←

Privacy policy

Last updated 13 October 2026 · Covers this website, the Swayro application, cookies, the companies we write to and the data processing agreement.

Who we are. Swayro is operated by Arthur De Crom, Belgium — [email protected], +32 456 81 54 75. The company behind Swayro is being registered; its name, registered office and enterprise number will be added here as soon as they exist, and before anything is invoiced.

This policy explains what Swayro (“Swayro”, “we”) does with personal data. We are the controller for the data described under “This website”, and the processor for the data your company puts into the application — see the data processing agreement.

This website

• Contact form. The name, company, email, phone number, team size and message you send. We use it to answer you and to keep track of the conversation if it becomes a customer relationship. Legal basis: steps taken at your request before entering a contract, and our legitimate interest in replying. Kept for two years after the last contact, unless you ask us to delete it sooner.
• Asking for an account. The company name, country, your name and email address, and your answers to the set-up questions. We use them to decide on the request and to set the workspace up. Legal basis: steps taken at your request before entering a contract. If we decline a request, it and the login made for it are deleted.
• Server logs. Our host records the usual technical data (IP address, browser, page, timestamp) to serve the site and defend against abuse. Kept for a short period by the host and not used to profile you.
• Visitor counts. We count page views with Cloudflare Web Analytics, which sets no cookies, stores nothing in your browser and does not fingerprint you. It records the page, the referring site, the country and the type of browser and device — no IP addresses and nothing that identifies you. No advertising pixels and no other trackers run on this site, and its typefaces are served from the site itself, so opening a page tells no font provider that you did.

Companies we write to

We look for companies that Swayro could suit and sometimes write to them. For that we keep a list with, per company: its name, website, general email address (such as info@…), phone number, town, sector, and the date we wrote and any reply.

• Where it comes from. Public sources only: OpenStreetMap, which is open data, and the company's own website, which we read for its general contact details and for the legal form it states. We do not use the Crossroads Bank for Enterprises for this, and we do not buy lists.
• Who we write to. Businesses in Belgium, France and Luxembourg, at their general address only. We leave out named people's email addresses, and a business whose own website says it is run by one person as a sole trader is not written to without having asked.
• Why we may. Our legitimate interest in making Swayro known to businesses it could be useful to, and the room the law of each of those countries leaves for a message about a business's own work sent to its general address, with a way to refuse in every message.
• What we see afterwards. Per company, whether the logo in our email was loaded and whether its button was followed to this website. That tells us if a message was looked at; it does not tell us who looked.
• Saying no. Every email has a one-click way out. Use it, or simply reply “no” or “stop”, and we do not write again; we keep only the note that you asked, so that it stays that way. You can also ask us to delete your company's entry altogether: [email protected].
• How long. Two years after the last contact, unless you ask us to remove it sooner.

Cookies

This site sets no cookies at all. It stores two things in your browser's local storage — the language you picked and whether you chose light or dark — which stay on your device, are never sent to us, and disappear when you clear your browser data. Because none of that is tracking, there is no cookie banner to click away.

The application itself uses a strictly necessary cookie to keep you signed in. It is not used for analytics or advertising, and it cannot be turned off without making sign-in impossible.

An automated cookie scanner may still report this site as needing consent. That is because such tools check whether a consent banner is present, not whether any cookies are actually set — and they often earn their keep selling the banner they tell you that you are missing. Here there is nothing to consent to: no advertising or statistics cookies are placed before or after you do anything, so there is nothing to block and nothing to ask about. Setting no non-essential cookies is how a site meets the ePrivacy Directive and the GDPR on this point — not by adding a pop-up on top of them.

The application

When your company uses Swayro, we process the data your company decides to put in: names and email addresses of users, roles, contracted hours, hours logged, leave, projects, clients, tasks, chat messages and invoicing data. Your company decides what goes in and why; we only process it to run the service, on your company's instructions.

Knowing your devices. So that we can email you when your account is used to sign in somewhere new, the application keeps a random identifier in each browser or phone you sign in on, together with what kind of device it is (“Chrome on Mac”) and when it was last used. Nothing about the device itself is measured, and the list is not used for anything else.

Signing in with Google. If you choose to sign in with Google (and, once available, Microsoft), that company confirms who you are and sends us your name, email address and profile picture — nothing else. We send them nothing from your workspace. You can always sign in with an email address and password instead.

Where the data is

• Database, files and backups are hosted in the European Union (Frankfurt, Germany).
• We do not transfer personal data outside the European Economic Area, except where a sub-processor listed below requires it, and then only under the European Commission's standard contractual clauses.

