snowberry

Privacy Policy

Snowberry is a workspace for conversations with AI agents, shared project files and connected tools. This notice covers the Snowberry website, iOS app and supporting services. The information a particular service receives depends on the features you use and the integrations your organization enables.

1. Who is responsible for your information?

The organization providing your Snowberry workspace determines how information in that workspace is used. When we process project content on its instructions, that organization is generally the data controller and we act as its processor. We are responsible for processing we determine ourselves, such as operating accounts, securing Snowberry and responding to support requests. Your organization’s notices and its agreement with us may also apply.

Snowberry is operated by Sengi AI AB, Swedish organization number 559472-2125. Registered postal address: c/o Innovation Stable, Uppsala Science Park, 751 83 Uppsala, Sweden. You can send privacy requests to Sengi AI AB at this address. Before publication, add a monitored privacy email and any applicable representative or data protection officer details.

2. Information we process

  • Account and access information: your name, email address, account identifier, password hash, verification status, sessions, project memberships, permissions and notification preferences, plus the version and time of your registration acknowledgements and AI-sharing permission.
  • Workspace content: messages, prompts, AI responses, uploaded files, generated documents, code, workspace databases, workflow instructions and tool results. Content may include information about other people that you or your organization submit.
  • Connected-service information: authorization grants and credentials, selected Google Drive folders and files, external MCP connections, email addresses, email contents and attachments, and incoming webhook data used by enabled integrations.
  • Operational information: request and execution identifiers, timestamps, IP addresses and other connection metadata, security and access records, tool activity, model usage, run status, errors and diagnostic information.
  • Device and interaction information: app version, device and account identifiers, navigation and interaction events, performance measurements and crash reports when diagnostics are enabled. Push registration includes an Apple device token and its development or production environment.

3. Why we use information

We use information to authenticate users, enforce project access, run requested AI tasks, store and synchronize project content, perform authorized tool actions, deliver account messages and notifications, investigate failures, prevent misuse and support users.

Where data protection law requires a legal basis, processing may be necessary to provide an agreed service, meet a legal obligation, or pursue legitimate interests such as securing and maintaining Snowberry. Where we rely on consent, including for optional native session recordings, you may withdraw it without affecting earlier lawful processing. Your organization is responsible for the legal basis for content it asks us to process on its behalf. This notice is not a substitute for a separate consent where one is required.

4. AI processing and service providers

Registration asks separately for agreement to the Terms, acknowledgement of this Privacy Policy and permission to share data for AI processing. These boxes start unchecked and registration requires all three. AI requests can send your prompt, relevant conversation history, instructions, file contents and tool results outside Snowberry. Do not submit information you are not authorized to share. A connected tool may send data to another service or make changes there; review your project’s enabled tools and access rules before using it.

  • OpenAI / Codex: generates AI responses and agent actions. The current runtime routes model requests through a configured Codex Pooler gateway, which can also process those requests. The upstream account, gateway operator and their applicable data-processing arrangements must be identified for your deployment. Provider retention and any use for model improvement depend on those arrangements; this notice does not promise zero retention or a provider training opt-out.
  • E2B: hosts the remote environments where agents execute code and work with project files, dependencies, tool outputs and execution state. Information placed in that environment can be processed by E2B and by services the authorized agent contacts.
  • PostHog: receives configured analytics and diagnostic data from the web app, iOS app and server components. See the analytics section below. The repository’s default ingestion endpoint is PostHog EU Cloud; this is not a guarantee that all Snowberry data or all provider operations remain in the EU.
  • SMTP2GO: processes email recipients, subjects, bodies and attachments when an enabled agent tool sends email. Project recipient rules limit permitted destinations. Account verification and password-reset emails use the deployment’s configured SMTP provider, which must be identified separately if different.
  • Resend: processes incoming email and attachments for projects with inbound email enabled. Snowberry retrieves these messages so an agent can work on them.
  • Google Drive: connects files and folders authorized for a project. Google’s OAuth grant uses the full Drive scope; Snowberry applies additional project folder and operation rules before tool access. Authorized file contents or extracts may become part of an AI request. Disconnecting an integration stops future access through it but does not automatically erase copies already saved in chats, files or other systems.
  • Apple Push Notification service: receives a device token, notification text and a link identifying the relevant project/chat when an eligible push is sent. Notification text can appear on a device’s lock screen depending on its settings.
  • Organization-selected MCP services and external destinations: receive the tool arguments, authorized records and files needed for an action. These services vary by project; consult your administrator and their privacy notices. A remote MCP client authorized by a user may also receive Snowberry data within its granted scopes.
  • Hosting, storage and backups: application data is stored in the deployment’s databases and object storage. The supplied deployment uses PostgreSQL, MinIO-compatible object storage and workspace SQLite databases. These are technologies, not confirmation of a particular hosting vendor, country or backup-retention policy.

