Privacy Policy

1. Who is responsible for the data

Swappy is a service operated from Portugal. When you contact Swappy directly, create a business account or manage a subscription, Swappy is responsible for the processing needed to provide and protect those services.

When you use the Swappy widget on a shop's website, that shop is responsible for its relationship with you, for making the widget available and for the quote request. Swappy processes the data needed to provide the tool on the shop's behalf.

2. Data we process

Depending on how you use the service, we may process:

• the original car photo and the generated preview;
• the selected colour or finish and basic information about the creation of the preview;
• the name, contact details and message submitted with a quote request;
• the name, company, contact details and message submitted through the website form;
• shop account data such as name, email, business, website, language and preferences;
• authentication identifiers and information needed to maintain the session and protect access;
• the selected plan, subscription and billing status, Stripe identifiers and a record of accepted contract versions, without storing complete card details;
• when you open an individual link sent by Swappy, the random code associated with the recipient business or contact, a random visit identifier, the language and limited actions such as sections, buttons and demo features used;
• technical data needed for security and operation, such as IP address, browser, date and time of the request.

3. Uploaded photos

A photo may include personal elements such as a licence plate, people or other objects in the background. Only upload photos you are authorised to use and avoid including unnecessary information.

4. Why we use the data

We only use the data to:

• generate and display the requested preview;
• deliver a quote request to the selected shop;
• reply to messages sent directly to Swappy;
• create and manage the shop's account, authentication, trial, subscription and access;
• record acceptance of contractual documents and comply with legal obligations;
• assess whether individual commercial outreach links were visited and which features attracted interest, in order to follow up those contacts and improve Swappy's launch;
• operate, protect and troubleshoot the service.

5. Legal basis for processing

Depending on the context, processing is necessary to provide the requested feature, enter into or perform the contractual relationship with the shop, comply with legal obligations and pursue the legitimate interests of protecting the service, preventing abuse, maintaining contractual records and resolving issues.

The limited measurement of individual commercial outreach links is based on Swappy's legitimate interest in assessing commercial interest, following up contacts and improving the launch. You may object to this processing through the contact form.

Data marked as required during account creation and subscription is needed for that process. Without it, Swappy may be unable to create the account, start the trial or provide the service.

Where processing relies on consent, that consent may be withdrawn at any time without affecting processing that was already carried out lawfully.

6. Use of artificial intelligence

To generate the requested preview, the photo is processed by artificial intelligence services.

We apply settings and restrictions intended to prevent photos and instructions from being used for training, publication or unnecessary retention by the services involved.

The generated image is only a visual simulation, may contain inaccuracies and does not make decisions with legal or similarly significant effects about the visitor.

7. Who we share data with

Data is shared only when necessary to provide and protect the service, including with:

• the shop where the widget is installed, when a quote request is submitted;
• hosting, database and private storage providers;
• artificial intelligence processing providers;
• authentication and payment services used by the shop;
• email delivery and receiving services;
• security and abuse-prevention services.

8. International transfers

Some providers may process data outside the European Economic Area. Where applicable, appropriate legal and contractual safeguards are used to protect that data.

9. How long we keep data

Photos, previews, related records and quote requests stored by Swappy are kept for 30 days from the creation of the preview.

After that period, a daily process removes the related active data. Deletion may take place during the following daily run or after a temporary failure has been resolved.

Messages sent directly to Swappy are kept until the request is resolved and for a further 30 days.

Data associated with an individual commercial outreach link is kept for no more than 60 days from the creation of the link. The daily process then deletes the events first and the associated link afterwards; deletion may take place during the following daily run or after a temporary failure has been resolved.

Account, subscription and contractual acceptance data is kept while the account or service relationship remains active. After closure, it is retained only for as long as needed to comply with legal obligations, resolve contractual matters and establish, exercise or defend legal claims, and is then deleted or anonymised where applicable.

When a quote request is sent to a shop, that shop receives a copy. Swappy does not control that copy, which is subject to the shop's own privacy practices. Provider backups and technical records may follow their respective operational retention periods.

10. Cookies and similar technologies

Swappy does not use advertising cookies, third-party analytics tools, fingerprinting or session recording.

When you open an individual commercial outreach link, we carry out our own limited measurement of the visit and interactions such as navigating between sections, using the demo or clicking access and contact buttons. This measurement does not use cookies, localStorage or persistent identifiers: the link code and random visit identifier exist only in the URL and in memory while the landing page is open.

Activity is associated with the business or contact to whom the link was sent, but it does not prove that a specific person opened the email or performed the action. The link may be shared and security services may open it automatically.

Strictly necessary cookies or technical mechanisms may be used for authentication, session maintenance and to protect the website and forms against abuse and automated requests.

11. Your rights

Where applicable, you may request:

• access to your data;
• correction of inaccurate data;
• deletion of data;
• restriction of or objection to processing;
• data portability, where applicable;
• withdrawal of consent, where applicable.

You also have the right to lodge a complaint with your local data protection authority. In Portugal: CNPD

12. Security

We apply technical and organisational measures intended to limit the collection, access and retention of data to what is necessary. No system is completely risk-free.

13. Changes to this policy

This policy may be updated when the service, providers or legal requirements change. The date of the latest version will always be shown at the top of the page.

14. Contact

For privacy, access or deletion requests, use Swappy's contact form. We may request enough information to locate the data, confirm the requester's identity and protect the privacy of other people and shops.