Privacy Policy

1. Who is responsible

SwapThat is operated by Nathan Lewis, trading as Bold Boy, Eerste Jan van der Heijdenstraat 108-H, 1072 VB Amsterdam, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 52479536, VAT number [To confirm: VAT number] [To confirm: that this is the registered address; boldboy.nl's footer shows a different one].

For running the accounts, keeping the service secure and keeping our administration, SwapThat is the controller under the General Data Protection Regulation (GDPR). For the photographs and other content a Customer uploads, SwapThat is a processor acting for that Customer. Section 2 sets out the split.

Contact for privacy matters: the SwapThat support address on our Help page. [To confirm: a dedicated privacy address, for example privacy@swapthat.io.]

SwapThat has no Data Protection Officer. It is not a public body, and its main activity is not large-scale monitoring or the processing of special categories of data, so article 37 GDPR does not require one.

2. Where we decide, and where you decide

SwapThat has two roles, and it matters which one applies:

• SwapThat is the controller for account and sign-in data, security and audit records, credits, invoicing and support. We decide why and how those are processed, and a Customer cannot instruct us to stop: they are how the service is run and accounted for.
• SwapThat is a processor for the photographs, reference images and instructions a Customer uploads, and for the people shown in them. The Customer decides what is uploaded and why, and must have its own legal basis. We process them only to provide the service, under our Data Processing Agreement.

The Data Processing Agreement is accepted once per company by an Approver, and is part of the Terms.

3. Which data we process

• Account and company data: your business email address, the company you work for, your role, the invitation that brought you in, the name you give us, and which policies you accepted and when.
• Sign-in data: handled by our authentication provider; your password is stored only as a secure hash. Sessions, and two-factor authentication for SwapThat's own administrators.
• Uploaded images: photographs, reference images, product images and logos, which can show identifiable people, with their file name, size and dimensions. We also store short text descriptions of an uploaded image produced by an AI analysis, such as garment type or pose, which you can see and change.
• Generation requests and results: the workflow, settings and instructions you chose, which images were used, the result, its status, the AI model, the timing and the cost. The exact request we sent to the AI provider is kept for 30 days for support and disputes; it contains no keys and no image data.
• Reviews: your Approve, Needs Work or Reject decisions, with reasons.
• Audit records: who did what and when in the company account, and every action a SwapThat administrator takes, with the reason they gave. They keep the service accountable, explain charges and settle disputes, and they cannot be changed or deleted afterwards.
• Credits and billing: the company's credit balance and every change to it, credit requests with the contact name, email address, message and number of credits, and the invoicing details we keep outside the application.
• Support: the messages you send us.
• Technical data: IP address, browser and request logs kept by our hosting providers for security and operation. [To confirm: what each hosting provider logs, and for how long; Cloud Run log retention is to be set to 30 days.]

SwapThat uses no analytics, advertising or tracking tools, and does not use face recognition or any other technique to identify the people in your images. We do not create a biometric template of anyone.

4. Why we process it, and on what legal basis

• Providing SwapThat to the Customer — accounts, images, generation, reviews, credits: to perform our agreement with the Customer, and our legitimate interest in letting the Customer's team members use it (article 6(1)(b) and (f) GDPR).
• Security, preventing misuse and enforcing usage and spending limits: legitimate interest (article 6(1)(f)). We balance it by keeping the logs short and by recording a reason for every administrator action.
• Support, invitations, service email and credit requests: legitimate interest, or steps towards an agreement (article 6(1)(f) and (b)).
• Keeping our administration and tax records: a legal obligation (article 6(1)(c)), under article 52 of the Dutch General Tax Act.
• Content we process for the Customer: the Customer, as controller, needs its own legal basis and must inform the people shown.

We send no marketing email at all. [To confirm: the legal bases above are a proposal for legal review.]

5. Photographs of people

Photographs can show identifiable people, such as models, and a photograph of an identifiable person is personal data.

A photograph is not by itself a special category of data: article 9 GDPR covers biometric data processed in order to identify a person uniquely, and SwapThat does not do that. The photographs are nonetheless sensitive in practice, so they are private by default, never public, never shown to another customer, and used for nothing but the Customer's own generation.

