← Back to swayro

Privacy policy

Last updated 28 September 2026 · Covers this website, the Swayro application, cookies and the data processing agreement.

A working draft. The company is being registered; its full legal details will appear here before Swayro is sold to anyone, and the text will be reviewed by a lawyer before then.

This policy explains what Swayro (“Swayro”, “we”) does with personal data. We are the controller for the data described under “This website”, and the processor for the data your company puts into the application — see the data processing agreement.

This website

• Contact form. The name, company, email, phone number, team size and message you send. We use it to answer you and to keep track of the conversation if it becomes a customer relationship. Legal basis: steps taken at your request before entering a contract, and our legitimate interest in replying. Kept for two years after the last contact, unless you ask us to delete it sooner.
• Server logs. Our host records the usual technical data (IP address, browser, page, timestamp) to serve the site and defend against abuse. Kept for a short period by the host and not used to profile you.
• No analytics, no advertising pixels and no third-party trackers run on this site.

Cookies

This site sets no cookies at all. It stores two things in your browser's local storage — the language you picked and whether you chose light or dark — which stay on your device, are never sent to us, and disappear when you clear your browser data. Because none of that is tracking, there is no cookie banner to click away.

The application itself uses a strictly necessary cookie to keep you signed in. It is not used for analytics or advertising, and it cannot be turned off without making sign-in impossible.

The application

When your company uses Swayro, we process the data your company decides to put in: names and email addresses of users, roles, contracted hours, hours logged, leave, projects, clients, tasks, chat messages and invoicing data. Your company decides what goes in and why; we only process it to run the service, on your company's instructions.

Where the data is

• Database, files and backups are hosted in the European Union (Frankfurt, Germany).
• We do not transfer personal data outside the European Economic Area, except where a sub-processor listed below requires it, and then only under the European Commission's standard contractual clauses.

Sub-processors

We use a small number of specialist suppliers to run the service. Each is bound by a written agreement, processes data only on our instructions, and is named in full — company, role and country — in the data processing agreement, which you can ask for before you sign.

• Database, authentication and file storage — European Union.
• Hosting for the application and this website.
• Language-model processing, only for customers on the plan that includes the AI assistant, and only for the text of a request and the workspace data needed to answer it. It is not used to train anyone's model.
• Sending invitations, notifications and invoices by email.

We tell customers by email at least 30 days before we add or change a sub-processor, so they can object.

How long we keep it

• Workspace data: for as long as the subscription runs, then 30 days so you can export it, then deleted. Sooner on request.
• Invoices and accounting records: seven years, because Belgian law requires it.
• Support email: two years after the last message.

Security

• Everything travels over HTTPS and is encrypted at rest by the hosting provider.
• Each company's data is separated in the database itself, by row-level security, not only in the interface.
• Who can see what inside a workspace is enforced by the database, not only by the interface — see the roles in our terms. The owner can tighten several of those boundaries themselves.
• If a breach affects your data, we tell you without undue delay and, where the law requires it, within 72 hours of becoming aware of it.

What we can and cannot see

We run Swayro. That is not the same as being able to read what you put in it, and the two are worth separating precisely.

What we cannot do

• We cannot read your work: hours, notes, clients, projects, tasks, invoices, chat and planning are scoped to your own workspace in the database. Being the operator grants no read of any of it.
• We cannot change anything inside your workspace. There is no write path from us to your records.
• We cannot grant ourselves access. Support access can only be opened by the owner of the workspace concerned, from inside their own account.
• We cannot extend or widen access once it is given, and we cannot make it permanent. A grant carries a fixed scope and expiry and can only be closed early.
• We cannot erase the record of what we did. It is written where the owner of the affected workspace can read it, and we cannot edit or delete it.

What we can do

• See that a workspace exists and how much it is being used — its name, sign-up date, plan, number of people, and totals such as hours logged in the last 30 days. Counts, not records.
• See and change billing, on request from the owner. A change follows the same waiting period as one the owner makes themselves.
• Set the rules in section 2.2 of the terms, on request from the owner. The change is marked as made by us, so the owner can see it was not them.
• Read technical error reports the application sends when something breaks. These are capped in length, limited to a fixed set of kinds, and contain no workspace records — and the company that sent one cannot read it back either.

Recovering data after loss or theft

If data is lost, or an account is compromised, we can help — but only through a door you open:

1. The owner asks, in writing, from the address on the account.
2. The owner opens support access from inside their own Swayro, naming the reason.
3. The access expires within 72 hours and cannot be extended in place.
4. Everything we look at under it is logged where the owner can read it.
5. It is closed when the work is done, or expires by itself.

If the owner cannot sign in at all — the account is locked, the laptop is gone — we verify identity out of band before anything happens: the company registration number on file, a person named on that registration, and a second channel already recorded on the account. We do not make exceptions for urgency. Urgency is what someone impersonating you would bring.

Deleting your account

• Any user can delete their own login from inside the application at any time. It cannot be undone.
• Hours logged stay with the employer. A timesheet is an employment record and the employer is both entitled and required to keep it; an individual leaving does not erase their employer's books. Export your own copy first if you want one — the application offers it in the same place.
• The owner can delete the whole workspace from inside the application, which removes every record and every login in it.

Your rights

Under the GDPR you can ask for access to your personal data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. Use the contact form on the Swayro site and we answer within one month. If you are an employee of a customer, ask your own employer first — they decide what goes into their workspace, and we will pass your request on to them.

You can also complain to the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels — gegevensbeschermingsautoriteit.be.

Data processing agreement

For the data we process on a customer's behalf, a data processing agreement under Article 28 GDPR forms part of the contract. It sets out the subject matter and duration, the categories of data and data subjects, our obligation to act only on documented instructions, confidentiality, the security measures above, the rules on sub-processors, our help with data-subject requests and breach notification, and what happens to the data when the contract ends.

Ask for it before you sign and you get it — use the contact form on the Swayro site.

Changes

We update this policy when the service changes. The date at the top always says when. Material changes are announced by email to customers.

Prepared for Swayro and not legal advice. It will be reviewed before Swayro is sold to anyone.