Privacy policy

Last updated: November 5, 2026.

This policy explains how SnapPlug, based in the Republic of Korea, handles data when you use this service. Contact: hello@snapplug.app.

What we collect, and why

• Your Xero user ID and sign-in session: to confirm that you connected the export.
• Encrypted Xero tokens: to read your organisation while the export runs.
• Your organisation's name and short code, its transaction numbers, dates, contacts, amounts, currencies, account codes and statuses for the chosen period, and the names of contacts and accounts that have attachments, and of your Xero Documents files and folders: to run the scan and write the reports.
• Attachments and sales invoice PDFs, after you pay: to build your ZIP.
• Your email address from the checkout: to send you the link and updates about your export.
• The time you accepted our terms: to keep a record of your agreement.
• The campaign name in the link you arrived from, if it has one: to learn which pages and places bring customers. We do not use tracking scripts or advertising cookies.
• Access logs (time, event, IP address and Xero user ID): to keep the service secure.

Xero records can contain personal data about other people, such as a supplier's name. For that data we act on your behalf.

What we do not do

We do not sell your data. We do not use Xero data to train or improve AI models. We only ask for read access to Xero, and we do not change your Xero records.

We do not open or read your files or records. The export runs automatically. The only exceptions are when you ask us for support on your export, or when the law requires it.

Legal basis

Where the GDPR or UK GDPR applies, we process data to perform our contract with you, to meet legal duties, and for our legitimate interest in keeping the service secure.

Who else receives data

• Xero: you sign in and connect through Xero.
• Lemon Squeezy: our merchant of record. It collects your payment details from you, and receives an export reference from us. We do not see your card number.
• Resend: sends our emails. It receives your email address, a link to your export, the export status and file and transaction counts. If an export fails, it also receives the reason.
• Akamai Cloud (server in London, UK): hosts our server, which stores the data above.
• Backblaze: stores our access logs.

We may also disclose data if the law requires it. These providers may process data outside your country.

How long we keep it

• Unpaid scans: deleted after 24 hours.
• Finished exports, including the ZIP: deleted 7 days after the export is ready.
• Failed paid exports: deleted 30 days after payment.
• Xero tokens: deleted, and the Xero connection closed, when the export ends.
• Access logs: kept for up to one year.
• Payment records: kept by Lemon Squeezy under its own policy.

Security

We encrypt Xero tokens, your email address, organisation name, transaction details and file names in our database, and your downloaded files on disk, with AES-256. A ZIP is unencrypted on the server only for the short time we are building it. We use HTTPS for traffic to the service. Only the Xero user who connected an export can open it. If a breach affects your data, we will tell you without undue delay, and we will tell Xero as its terms require.

Cookies

We use one cookie that is needed to keep you signed in. We do not use advertising cookies.

Your rights

You can remove this app in Xero at any time under Connected apps. You can ask us to access, correct, delete or send you your data by emailing hello@snapplug.app. You can also complain to your data protection authority. You must be at least 18 to use the service.

Changes

We may update this policy. The date at the top shows the latest version.