The Customer must be allowed to use these photographs for AI editing and for the use it intends, and must have informed the people shown. See our AI & Image Rights Policy.

Please do not upload photographs of people who have not agreed, of children without their parents' or guardians' permission, or that reveal sensitive information such as health, religion or political views.

6. The AI providers, training and retention

To produce an image, SwapThat sends your instructions and the images involved to an AI provider, using SwapThat's own business accounts. These are the providers' own published commitments, as read on 27 October 2026, and we say plainly which of them we have been able to verify.

• OpenAI (GPT Image 2 and GPT Image 2.5 Sunburst), through the OpenAI API. Data sent through the API is not used to train OpenAI's models. OpenAI may keep inputs and outputs for up to 30 days for abuse detection, where authorised staff may review them. For customers in the EEA, our processor is OpenAI Ireland Ltd., and transfers are made under the European Commission's standard contractual clauses.
• Google (Nano Banana Pro, and the model that analyses an uploaded photo), through the paid Gemini API. For paid services Google states that it does not use prompts or responses to improve its products. Google logs prompts and responses for a limited period to detect abuse and for legal reasons, up to 55 days.

Two things we will not claim until they are true:

• We do not offer "zero data retention". It needs OpenAI's prior approval, which we have not yet requested, and it is not available at all on the Google service we currently use. Even with it approved, OpenAI must by law retain an image input flagged as child sexual abuse material for review.
• We do not claim that AI processing happens only in the EU. OpenAI offers an EU region but it needs approval for image models, and the Google service we use gives no regional commitment at all: Google's terms say the data may be stored or cached in any country where Google operates.

We are working on both, and this section will say so when they are in place. SwapThat itself never uses your images or results to train any model.

7. Service providers (subprocessors)

• Supabase: the database and sign-in, hosted in Frankfurt, Germany (EU). Contracting entity in Singapore; transfers under standard contractual clauses.
• Cloudflare R2: storage of all images, in a Western Europe location, in a private bucket with no public access. Contracting entity in the United States; transfers under the EU-U.S. Data Privacy Framework, with standard contractual clauses as a fallback.
• Google Cloud (Cloud Run, Cloud Tasks, Secret Manager): the generation service and its queue, in Frankfurt, Germany (EU).
• OpenAI and Google: AI image generation and photo analysis — see section 6.
• Mailgun, part of Sinch: service email only, in Mailgun's European region. Invitations, sign-in and password-reset email, credit request notifications and essential account or security notices. Open and click tracking is switched off. Transfers under standard contractual clauses.
• Vercel Inc. (United States): hosts the website and the admin dashboard. Its server functions run in Frankfurt, Germany (EU); its network serves pages from locations near the visitor. [To confirm: Vercel's DPA, its transfer mechanism and its log retention.]

Each provider receives only what it needs for its task. Every one of them is engaged under a data processing agreement. There is no analytics provider, no advertising network, no error-tracking service, no support-chat tool and no payment provider.

We give Customers at least 30 days' notice before we add or change a provider that processes their content, and a Customer may object; the Data Processing Agreement sets out how.

8. Transfers outside the European Economic Area

Your account data is stored in the European Union (Frankfurt), and your images are stored in the European Union.

Storing data in the EU does not mean nothing leaves it. Some of our providers are established outside the EU, or their staff can reach the data from outside it, and the AI providers may process your images outside it.

Those transfers are made under the European Commission's standard contractual clauses, and in Cloudflare's case under the EU-U.S. Data Privacy Framework with the standard contractual clauses as a fallback. We have assessed each transfer and recorded it; you may ask us for the assessment.

The one we want you to know about plainly: the AI providers that generate your images may process them outside the European Union. We are working to change that for every model, and this section will say so when it is done.

