Privacy Policy
Effective 15 August 2026 · Last updated 15 August 2026
How Swaptico collects, uses, shares and protects personal data, the legal bases for processing, retention, your UK GDPR data rights and how to exercise them.
1. Who we are
This Privacy Policy explains how Swaptico (the operator of the Swaptico marketplace, "we", "us", "our") collects and uses personal data when you use our platform. [Registered legal name and registered office of the operator to be confirmed before public launch.] You can contact us about privacy matters at legal@swaptico.com.
2. What we collect
We collect the following categories of personal data: account information (username, name, email address and/or phone number, password in hashed form); profile information you add (bio, photo, location, preferences); content you create (listings, photos, wants, saved searches, reviews, ratings, reports); swap and transaction records (offers, acceptances, cash adjustments, completion and cancellation events); messages between users; reward and payment history (points, levels, boosts, Pro subscription records — card details are processed by our payment provider and never stored by us); identity information you choose to provide (date of birth, verification documents where a category requires them); location information at the precision you choose; and technical information (IP address, device identifier, browser type, and security logs).
3. Location data
Location is always under your control. You choose your location precision (exact, area, city, region or country). Precise coordinates are used only to calculate swap distances and are never shown publicly on profiles or listings. When you agree to complete a swap that requires delivery or pickup, the address you provide to the other participant is shared only with that participant and only for the purpose of completing the swap.
4. Device identifier and security data
When you register or sign in, your browser generates a random, opaque device identifier that we store in your browser's local storage and send with requests. The identifier is not a fingerprint: it contains no information about your device, and the platform stores only a one-way hash of it, so the raw value cannot be recovered or used to identify you as an individual. We use it only to detect patterns such as many accounts sharing one device, which is an advisory signal for our fraud controls — never a basis for any automatic action. We also keep security logs (login events, failed logins, password changes, security alerts) and record the IP address of policy acceptances so we can demonstrate what you agreed to.
6. How we use your data
We use personal data to: provide and operate the marketplace (accounts, listings, matching, messaging, swaps, reviews and rewards); personalise your experience (language, currency, distance and preferences); keep the platform safe (moderation, fraud detection, risk scoring, spam prevention, device and network analysis, verification workflows); provide support and respond to enquiries, disputes and data-rights requests; comply with legal obligations (tax and platform-reporting duties, court orders, requests from authorities); and improve the platform (aggregated, anonymised statistics). We do not use your data for advertising, and we do not sell it.
7. Legal bases
Under the UK GDPR and EU GDPR, we process personal data on the following bases: performance of a contract with you (providing the service you signed up for, including recording your policy acceptances); our legitimate interests (operating and improving the marketplace, preventing fraud and abuse, and protecting users — balanced against your rights and interests); compliance with a legal obligation (tax reporting, lawful requests from authorities); and consent where we ask for it (for example, optional location sharing). Where we rely on legitimate interests, you can object at any time as described in section 12.
9. International transfers
Your data is processed on servers and by providers that may be located outside the United Kingdom and the European Economic Area. Where we transfer personal data internationally, we ensure appropriate safeguards are in place (such as the UK and EU standard contractual clauses and, where relevant, adequacy decisions), and you can request a copy of the relevant safeguards from legal@swaptico.com.
10. Automated decision-making and profiling
Swaptico uses automated systems to support, not replace, human decisions: risk scoring and trust scoring produce advisory scores based on explainable factors (account age, completed swaps, confirmed violations, shared devices and networks); AI screening analyses listings, messages and serial numbers — using deterministic, explainable signal analysis (optionally enhanced by an AI provider if the operator has configured one) — to flag possible prohibited, fraudulent or copied content; and findings are queued for human moderators to review. A weak or single signal never results in a ban or restriction on its own, and no decision that has a legal or similarly significant effect on you is taken purely by automated means. Where an automated system contributes to a decision about your account, listing or transaction, you can ask for human review and can appeal as described in the Fraud & Abuse Policy and the Terms of Service.
11. Retention
We keep personal data only for as long as needed for the purposes described in this policy: while your account is active we keep your data to operate the service; after you close your account, we retain records where required by law or for legitimate, documented purposes — for example transaction, review and financial records retained for tax and dispute purposes (with personal data removed), security and audit logs, and evidence preserved under a legal hold during an investigation. Verification documents are retained only for the configured validity periods (for example identity documents 2 years, proof of address 90 days) and are deleted or flagged for re-verification when they expire. When retention is no longer required, data is deleted or anonymised.
12. Your rights
Under the UK GDPR you have the right to: access a copy of your personal data; rectification of inaccurate data; erasure ("right to be forgotten"); restriction of processing; objection to processing based on legitimate interests; data portability (a structured, machine-readable copy); withdraw consent where consent is the basis; and not be subject to decisions based solely on automated processing that produce legal or similarly significant effects. You can exercise most of these yourself: export a copy of everything we hold about you and delete your account from Settings → Privacy & Data at any time. For anything else, email legal@swaptico.com. We will respond within one month as required by law.
13. Account deletion and retention exceptions
When you delete your account, we erase your personal data: your profile is anonymised, your listings and wants are deactivated, and your messages are removed from view. Because of how marketplaces work, records tied to completed transactions, reviews, disputes and financial records are retained in anonymised form so that transaction history, tax records and dispute evidence remain intact and verifiable — with your personal data removed. If your account is under a legal hold (for example during a fraud investigation or after a court order), erasure is deferred until the hold is lifted. These retention exceptions are explained in the Terms of Service and in the confirmation you receive when you delete your account.
14. Security
We protect personal data with appropriate technical and organisational measures: passwords are stored only as one-way hashes, device identifiers are stored only as salted hashes, tokens are short-lived and revocable, connections are encrypted in transit, access to personal data is limited to those who need it, and security events are logged and monitored. No system is completely secure, and we cannot guarantee absolute security; if a breach affects your data, we will notify you and the relevant supervisory authority as required by law.
15. Children
Swaptico is intended for users aged 18 and over. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, contact legal@swaptico.com and we will delete it.
16. Complaints
If you have a concern about how we handle your data, please contact us first at legal@swaptico.com and we will do our best to resolve it. You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk) — at any time.
17. Changes to this policy
We may update this Privacy Policy when our practices or the law change. Material changes are announced in the app and, where required, you will be asked to accept the updated version before continuing to use the platform. The version you accepted is recorded against your account, and previous versions are retained. This policy is version 1, effective 15 August 2026.
Related policies