Datenschutzerklärung

1. Who we are

Swish is operated by [company legal name], [registered address], United Arab Emirates ("Swish", "we"). For questions about this policy, use the contact form on our website with the topic Security, or write to [privacy email address].

When an organisation gives its members Swish accounts, the organisation decides how those accounts are used, and we process its members' data on its behalf.

2. What we collect

Your account: your name, email address and language, and how you sign in (an emailed code, Google, Apple, Microsoft, LinkedIn or your organisation's single sign-on).

Your cards: everything you put on them, such as your title, company, phone numbers, links, photo, logo and documents.

The people you meet: contacts you save from rooms, read with Snap from a paper card or badge, add by hand, or that people send you from your card. With each one we keep the date and, if you choose, the event and the city where you met. Your exact location is never stored with a contact or in your account.

Your follow-ups and notes, which only you can see.

Your Swish ID and the work email you confirm. Your connections, the people you block, the Circles you join and what you offer and need in them, your Now updates, messages and Taps, your notification choices and the offers you redeem. Each of these is visible only to the people you chose.

Name confirmation, if you ask for it: the name and company you give and one document that shows them. Only authorised staff can open the document, each opening is logged, and it is deleted as soon as your request is decided. We keep the outcome and the confirmed name.

Find each other, if you use it at an event: when you and one other person both agree, you can share a meeting point or your device's position with that person for a few minutes. A shared position is held briefly in memory, goes only to them, and is removed when sharing ends. It is never written to our database. We keep who asked whom and when, and delete that 30 days after it ends.

Connections you choose to make to HubSpot, Salesforce, Google or Microsoft. Their access tokens are stored encrypted.

Card views: the channel (for example QR or NFC), the kind of device and the country, as totals for the card's owner. We do not store visitors' IP addresses and do not use advertising or analytics cookies on cards.

Messages you send us through the contact form.

Payments: Stripe processes card payments. We keep the plan, its status and Stripe's customer reference, never your card number.

3. Why we use it

To provide Swish: showing your card, exchanging contacts, rooms, search, reminders and the features you turn on.

To keep Swish secure: preventing abuse, rate limiting and investigating problems.

To reply to you and to send messages about your account. We do not send marketing email unless you ask for it, and sharing your details back from someone's card never subscribes you to anything.

[Legal review: legal bases under the UAE Personal Data Protection Law and, where it applies, the GDPR.]

4. Where it is kept, and who helps us

Swish stores your data in the United Arab Emirates (Microsoft Azure, UAE North).

Some services handle specific tasks and may process data outside the UAE: Anthropic (reading card photos with Snap and drafting follow-ups when you ask), Resend (delivering email), Stripe (payments), Sentry (error reports without personal details), Cloudflare Turnstile (stopping spam on public forms), Apple and Google (Wallet passes and notifications), and the CRM or email services you connect.

[Legal review: transfer safeguards and the list of sub-processors.]

5. How long we keep it

Your account data stays until you delete your account. When you do, your cards stop working at once and everything is deleted 30 days later, including stored images.

Contacts that other people saved from your card belong to them; after deletion they no longer link to your account.

Contact-form messages are deleted after 180 days.

Messages, Taps and connections stay until you or the other person deletes your account. Now updates and find sessions are deleted 30 days after they end. Read notifications are deleted after 90 days and all notifications after a year. Circle invitations nobody accepted are deleted 30 days after they expire.

[Legal review: backup retention.]

6. Your choices and rights

You can download everything Swish keeps about you, as JSON, CSV or vCard, from Settings.

You can correct your details at any time, get a new card link, hide your card from search engines (the default), block or report anyone, turn off each kind of notification, and delete your account.

You can ask us to restrict or stop processing, or complain to a data protection authority. [Legal review: the authority and how to reach it.]

7. Cookies and storage

Swish uses a sign-in cookie, a cookie that remembers your language, and your browser's storage for your theme and, if you join a room as a guest, your guest session. It does not use advertising or third-party analytics cookies.

8. Children

Swish is for professional use and not for children under [age].

9. Changes

We will tell you before a change that affects how we use your data, by email or in Swish. The date above shows the latest version.