This agreement applies when Sway SRL ("the processor") processes personal data on behalf of a customer ("the controller") through openshield. It is part of the terms of service and meets article 28 of the General Data Protection Regulation (GDPR). It starts when the customer creates an account and lasts as long as the customer uses the service.
1. What is processed
- Subject: the moderation of images and texts that the controller sends to the API, and, when the controller turns fraud prevention on, the scoring of the events about its users that it sends to the fraud API.
- Nature: automatic analysis in memory, which returns a decision and the reasons for it. The processor keeps nothing of the content. Once the controller has topped up its balance, a text sent to review is also analysed by the sub-processor TypeSafe AI, Inc. (United States), as the annex of this agreement describes.
- Nature (fraud prevention): the events are kept in an instance that belongs to the controller alone, where the controller's rules score them, link related accounts and open cases. Email addresses, phone numbers, IP addresses and device identifiers are replaced by keyed pseudonyms before any rule sees them; the raw values are not stored. The processor enriches each event with network data derived from the IP address (operator, country, Tor exit, VPN, data centre, disposable email domain), from lists mirrored daily on its node. It checks the instance's webhooks, signs them again with the controller's own secret and delivers them to the https address the controller set. By default, it promotes a shadow rule to act automatically once the rule is reliable, as the terms describe; for that, the sub-processor TypeSafe AI, Inc. reviews pseudonymized timelines of up to 10 accounts the rule hit, and answers a probability.
- Purpose: to return the moderation result or the fraud decision to the controller, and for no other purpose.
- Types of personal data: whatever the content holds, which the controller decides: faces and bodies in images, names, contact details or any other personal data in texts, and the optional reference (the
reffield) the controller attaches to a check. The processor does not ask for, and does not need, special categories of data, but moderated content can hold them. - Types of personal data (fraud prevention): whatever the controller puts in its events: account identifiers, pseudonyms of email addresses, phone numbers, IP addresses and devices, a country, the browser and system read from a
User-Agent, and the attributes the controller adds. - Data subjects: the controller's users, and anyone who appears in the content.
- Duration: the content is forgotten when the answer has been sent. The result of each check (never the content) is kept in the decision journal for 7 days until the controller first tops up its balance and 30 days after, so that the controller can read it. The events, decisions and cases of fraud prevention are kept 30 days until the controller first tops up its balance and 90 days after.
2. Instructions
The processor processes personal data only on the controller's documented instructions, which are these terms, the use of the API and the dashboard, and the settings the controller chooses (such as its workflows, its fraud rules and packs, its lists, its webhook address and the rule promotion setting: automatic, manual, or automatic for rules that only hold or send to review). If the processor thinks an instruction breaks data protection law, it tells the controller. Where the law requires the processor to process data otherwise, it tells the controller first, unless the law forbids it.
3. Confidentiality
The processor makes sure that the people who may process the data are bound by confidentiality.
4. Security (article 32)
The processor takes the technical and organisational measures that fit the risk, including:
- content is processed in memory only, with no copy kept in the processor's logs, queues or storage;
- connections are encrypted, and the systems of the service talk to each other through signed requests;
- API keys are stored as hashes, and a key is shown only once;
- account owners must use two-factor authentication before topping up a balance;
- data at rest is stored in the European Union, except what the sub-processor of the advanced AI workflows keeps of the texts it receives;
- access to the service's systems is limited and logged;
- the checking server accepts remote administration with keys only, behind a host firewall and an intrusion-prevention service, and installs security updates automatically;
- backups are encrypted before they leave the server and are stored in the European Union for 30 days;
- abuse protection on the API and on sign-in forms;
- fraud prevention: keyed pseudonyms (HMAC) for email addresses and IP addresses, the raw values never stored and the
User-Agentdropped after reading; - fraud prevention: one isolated instance per organization, with a derived key and admin token per instance, in a read-only container with no capability, on an internal network with no internet access;
- fraud prevention: events, decisions and cases purged after 30 days until the controller first tops up, 90 days after, and access through scoped API keys.
5. Sub-processors
The controller gives a general authorisation for the sub-processors in the annex of this agreement. The processor binds each of them by a contract that gives the same level of data protection as this agreement, and remains responsible for them towards the controller.
The processor tells the controller by email at least 30 days before it adds or replaces a sub-processor. The controller may object on reasonable grounds related to data protection within that time. If the parties cannot agree, the controller may end the subscription before the change takes effect, without any charge.
6. International transfers
The processor's data at rest stays in the European Union. Some sub-processors are United States companies and handle requests outside the European Union. Those transfers rely on the EU-U.S. Data Privacy Framework, with the standard contractual clauses of the sub-processor's terms as the fallback; the transfer of the texts of the advanced AI workflows to TypeSafe AI, Inc. relies on the standard contractual clauses of its data processing agreement. The privacy policy gives the detail.
7. Assistance
Taking into account the nature of the processing, the processor helps the controller:
- answer requests from data subjects (access, erasure and the other rights of chapter III of the GDPR). For content, which is not kept, there is usually nothing to find; the processor says so, and helps with the journal. For fraud data, the controller can export what is kept about one person through
/fraud/v1/subjects/{id}/exportand erase it throughDELETE /fraud/v1/subjects/{id}, and the processor helps where the API is not enough. openfraud also provides statements of reasons and an appeal route (/fraud/v1/statements/{id},/fraud/v1/cases/{id}/appeal) so that the controller can meet article 22 of the GDPR. The controller does not use a score, signal or decision of openfraud as the only basis of a decision about a person that has legal or similarly significant effects (for example on credit, insurance, employment, housing or access to an essential service) without a person's review; - meet its duties on security, breach notification, impact assessments and prior consultation (articles 32 to 36), with the information it has.
