Privacy and data
This page summarizes how data is handled. The privacy policy, the data processing agreement and the list of sub-processors are the binding texts.
Your content is never stored
Images and texts are checked in memory and forgotten when the answer is sent. There is no copy, no thumbnail, no excerpt and no hash of them, in logs or anywhere else. Nothing holds your content in a queue, and it is not used to train models.
Once you have topped up, the advanced reading also sends a text that the first check sends to review, with its context, to a sub-processor in the United States. The privacy policy says who it is and what it keeps.
For the personal data your content may hold, Sway SRL is your processor: it processes the content only to return the decision, on your instructions.
Fraud prevention data
The fraud prevention API is the exception to "nothing is stored", because a fraud decision needs a history. Each organization has an instance of its own, so its events, accounts and cases never mix with anyone else's.
- Events, decisions and cases are kept 30 days until your first top-up and 90 days after, then deleted. The sandbox keeps them 30 days.
- Email addresses, phone numbers, IP addresses and devices are replaced by keyed pseudonyms before any rule sees them, and the raw values are not stored. The
User-Agentis read for the browser, the system and the signs of automation, then dropped. - You can export what is kept about one person, and erase it, with one call each (
GETandDELETEon/fraud/v1/subjects/{id}). - When you turn fraud prevention off, the instance and its data are erased.
What is kept
| Data | Holds | Kept |
|---|---|---|
| The decision journal | For each check: the time, the request id, the key, the kind, the workflow and its version, the decision, the reasons with scores and thresholds, the duration, the size and your ref. Never the content. | 7 days until your first top-up, 30 days after |
| Usage counters | Checks per hour, key, workflow and kind. | While the organization exists |
| Account and organization | Email addresses, names, members and roles, plan, workflows, keys (as hashes only). | While the organization exists |
| Dashboard sessions | For each browser signed in: its IP address, its browser and when it signed in. | Until the session expires or you sign out |
| Audit log | Who changed what in the dashboard, with the network prefix of their IP address (IPv4 /24 or IPv6 /48), never the full address. | While the organization exists |
| Billing | Handled by Stripe; invoices are kept as accounting law requires. | See the privacy policy |
| Fraud events, decisions and cases | Only if you turned fraud prevention on. What you report and what was decided, with email addresses, phone numbers, IP addresses and devices as keyed pseudonyms. | 30 days until your first top-up, 90 days after |
The journal never stores the IP address or the browser of your users, only what you send in ref.
Where it runs
- The databases and the file storage are in the European Union.
- The checking server is in the European Union.
- The fraud prevention instances run on a server in Germany.
- The website, the dashboard and the front door of the API are delivered through Cloudflare's network, so a request is handled in the Cloudflare location closest to the sender.
Your data, your exit
You can export your workflows (JSON), your journal (JSONL or CSV) and your usage (CSV) at any time from the dashboard. When you delete your organization, the keys stop at once and your data stays available for 30 days so that you can take it out, then it is erased. The fraud instance's data can be exported and erased person by person at any time, as described above.
Questions
Write to contact@sway.events.