Privacy policy

POG Snap (“POG Snap”, “we”, “us”) makes planogram software for the people who sell into retail rather than the people who plan the space. This policy covers www.pogsnap.com and the application served from it. It does not cover anywhere else you go from here — the comparison pages name other companies and link to them, and what those sites do is their own business.

Questions, requests and complaints all go to the same place: support@pogsnap.com. A person reads it.

In shortYour email, whatever you build with the tool, the files you upload, and ordinary web measurement. Nothing else.

What you hand over to open an account:

• Your email address, and a password if you use one. The password is hashed by our sign-in provider before it is stored; we never receive it and cannot read it.
• If you sign in with Google instead: your name, your email address and the address of your profile picture, as Google gives them to us.
• If your company uses SAML single sign-on: whatever your own identity provider sends, which is normally a name and an email address.
• Which organization you belong to, your role in it, and any invitations you send or accept.

What you put into the tool, which is the substance of it:

• Brands, SKUs and their details — names, UPCs, dimensions, and the retail facts you keep alongside them.
• Fixtures, planograms, and every layout decision inside one.
• Sales figures, if you import a POS report: units scanned, store on hand, sell-in.
• Artwork you upload — dielines, packshots and photographs taken in the aisle.

What arrives without you doing anything:

• Ordinary request logs kept by our host: IP address, browser, the page requested, the time it was requested.
• The analytics described in section 07.

We do not ask for, and do not want, payment card details, government identifiers, health information or anything else in that category. There is nothing to pay for today, and no part of this product needs to know that much about you.

In shortA layout you build as a guest never reaches us. The exception is a file you hand to one of the AI features, which still has to be sent.

“Try it free” opens the editor with no account at all. What you build there is exactly the local-only build of this app: it belongs to no organization, it is never written to our database, and it does not leave your browser. Closing the browser ends it, and there is nothing left behind for us to keep.

One thing is genuinely different, and it would be misleading not to say so. The AI features work for a guest, and they work the only way they can — by sending the file to the provider that reads it, as set out in section 05. If you would rather that not happen, do not use those features; the editor, the fixtures and the 3D view are all untouched by them.

Guest mode is recorded by a single session cookie so the app knows which door you came through. Analytics still runs, as it does on every page.

• Run the service: save your work, show it back to you, and let the people in your organization see it.
• Prove who you are, and keep you signed in from one page to the next.
• Send you the email the service itself needs — confirming an address, resetting a password, passing on an invitation. We do not send marketing email. If that ever changes it will be something you opt into, not something you find yourself in.
• Understand, in aggregate, which parts of the product get used and which do not.
• Keep the thing secure, find out why something broke, and stop abuse.
• Meet an obligation where the law imposes one.

We do not sell your personal information, we do not share it for cross-context behavioral advertising, and there is no advertising network anywhere on this site.

We do not train models on your artwork, your planograms, your dimensions or your sales figures. POG Snap trains nothing, on anything.

In shortFour optional features, three outside providers. Each sends one specific thing, only when you ask, and each gives back a position or a proposal rather than a number you are expected to trust.

This is the part of a privacy policy that usually says “we may use third-party artificial intelligence services” and stops. Here is the actual list.

• Reading a dieline. The image goes to Google’s Gemini API. What comes back is rectangles — where each printed panel sits on the sheet. No pixels come back and no dimensions come back; the cropping happens in your browser, from your own file.
• Reading a hang hole. The packshot goes to Anthropic’s Claude API. What comes back is a fraction of the package height. The inches are worked out here, from the height you measured and typed in.
• Proposing a column mapping. When you import a SKU sheet or a sales report, the header rows and a small sample of the rows go to Claude. What comes back is a proposal, which the importer shows you before a single record is written.
• Making a render photographic. The rendered image and the scene notes you typed go to fal.ai, which runs the image model. What comes back is a second picture, which you look at before it can be saved.

Each of these is optional, each runs only when you ask for it, and the rest of the application works with none of them switched on. Two things are true of all four. We do not train anything on what is sent. And once it has been sent, what that provider does with it is governed by their terms, which are linked in the next section.

We do not run our own servers. Six companies are involved in delivering this product, and this is all of them.

Beyond that list: we will hand over data if the law requires it, and we will say so unless we are forbidden from saying so. If the business is ever sold or merged, your data goes with it, and you will be told before that happens rather than after.

Three kinds of cookie, and nothing else:

• Session cookies set by our sign-in provider. These are what being signed in means. Block them and you cannot sign in.
• pog_guest — a session cookie that records you chose to try the tool without an account. It expires when you close the browser.
• Google Analytics cookies, which measure visits and pages across the whole site, the marketing pages and the application alike.

In shortYour work stays until you delete it or ask us to close the account. There is no self-serve delete button yet, so deletion is an email — and it is a real one.

• Anything you save stays until you delete it or until the account is closed.
• The application has no “delete my account” button today. Write to support@pogsnap.com and we will delete the account, the organization’s records and every uploaded file within 30 days, and write back to tell you it is done.
• Deleted records can survive in routine backups for a short window afterwards, until those backups age out on our provider’s schedule. They are not restored to the live service.
• Request logs are kept by our host for a limited period and then discarded.
• Analytics data is held for the retention period configured on the Google Analytics property.

• Everything travels over HTTPS.
• Organizations are separated in the database itself, by row-level security. A query made with your credentials cannot return another organization’s rows, whatever the application above it asks for.
• Uploaded artwork lives in a private bucket, filed under the organization that owns it, with the same membership check on every read. There are no public URLs for your files.
• Passwords are hashed by our sign-in provider. We do not store them and cannot see them.

None of which is a promise of absolute security, because nobody can make one honestly. If we ever find that your data has been exposed, we will tell you and say what we know.

In shortWherever you live, write to support@pogsnap.com and we will do it — see it, correct it, export it, delete it.

Depending on where you are, the law may give you specific rights: access, correction, deletion, portability, objection, and the right not to be treated worse for exercising any of them. California’s CCPA and the EU and UK GDPR are the usual sources. Our position is simpler than working out which applies to you — ask, and we will do it for anyone who asks, at no charge.

• We will check you control the account before acting on a request about it, which normally means replying from the address it belongs to.
• We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of on that front.
• If you are in the EU or the UK, we handle your data to perform our contract with you (running the service), on legitimate interests (keeping it secure and improving it), and on consent where you have given it.
• If we cannot do what you have asked, we will tell you why rather than let it go quiet.

Our host, our database and our file storage are all in the United States, and the model providers in section 05 process what is sent to them in the United States as well. If you are somewhere else, using POG Snap means your data is transferred to and handled in the US, under US law.

This is a tool for doing a job, it is not directed at children, and it is not for anyone under 16. If we learn that we hold data about a child, we will delete it.

The date at the top is the date this version took effect, and it changes when the policy does. If a change is material — a new provider, a new category of data, a new use for what we already hold — we will tell you by email or in the application before it applies, rather than quietly reposting the page.

support@pogsnap.com, for any of it: a question about this policy, a request about your data, or a complaint about how we have handled either.