Only the relevant services are involved in a given action. Your administrator can provide the current list of providers and enabled integrations for your workspace. Changes that introduce materially different processing require an updated notice and any necessary authorization or consent.

5. Analytics, diagnostics and local storage

The website uses essential session cookies and local settings for sign-in and preferences. When configured, PostHog collects page views, page exits, clicks, scroll-depth measurements and errors. Browser analytics identifiers are held in memory rather than persistent analytics cookies. Web session replay is disabled. Filters remove query strings and restrict event metadata; diagnostics should not be treated as guaranteed anonymous data.

In iOS, diagnostics are enabled by default in builds that configure PostHog. You can turn off new diagnostics in the app’s Diagnostics settings. They can include a stable account identifier, app/version details, screen and request-operation labels, timing and sanitized crash information. App instrumentation is designed to exclude passwords, message text, file contents and push tokens from these reports.

Native masked recordings are off by default and require both deployment enablement and your separate “Allow masked recordings” setting. These recordings show layout and interactions with text and images masked; sensitive screens are excluded. Disabling diagnostics or recordings stops new collection through those controls, but does not delete information already received by PostHog. iOS settings do not control separate server security logs or browser analytics.

The app also stores session credentials securely on the device and caches some project content locally to support restoring sessions and viewing saved content. The current integrations do not implement advertising tracking. Essential network requests still expose connection information to their recipients.

6. Project access and other disclosures

Project content is shared with users who have access to that project. Organization administrators and authorized service operators may access information to administer, support or secure the service. Email recipients and connected services receive information sent to them through authorized actions. We may also disclose information when legally required or necessary to investigate misuse or protect people and the service, subject to applicable law.

7. Storage locations and international transfers

Snowberry and its providers may process information in countries other than where you live. Where applicable law requires it, international transfers need an appropriate legal mechanism, such as an adequacy decision or contractual safeguards. The actual hosting countries, provider agreements and transfer mechanisms must be confirmed for the deployed service before this draft becomes effective; no blanket EU-only storage claim is made.

8. Retention and deletion

You can initiate account deletion from Account → Delete Account in the iOS app, confirm your current password and approve the deletion. Your profile details and sign-in credentials are removed, sessions and account access are revoked, and push registrations are deleted. Google Drive and OAuth connections you authorized are disconnected. If you are the only project owner or super admin, first assign another person to that role.

Account deletion does not delete your organization’s workspaces, shared conversations, files, automations or records it needs to retain. A non-login account identifier and security records may remain to preserve shared records and meet security or legal obligations. Content already sent to providers, recipients or backups is subject to their applicable deletion and retention arrangements. Contact your organization about removing personal information within shared content.

Retention depends on the type of information, your organization’s instructions, operational needs and applicable legal obligations. Signing out, uninstalling the app, disconnecting a tool or disabling notifications does not by itself delete your server-side account or all previously processed content.

Some technical records have automated cleanup. The current default for realtime event history is seven days. The configured push-delivery worker removes its delivery records after seven days and stops attempting alerts older than 24 hours. A separate legacy Codex execution-log cleanup defaults to 30 days when enabled; that is not a retention limit for conversations, project files or all execution records. Cleanup depends on the relevant worker running successfully.

Account records, workspace content, security records, backups and provider-held data need their own retention and deletion schedules. Those schedules, including legally required retention and treatment of shared organizational records, must be finalized before publication. Removing content from an active workspace does not necessarily immediately remove backups or copies already sent to another service or recipient.

9. Your choices and rights

  • Update available account details and manage project access within Snowberry.
  • Choose chat-completion and AI notification preferences; iOS system settings control device permission and previews.
  • Use Diagnostics settings to stop new native diagnostics or withdraw optional recording consent.
  • Ask an administrator to review or disconnect project integrations; you can also revoke Google access in your Google account.
  • Depending on applicable law, request access, correction, deletion, restriction, portability or object to certain processing. We may need to verify your identity and involve your organization when it controls the requested information.

Privacy and deletion requests should go to the privacy contact identified in section 1, or to your organization where it is the controller. You may also complain to the relevant data protection authority, including Sweden’s Integritetsskyddsmyndigheten (IMY). To stop submitting new information to AI providers, stop using the AI workspace; you can delete your account in the app. Contact us or your organization for requests concerning earlier processing. Before publication, confirm the deployed deletion flow and working privacy contact details.

10. Security and changes

Snowberry uses access controls, authenticated connections and protections for stored credentials. No system can guarantee absolute security. Protect your account and only connect services and upload information you are authorized to use.

We may update this notice as the service changes. A published version will identify its effective date, and material changes will be communicated as required by applicable law.