Sub-processors

We use a small number of specialist suppliers to run the service. Each is bound by a written agreement, processes data only on our instructions, and is named in full — company, role and country — in the data processing agreement, which you can ask for before you sign.

• Database, authentication and file storage — European Union.
• Hosting for the application and this website.
• Language-model processing, only for customers on the plan that includes the AI assistant, and only for the text of a request and the workspace data needed to answer it. It is not used to train anyone's model.
• Sending invitations, notifications and invoices by email.
• A certified Peppol access point, for customers who send their invoices over Peppol: it receives the invoice and the details of sender and recipient.

We tell customers by email at least 30 days before we add or change a sub-processor, so they can object.

How long we keep it

• Workspace data: for as long as the subscription runs, then 30 days so you can export it, then deleted. Sooner on request.
• Invoices and accounting records: seven years, because Belgian law requires it.
• Support email: two years after the last message.

Security

• Everything travels over HTTPS and is encrypted at rest by the hosting provider.
• Each company's data is separated in the database itself, by row-level security, not only in the interface.
• Who can see what inside a workspace is enforced by the database, not only by the interface — see the roles in our terms. The owner can tighten several of those boundaries themselves.
• If a breach affects your data, we tell you without undue delay and, where the law requires it, within 72 hours of becoming aware of it.

What we can and cannot see

We run Swayro. That is not the same as being able to read what you put in it, and the two are worth separating precisely.

What the product does not let us do

• The console we run Swayro from cannot read your work: hours, notes, clients, projects, tasks, invoices, chat and planning are scoped to your own workspace in the database, and the console is given counts, not records.
• We cannot change anything inside your workspace. There is no write path from us to your records.
• We cannot grant ourselves access. Support access can only be opened by the owner of the workspace concerned, from inside their own account.
• We cannot extend or widen access once it is given, and we cannot make it permanent. A grant carries a fixed scope and expiry and can only be closed early.
• We cannot erase the record of what we did. It is written where the owner of the affected workspace can read it, and we cannot edit or delete it.

One thing these safeguards do not cover, and it is better said than left out: as with any hosted service, whoever administers the database itself can technically reach what is stored in it. At Swayro that is the founder alone. It is done only on a written request from the owner of the workspace concerned — to recover or export data, for example — limited to what the request needs, and the owner is told what was done.

What we can do

• See that a workspace exists and how much it is being used — its name, sign-up date, plan, number of people, and totals such as hours logged in the last 30 days. Counts, not records.
• See and change billing, on request from the owner. A change follows the same waiting period as one the owner makes themselves.
• Set the rules in section 2.2 of the terms, on request from the owner. The change is marked as made by us, so the owner can see it was not them.
• Read technical error reports the application sends when something breaks. These are capped in length, limited to a fixed set of kinds, and contain no workspace records — and the company that sent one cannot read it back either.

Recovering data after loss or theft

If data is lost, or an account is compromised, we can help — but only through a door you open:

1. The owner asks, in writing, from the address on the account.
2. The owner opens support access from inside their own Swayro, naming the reason.
3. The access expires within 72 hours and cannot be extended in place.
4. Everything we look at under it is logged where the owner can read it.
5. It is closed when the work is done, or expires by itself.

If the owner cannot sign in at all — the account is locked, the laptop is gone — we verify identity out of band before anything happens: the company registration number on file, a person named on that registration, and a second channel already recorded on the account. We do not make exceptions for urgency. Urgency is what someone impersonating you would bring.

Deleting your account

• Any user can delete their own login from inside the application at any time. It cannot be undone.
• Hours logged stay with the employer. A timesheet is an employment record and the employer is both entitled and required to keep it; an individual leaving does not erase their employer's books. Export your own copy first if you want one — the application offers it in the same place.
• The owner can delete the whole workspace from inside the application, which removes every record and every login in it.

Your rights

Under the GDPR you can ask for access to your personal data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. Use the contact form on the Swayro site and we answer within one month. If you are an employee of a customer, ask your own employer first — they decide what goes into their workspace, and we will pass your request on to them.

You can also complain to the data protection authority of the country you live or work in (in France the CNIL, in Luxembourg the CNPD), or to ours: the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels — gegevensbeschermingsautoriteit.be.

Data processing agreement

For the data we process on a customer's behalf, a data processing agreement under Article 28 GDPR forms part of the contract. It sets out the subject matter and duration, the categories of data and data subjects, our obligation to act only on documented instructions, confidentiality, the security measures above, the rules on sub-processors, our help with data-subject requests and breach notification, and what happens to the data when the contract ends.

Ask for it before you sign and you get it — use the contact form on the Swayro site.

Changes

We update this policy when the service changes. The date at the top always says when. Material changes are announced by email to customers.

Questions about this policy: [email protected].