Privacy & AI Processing

Where your images and your account live

Both are in the European Union, and we have verified this in our own configuration.

• Your imagesCloudflare R2, Western Europe. A private bucket with no public access.
• Your account, campaigns and creditsSupabase, Frankfurt, Germany.
• The websiteVercel. Its server runs in Frankfurt, Germany.
• The generation serviceGoogle Cloud Run, Frankfurt, Germany.
• Service emailMailgun's European region. Invitations and account notices only.

Nobody can reach an image through a public link. Every view and every download goes through a link that we create after checking that you may see it, and that expires after 15 minutes.

Your company's data is separated inside the database itself, which checks on every single request who may see what. It is not left to the application to remember.

Which AI providers process your images

To make an image, we send the images involved and your instructions to one of two providers, using our own business accounts.

• GPT Image 2 and SunburstOpenAI. Our processor for the EEA is OpenAI Ireland Ltd.
• Nano Banana ProGoogle, through the paid Gemini API.
• Reading an uploaded photo to describe its stylingGoogle, through the paid Gemini API.

We send the image and the instruction text. We do not send your name, your email address, your company name or your account identifier with it.

Nano Banana 2.1 is never used in SwapThat.

Training

Your images are never used to train an AI model. Not by us, and not by the providers: OpenAI states that data sent through its API is not used to train its models, and Google states that for paid services it does not use prompts or responses to improve its products.

We have no model of our own, we train nothing, and we never show one customer's images to another.

What the providers keep, and for how long

This is what their own documentation says, read on 27 October 2026.

• OpenAIMay keep inputs and outputs for up to 30 days to detect abuse, where authorised staff may review them.
• Google (Gemini API)Logs prompts and responses for a limited period for abuse detection and legal reasons, up to 55 days.

We do not offer "zero data retention" and we will not say that we do until it is in place for every model we use. It needs OpenAI's prior approval, which we have not yet requested, and it is not available at all on the Google service we currently use. Even with it approved, OpenAI must by law keep an image input flagged as child sexual abuse material for review.

Does anything leave the EU?

Your images and your account data are stored in the European Union. But storing data in the EU does not mean nothing leaves it, and we would rather be exact than reassuring.

Some of our providers are established outside the EU, or can reach the data from outside it. Those transfers are made under the European Commission's standard contractual clauses, and in Cloudflare's case under the EU-U.S. Data Privacy Framework with those clauses as a fallback. We have assessed each one and written the assessment down; ask us and we will send it.

The AI providers that generate your images may process them outside the European Union. OpenAI offers an EU region, which needs approval for image models, and the Google service we use gives no regional commitment at all. So we do not claim that AI processing happens only in the EU.

What we are still working on

Internal compliance work, not promises. It is listed here so you can see what we have and have not done.

• Zero data retention at OpenAI: to be requested; it needs OpenAI's approval.
• Whether our Standard tier model is available in OpenAI's EU region: to be asked; it is not on OpenAI's published list.
• Moving the Google calls to a service that offers EU processing and zero retention: assessed and recommended internally, not yet decided.
• A tested restore of our backups: on the checklist before launch.
• Our legal documents are drafts, with a Dutch lawyer's review still to come. The pages say so at the top.

When one of these is done, this page changes in the same release.

Deleting your images

Delete any image in Media and it leaves our active storage on the next scheduled clean-up, within 24 hours, and our backups as those expire, within 30 days.

Ask us to close your company account, and its images and campaigns are deleted 30 days later. We keep the credit and invoice records for 7 years because Dutch tax law requires it; those records hold no images.

Our clean-up deletes the file from storage first and the record of it afterwards, so nothing is left behind. It keeps a log of how much it deleted, in which category, for which company — and deliberately no file names and no email addresses.

No tracking, anywhere

No analytics, no advertising pixel, no session replay, no error-tracking service, no support-chat widget.

The only cookies we set are the ones that keep you signed in and remember which company you are working in. We load no third-party script and no font from an outside network, so no other company learns your IP address from visiting SwapThat.

Our service email carries no open tracking and no click tracking, and we send no marketing email at all.

Your rights, and the people in your photographs

You can see, download and delete your images at any time. For anything else — a copy of your personal data, a correction, an objection — write to support and we answer within a month.

For the photographs you upload, your company is the controller and we are the processor. If someone shown in one of your images asks us about it, we do not answer for you: we pass the request to you without delay and help you answer it. That split is set out in our Data Processing Agreement.

You can also complain to the Autoriteit Persoonsgegevens, the Dutch data protection authority.