8. Personal data breaches
The processor tells the controller of a personal data breach that concerns the controller's data without undue delay, and in any case within 48 hours of becoming aware of it, with what it knows: what happened, which data, the likely effects and the measures taken. It keeps a record of each breach, as article 33(5) requires.
9. Deletion and return
Content is not kept, so there is nothing to return. The controller can export its workflows, journal and usage from the dashboard, and what its fraud instance keeps about one person through the fraud API. Turning fraud prevention off erases the instance and its data. When the controller deletes its organization, its data stays available for 30 days so that it can take it out, and is then erased. Invoices and accounting records that the law makes us keep are the exception, and the processor handles them as controller.
10. Audits
The processor gives the controller the information needed to show that it meets article 28, and allows audits, including inspections, by the controller or by an auditor the controller appoints, once a year, with 30 days' notice, at the controller's cost and under confidentiality.
11. Network data (opt-in)
Network data is optional and off by default. It applies only while the controller has turned it on in the fraud settings of the dashboard, and it ends when the controller turns it off.
- Roles. For the controller's own events the processor stays a processor. For the aggregates it builds from the customers that opted in, the processor acts as an independent controller, for one purpose: preventing fraud and abuse across its customers (legitimate interest, GDPR article 6(1)(f) and recital 47). By opting in, the controller allows the processor to read the labels and values below from its fraud instance for that purpose, and for no other.
- What is used. Only for the accounts the controller labelled fraud or legitimate (a false positive counts as legitimate): a network pseudonym of the IP network (the /24 of an IPv4 address, the /48 of an IPv6 address) and of the device, made with a network key that is not the key of any instance and never leaves the processor's backend; the registered domain of the email address, unless it belongs to a free mailbox provider (gmail.com, outlook.com and the like), which is never used; the network operator (AS number); and the label. The raw IP address, email address and device identifier, the account identifier and the content of an event are never used.
- K-anonymity. A value is published only when at least 3 distinct customers saw it, in at least 10 accounts together, with at least 80 % of them labelled fraud and no single customer behind more than half of them. What is published is membership in a list, with a tier (
highorelevated): no count, no customer, no account. - What the controller gets. The lists built that way, for its fraud instance, refreshed daily, for as long as it shares. A customer that does not share gets nothing.
- Retention. An entry that no nightly run has confirmed for 90 days is deleted. When the controller opts out, turns fraud prevention off or deletes its organization, what it brought leaves the aggregates at the next nightly run, and it no longer gets the lists.
- The controller's duties. The controller tells its users, in its own privacy policy, that signals about fraud are shared with the processor, Sway SRL, which combines them and gives the result to the other customers that share, and keeps its labels accurate: an account is labelled fraud only on evidence, and a mistake is corrected by labelling the account legitimate.
- No reversal. The controller does not try to reverse a network pseudonym, or to link a list entry to a person, other than by using the list in its fraud rules as the service provides.
- Joint control. If an authority or a court holds that the controller and the processor are joint controllers of the step in which the labels are passed to the processor, the processor answers people's requests about it and the information duties towards them (article 26 of the GDPR), and the essence of this section is available to anyone who asks at contact@sway.events.
- Rights. The processor could recompute a pseudonym from a raw value, so it treats the aggregates as personal data. It answers a person's request about them at contact@sway.events, and the controller helps it as article 28 provides.
12. Contact
Sway SRL, Clos des Colombes 23, 1342 Limelette, Belgium. Email: contact@sway.events.
Annex: sub-processors
A sub-processor is a provider that Sway SRL uses to run openshield and that handles data on its behalf. This list is part of this agreement.
The list
| Sub-processor | What it does for us | Where | Safeguard for transfers outside the EU |
|---|---|---|---|
| Cloudflare, Inc. (United States) | The website, the dashboard and the front door of the API; the databases and file storage; the secure tunnel to the checking server; bot protection on sign-in forms (Turnstile); transactional email; the relay of fraud API calls and the delivery of re-signed fraud webhooks | Data at rest in the European Union. Requests are handled in the Cloudflare location closest to the visitor, which can be outside the EU | EU-U.S. Data Privacy Framework, with the standard contractual clauses of Cloudflare's data processing addendum if the certification lapses |
| Hetzner Online GmbH (Germany) | The server that checks images and texts, in memory, and keeps each organization's fraud instance and its data (backed up, encrypted, to Cloudflare in the European Union for 30 days); the server that receives our error reports and checks that the service is up | The checking server in Nuremberg, Germany; the error reports and the uptime checks in Nuremberg, Germany | None needed: the servers are in the European Union |
| TypeSafe AI, Inc. (United States) | Only once the controller has topped up its balance, the advanced reading: a decision model that reads a text the first check sent to review, with the context sent with it, and answers with probabilities. Never images, never the texts of a controller that has never topped up. Also the fraud rule review: the decision model reads pseudonymized timelines of up to 10 accounts a rule hit (event types, times, pseudonymized email, IP network prefix and lists, country, decisions and rule ids, never a raw email or IP address) and answers a probability; it keeps nothing | United States | The standard contractual clauses of TypeSafe AI's data processing agreement |
| Stripe (payments) | Payments, saved cards for automatic top-ups, subscriptions, invoices and tax calculation | Stripe Payments Europe, Limited (Ireland), with processing in the European Union and the United States | EU-U.S. Data Privacy Framework, with the standard contractual clauses of Stripe's data transfers addendum if the certification lapses |
Cloudflare publishes its own list of sub-processors at cloudflare.com/gdpr/subprocessors.
The privacy policy says what each one sees.
Changes to this list
We tell account owners by email at least 30 days before we add a sub-processor or replace one, and this annex changes on the same day. A customer who objects for a reason related to data protection can end the subscription before the change takes effect, as section 5 describes.