Privacy notice

Last updated 13 August 2026

ReqSnap is built so that the sensitive part — the ERP screens and requirements you work on — stays on your own machine. This notice sets out the little that is collected, why, and how long it is kept.

It covers the website at reqsnap.com and the application at app.reqsnap.com. Both are operated by the ReqSnap team, who are the data controller for the personal data described below.

The work you do in ReqSnap

There is no account and no sign-up. Captured screens, mockups, workshop notes, requirements boards and the documents generated from them are written to your browser's own storage (IndexedDB) on the device you are using. They are not uploaded to us, we hold no copy, and we cannot see them.

• Anything you blur or cover is burned into the image before it is stored.
• Exports — Word, Excel, PowerPoint, .erdt files — are produced in the browser and saved straight to your downloads folder.
• Clearing your browser's site data for app.reqsnap.com permanently deletes everything ReqSnap has stored. Because we never held a copy, there is nothing for us to delete on your behalf, and nothing for us to recover if you clear it by mistake.

The optional AI draft

One feature sends data off your machine, and only if you switch it on. When you use the AI draft, the text you have typed — notes, requirement wording, field labels — is sent from your browser directly to Anthropic's API using an API key that you supply, so the request is between you and Anthropic under their privacy policy. It does not pass through any server of ours. Your captured screenshots are never sent, whether the feature is on or off. Leave it off and the documents are built entirely on your device.

Your API key is stored in your browser only, is used only to make those calls, and is never transmitted to us.

The contact form

If you fill in the contact form we collect what you type: first and last name, email address, phone number if you give one, company location, size of company, the ERP you use, and your message. We ask for these so we can understand your situation and reply usefully.

• Why we may lawfully use it: our legitimate interest in responding to an enquiry you chose to send us.
• What we do with it: read it and reply. It is not added to a marketing list, not used for advertising, and not sold or shared with anyone for their own purposes.
• Who processes it: the form is delivered to our inbox by Web3Forms, acting as our processor, and the resulting email sits with our email provider.
• How long we keep it: for as long as the conversation is live, and for up to 24 months afterwards in case you come back to us. Ask us and we will delete it sooner.

Cookies and analytics

This website sets no cookies and runs no analytics, advertising or tracking scripts. We do not build a profile of you and there is no consent banner because there is nothing to consent to.

One ordinary technical point: the typeface is served from this site itself, so loading a page makes no request to Google or any other third party, but our hosting provider (Vercel) keeps short-lived server logs — including IP address and browser type — for security and reliability. Storage inside the application itself is not a cookie and is never sent to a server.

Children

ReqSnap is a tool for people at work. It is not intended for, or directed at, anyone under 16.

Your rights

Where data protection law applies to you — including the UK GDPR and EU GDPR — you have the right to ask for a copy of the personal data we hold about you, to have it corrected or erased, to object to or restrict how we use it, and to receive it in a portable form. The only personal data we are likely to hold is what you sent through the contact form.

Use the contact form to make a request and we will respond within one month. If you are not satisfied with our response, you can complain to your national data protection authority — in the UK, the Information Commissioner's Office.

International transfers

Our hosting and form providers operate infrastructure in several countries, so a request you make may be handled outside your own. Where personal data is transferred out of the UK or EEA it is covered by the standard contractual clauses those providers put in place.

Security

The site and application are served over HTTPS. The strongest protection here is structural rather than procedural: the confidential material — your screens and requirements — never leaves your device, so there is no central store of customer data to breach.

Changes to this notice

If we add a feature that changes what is collected, we will update this page and the date at the top. Material changes will be described here rather than made quietly.