9. How long we keep data

These are the periods our automated clean-up actually enforces, every day, and they are the same numbers our tests check:

• Images and results: while the company account is active, until you delete them.
• An image you delete: removed from our active storage on the next clean-up, within 24 hours. Removed from backups as those backups expire, within 30 days.
• Images and campaigns of a closed account: deleted 30 days after the account closes.
• An upload that was never finished: removed after 24 hours.
• The technical record of what we sent to the AI provider: 30 days after the image finished.
• The working state the generator keeps between steps: 30 days.
• Invitations, once accepted, withdrawn or expired: 12 months.
• A credit request, once it is completed or declined: 12 months. An open request is never removed.
• Administrator audit records that are not about money: 12 months. Records about credits, invoices and spending are part of our administration and are kept for 7 years.
• Sign-in and security logs: 90 days. [To confirm: the retention our authentication provider applies on the plan we use.]
• Backups: 30 days. [To confirm: the backup window our database provider applies on the plan we use, and that a restore has been tested.]
• Credits, invoices and the records needed to account for them: 7 years, because article 52 of the Dutch General Tax Act requires us to keep our administration for 7 years. These records hold no images.
• Support correspondence: 12 months after the matter is closed.
• AI providers keep their own short logs under their own terms: see section 6.

Our clean-up deletes the image file from storage first, and only then the record of it, so nothing is left behind. It records what it deleted — how many items, in which category, for which company — and deliberately keeps no file names and no email addresses in that log.

We can put a hold on data when we must keep it for a dispute, a complaint or a legal request. A hold is recorded with a reason, and the clean-up then leaves that data alone until the hold is lifted.

10. Security

• Every connection is encrypted (HTTPS).
• Images are stored privately and shown or downloaded only through links that expire after 15 minutes, issued after we have checked that you may see the image.
• Each company's data is separated inside the database itself, which checks on every single request who may see what. It is not left to the application to remember.
• SwapThat's administrators need two-factor authentication, and every action they take is logged with the reason they gave.
• Audit records and reviews cannot be changed or deleted by anyone, including us.
• Keys and secrets live in the hosting providers' secret stores, never in our code.
• A monthly spending cap, with alerts and an emergency pause, limits what a mistake or a stolen key could cost.
• Error messages and logs are filtered so that keys and provider responses cannot leak into them.
• The database and the images are backed up. [To confirm: that backups and a tested restore are in place before launch.]

If a personal data breach happens, we follow a written procedure: we notify the Dutch Data Protection Authority within 72 hours where the law requires it, we tell the people affected where the risk to them is high, and we tell any affected Customer without undue delay so that it can meet its own duties.

11. Your rights

You may ask us to give you a copy of your personal data, to correct it, to delete it, to restrict or object to its processing, or to give it to you in a portable format. Where processing rests on consent, you may withdraw it at any time.

Send the request to the SwapThat support address. We answer within one month, as article 12(3) GDPR requires.

If your request concerns photographs a Customer uploaded, we are the processor and the Customer is the controller: we pass the request on to that Customer without delay and help them answer it. A Customer can delete any image itself, at any time.

You may also complain to the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) or to the supervisory authority in your own EU country.

12. Cookies

SwapThat sets only the cookies the application needs in order to work:

• the sign-in cookies of our authentication provider, Supabase, which keep you signed in;
• swapthat-org, which remembers which of your companies you are working in.

That is the whole list. There is no analytics cookie, no advertising cookie, no tracking pixel and no cross-site identifier. We load no third-party script, and no font or script from an outside network, so no other company learns your IP address from visiting SwapThat.

Because every cookie we set is strictly necessary to deliver the service you asked for, we do not need your consent for them and we do not show a cookie banner — refusing them would mean refusing to sign in. If we ever add anything optional, we will ask for your consent first, with a real choice to say no.

13. AI transparency

SwapThat produces images with AI, and says so on every screen where an image is generated and on every result.

The EU AI Act's transparency rules have applied since 2 August 2026. Where an AI provider marks a generated image so that software can tell it was made with AI, SwapThat passes that marking through untouched: we never re-encode or strip the metadata of a result.

[To confirm: whether SwapThat is a provider or a deployer of an AI system under the EU AI Act, and therefore whether SwapThat must add a machine-readable marking of its own. This is with our legal adviser.]

If you publish an AI image of a real person, place or event, the duty to disclose that is yours as the publisher. Our AI & Image Rights Policy explains it.

14. Changes to this policy

We update this policy when our processing changes. The version and date are at the top of this page. After a material change we ask you to read the new version the next time you sign in.