Privacy Policy

1. Introduction

Welcome to Swapzy ("we", "our", "us", or "Company"). We are committed to protecting your privacy and ensuring transparency in how we collect, use, and protect your personal information. This Privacy Policy explains our practices regarding data collection and processing when you use our face swap service at swapzy.pro (the "Service").

By accessing or using our Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, please do not use our Service.

This Privacy Policy complies with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws.

2. Information We Collect

2.1 Personal Information

We collect information that identifies, relates to, or could reasonably be linked with you:

• Account Information: Email address, full name, username, and password (encrypted)
• Payment Information: Billing address, payment method details (processed securely through Stripe)
• Profile Information: Profile picture, preferences, and settings
• Communication Data: Support tickets, emails, and feedback you provide

2.2 User Content

• Source Media: Images and videos you upload for face swap processing
• Generated Content: AI-processed face swap results
• Metadata: File names, timestamps, resolution, and processing parameters

2.3 Automatically Collected Information

• Device Information: IP address, browser type and version, device type, operating system
• Usage Data: Pages visited, features used, time spent, click patterns, generation history
• Technical Data: API usage, error logs, performance metrics
• Location Data: General location (country/region) inferred from IP address

2.4 Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience:

• Essential Cookies: Required for authentication and basic functionality
• Analytics Cookies: Help us understand how you use our Service (Vercel Analytics)
• Preference Cookies: Remember your settings and preferences (theme, language)

You can control cookies through your browser settings. However, disabling essential cookies may limit your ability to use certain features of our Service.

3. How We Use Your Information

We use the collected information for the following purposes:

3.1 Service Provision

• Process face swap requests using AI technology
• Manage your account and provide customer support
• Process payments and manage subscriptions
• Send service-related notifications and updates

3.2 Service Improvement

• Analyze usage patterns to improve our AI models
• Develop new features and enhance existing functionality
• Optimize performance and user experience
• Conduct research and development

3.3 Security and Compliance

• Detect, prevent, and address fraud or abuse
• Enforce our Terms of Service and policies
• Comply with legal obligations and requests
• Protect the rights, property, and safety of Swapzy and our users

3.4 Marketing (With Your Consent)

• Send promotional emails about new features or plans (you can opt-out anytime)
• Provide personalized recommendations

4. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA), we process your personal data based on:

• Contract Performance: Processing necessary to provide our Service
• Legitimate Interests: Improving our Service, fraud prevention, security
• Legal Obligation: Compliance with laws and regulations
• Consent: Marketing communications (which you can withdraw at any time)

5. Data Sharing and Disclosure

We do not sell your personal information. We may share your data only in these circumstances:

5.1 Service Providers

We work with trusted third-party companies that help us operate our Service:

• Supabase: Authentication, database, and file storage
• Vercel: Hosting, CDN, and analytics
• Stripe: Payment processing (PCI-DSS compliant)

These providers are contractually bound to protect your data and use it only for the purposes we specify.

5.2 Legal Requirements

We may disclose your information if required by law, court order, or government request, or if we believe disclosure is necessary to protect our rights or the safety of others.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change.

6. Data Storage and Security

We implement comprehensive security measures to protect your information:

6.1 Technical Measures

• End-to-end encryption using TLS 1.3 for data in transit
• AES-256 encryption for data at rest
• Secure, encrypted cloud storage infrastructure
• Regular security audits and penetration testing
• Automated backup systems with redundancy

6.2 Organizational Measures

• Access controls and role-based permissions
• Employee confidentiality agreements
• Regular security training for staff
• Incident response and data breach notification procedures

6.3 Data Processing

• Temporary processing files are automatically deleted within 24 hours
• Source media can be deleted immediately after generation completes
• All sensitive operations are logged and monitored

While we implement robust security measures, no method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we continuously work to protect your data.

7. Data Retention

We retain your information for as long as necessary to provide our Service and comply with legal obligations:

• Account Data: Retained while your account is active, plus 30 days after deletion
• Generated Content: According to your subscription tier limits (20-2,000 generations)
• Transaction Records: 7 years (for tax and accounting purposes)
• Temporary Files: Automatically deleted within 24 hours of processing
• Logs and Analytics: 90 days

You can delete your generated content at any time from your gallery. When you delete your account, all personal data and generated content are permanently removed within 30 days, except for data we must retain for legal compliance.

8. Your Privacy Rights

Depending on your location, you have the following rights regarding your personal data:

8.1 Universal Rights

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Deletion: Request deletion of your data ("right to be forgotten")
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to processing of your data for certain purposes
• Right to Restrict Processing: Limit how we use your data
• Right to Withdraw Consent: Withdraw consent for data processing at any time

8.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights:

• Right to know what personal information is collected, used, and shared
• Right to delete personal information
• Right to opt-out of the sale of personal information (we do not sell your data)
• Right to non-discrimination for exercising your privacy rights
• Right to correct inaccurate personal information
• Right to limit use of sensitive personal information

8.3 How to Exercise Your Rights

To exercise any of these rights, please:

• Email us at privacy@swapzy.pro
• Use the privacy controls in your account settings
• For deletion requests, we will respond within 30 days

We may need to verify your identity before processing your request. We will not discriminate against you for exercising your privacy rights.

9. International Data Transfers

Swapzy operates globally. Your information may be transferred to and processed in countries other than your country of residence, including the United States and European Union. These countries may have different data protection laws.

When we transfer your data internationally, we ensure adequate safeguards are in place:

• Standard Contractual Clauses approved by the European Commission
• Data processing agreements with all service providers
• Compliance with applicable data protection laws

10. Children's Privacy

Our Service is not intended for children under 13 years of age (or 16 in the EEA). We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@swapzy.pro, and we will delete such information.

11. Automated Decision Making

We use AI technology to process face swaps, which involves automated processing of your uploaded media. However, we do not use automated decision-making that produces legal effects or similarly significantly affects you without human intervention. You can contact us to request human review of any automated decision.

12. Do Not Track Signals

Some browsers have a "Do Not Track" feature that signals to websites that you do not want your online activities tracked. Our Service does not currently respond to Do Not Track signals because there is no industry standard for how to respond to such signals.

13. Data Breach Notification

In the unlikely event of a data breach that affects your personal information, we will:

• Notify affected users within 72 hours of becoming aware of the breach
• Notify relevant supervisory authorities as required by law
• Provide details about the nature of the breach and steps taken
• Offer guidance on protective measures you can take

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes:

• By email (to the address associated with your account)
• Through a prominent notice on our Service
• By updating the "Last updated" date at the top of this policy

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

15. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

16. Glossary

• Personal Data/Information: Any information relating to an identified or identifiable individual
• Processing: Any operation performed on personal data, such as collection, storage, use, or deletion
• Controller: The entity that determines the purposes and means of processing personal data (Swapzy)
• Processor: An entity that processes personal data on behalf of the controller (our service providers)
• Data Subject: The individual whose personal data is being processed (you)