including in the United States
Cal.com	Our booking calendar	May be processed outside Québec, including in the United States

5. Where your information is kept

The client portal is hosted in Canada.
Our business records are kept on our own computer in Québec, whose disk is encrypted, and copied by hand to an encrypted backup drive kept in Québec. Each night, an encrypted copy of the portal’s data joins them.
Outside Québec: before we communicate personal information outside Québec, or have it kept there, we assess the privacy risks as Québec law requires, and we have a written agreement with the provider.

6. How long we keep it

People we talked with who didn’t become clients: while it is useful for the purpose we collected it for, then we delete it or keep only what identifies no one. If you ask us to stop writing to you, we keep only your email address and your request, so that we never write to you again.
Call recordings: 90 days, then deleted, unless you agree to a longer period.
Business map answers: until they reach our customer records; the online link to your map works for 30 days.
Clients: for as long as our agreement lasts, then for as long as our business records and the tax and accounting laws require.
Client portals: a client’s portal and everything in it are deleted 30 days after their agreement ends, and the copies in our backups within 90 days. For each output that was published, we keep one proof record with no photo, note or other personal information.
Security records: sign-in and security events for 90 days, then only counts; the portal’s server logs for 30 days, with no message or document content.
Our incident register: at least five years.

7. Cookies

We use only the cookies a page needs to work. We use no advertising or tracking cookies.

In the client portal, two cookies: a session cookie, which signs you out after 12 hours without use and after 7 days at most; and, once you approve a device with an emailed code, a known-device cookie, which spares you the code on that device for 90 days after you last use it. You can forget a device at any time.
On our website: none. The site sets no cookie.

8. How we protect it

Every page is served over an encrypted connection.
A code by email when someone signs in on a new device, and limits on failed tries.
Passwords are stored only in a scrambled form that can’t be read back.
Each client’s data is kept in its own separate store.
Photos are processed in a sealed space with no network access, and their location data is removed.
The copies of the portal’s data are encrypted, and only Shawn has access to our systems.
We install security updates regularly, and we keep a register of incidents.

9. Your rights

Access: you may ask what personal information we hold about you, and get a copy.
Correction: you may ask us to correct it.
Withdrawing consent: you may withdraw your consent to a use you agreed to, at any time; for example, our emails.
A copy you can take elsewhere: you may ask for the information you gave us in a common file format. In a client portal, Download all my data gives the client everything in their account.
Deletion: you may ask us to delete information we no longer need.
Complaints: you may contact the Commission d’accès à l’information du Québec.

To use a right, write to contact@snabbysoftware.com. We may ask you to confirm who you are before we answer. If you are a customer of one of our clients, ask that client first; we pass on to them any request we receive about their customers.

10. Confidentiality incidents

If an incident involves your personal information, we take reasonable measures to reduce the harm and stop it from happening again. If it presents a risk of serious injury, we promptly notify you and the Commission d’accès à l’information. We record every incident in a register. If the information belongs to one of our clients’ customers, we tell that client’s person in charge without delay.

11. Changes to this policy

We publish each new version of this policy here, with its date, and clients see the current version in their portal. If a change affects how we use information you already gave us, we tell you before it applies.

Questions about this policy: contact@snabbysoftware.com.