Privacy policy

Your privacy matters

SwayQ ApS ("SwayQ", "we", "us") operates swayq.com. This policy explains what data we collect, why, and your rights under the EU General Data Protection Regulation (GDPR).

Who we are

SwayQ ApS (CVR 46300661), Copenhagen, Denmark. Data Protection contact: Janusch Häring, privacy@swayq.com.

Registered office: Sundkaj 11, 2150 Copenhagen, Denmark.

What we collect

Account signup

When you create an account, we collect your display name, email address, role (creator or brand), and (for creators) themes, primary platform, and audience size. These fields are required to set up your account.

Cookies and consent

We use strictly necessary cookies at all times: a language preference cookie (swayq_locale_choice) and authentication session cookies managed by our auth provider. Optional analytics cookies load only if you accept them in our cookie banner, see the "Third-party processors" section for details. We do not run advertising cookies.

Bot protection

We use Cloudflare Turnstile to protect forms from automated abuse. Turnstile may process your IP address and browser metadata. See Cloudflare's privacy policy for details.

Authentication and email verification

Authentication is handled by Better Auth running on our own servers, backed by Neon Auth. When you sign up with email and password we store a one-way hash of your password (never the password itself) and send a verification email. Session state is held in a secure, HTTP-only cookie. We also send transactional emails (verification, password reset, and account notifications) through Resend. We do not send marketing emails today; if that changes we will ask for consent first.

Social login and creator profiles

When you sign in or connect an account through a social login provider (Google, Microsoft, TikTok, Instagram, LinkedIn, Snapchat), we receive your display name, profile picture URL, provider user ID, and (where the provider shares it) your email address. For creator accounts we may also fetch public profile metrics such as follower count to help with matching. Some providers do not share an email address; in those cases we generate an internal placeholder so the account can still be managed. We link to the provider's image URL directly; we do not copy or cache OAuth profile images on our servers.

Profile images and media

If you upload a profile image or other media, we store the file in Cloudflare R2 in the EU and associate it with your account. When you connect a social account we link to the provider's profile image URL directly; we do not copy OAuth profile images to our own storage.

Technical logs

We collect error logs and performance telemetry (via BetterStack Logtail) to keep the service running. We intentionally avoid putting personal data into log messages. Server logs may include truncated IP addresses and request metadata for security and debugging.

Legal basis

We process your data based on: consent (cookie banner choices, optional fields you fill in), contract performance (operating your account and any campaign you participate in), legitimate interest (service security, fraud prevention, and service improvement), and legal obligation (tax, accounting, and record-keeping where required).

Emails we send

We separate two kinds of email. Service emails are part of providing SwayQ: account status, security and login notices, email verification, and notifications about campaigns and matches relevant to you. They are sent on the basis of our contract with you, and you receive them for as long as you have an account. Marketing emails are different: tips, newsletters and promotional messages. We send those only if you have given us your consent, we ask for that consent separately from anything else, and you can withdraw it at any time under account settings, with no effect on the service emails.

Third-party processors

Your data is processed on our behalf by the following providers. Each has a data processing agreement (DPA) in place and transfers outside the EEA rely on EU Standard Contractual Clauses where applicable:

• Cloudflare: hosting, CDN, Workers, R2 object storage, and security (DPA in place)
• Neon: Postgres database hosting in the EU (Frankfurt), SOC 2 compliant, DPA in place
• HubSpot: when enabled and with your consent, we use HubSpot for support and CRM workflows.
• Stripe: payment facilitation and fund custody for campaign transactions (rolls out with campaign payments)
• Google: social login
• Microsoft: social login
• ByteDance (TikTok): social login and creator profile verification
• Meta (Instagram Business Login): social login and creator profile verification
• LinkedIn (Microsoft): social login
• Snap Inc. (Snapchat): social login
• Resend: transactional email delivery (verification, password reset, account notifications)
• Cloudflare R2: object storage for profile images you upload and, in future, presentation videos
• BetterStack (Logtail): error logs and uptime monitoring. We avoid writing personal data into log messages.

Links to each provider's privacy policy are available on their websites.

Data retention

Financial and transactional records are kept for five years, as required by Danish bookkeeping law. Other personal data is retained only as long as your account is active and is deleted on request.

Social profile data is retained until you disconnect your account or request deletion. You can remove a social connection at any time from your account settings, or request full data deletion by contacting privacy@swayq.com.

Your rights

Under GDPR, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Receive your data in a portable format
• Object to processing based on legitimate interest
• Withdraw consent at any time

To exercise any of these rights, email privacy@swayq.com. We will respond within 30 days.

How we use AI

SwayQ uses algorithmic ranking (not personal data mining) to match creators and brands, and AI-assisted tools internally to help our team draft outreach, all reviewed by a person before anything is sent. Where AI generates or alters an image or other content shown to you, it carries an "AI-generated" label. Where a message you receive was written by one of our AI agents rather than by a person, it is labelled as coming from an AI agent, and if it is addressed to you individually a member of our team has approved it before it reaches you. Write to us if you want more detail on where AI is used.

Complaints

If you believe your data protection rights have been violated, you may lodge a complaint with the Danish Data Protection Agency (Datatilsynet) at datatilsynet.dk.

Changes to this policy

We may update this policy as our services evolve. Significant changes will be communicated via email or a notice on our website.