Privacy Policy

Last updated: 5 May 2026 · Effective: 5 May 2026

1. Who processes your data

The data controller within the meaning of GDPR Art. 4(7) and the Ukrainian Law on Personal Data Protection is:

2. What data we collect

2.1. Data you provide

• Phone number — for SMS-code authentication (TurboSMS)
• Email — for admin access, support, and digest subscription
• Name / company name, EDRPOU code, region, address — for CRM records
• Activity segment, farm size, crops, business type — for agricultural analytics (optional)
• Order history, deal records, message history — for CRM accounting and B2B communication
• Content you publish — marketplace listings, reviews, chat messages
• Text of your Solomia AI messages — processed via Google Gemini API (see Section 4)

2.2. Data collected automatically

• IP address — for security and rate limiting (stored as SHA-256 hash for 90 days, then deleted)
• App version and device model — for error diagnostics
• Activity logs — login times, performed operations (for audit)
• Technical cookies — for sessions only; no advertising trackers
• Crash logs (iOS) — anonymous crash reports via Apple App Store

2.3. What we do NOT collect

• Real-time geolocation
• Phone book contacts
• Photo gallery (except those you knowingly upload)
• Bank card data (payments are processed exclusively by certified payment providers)
• Biometric data (Face ID/Touch ID is processed only locally on your device — by Apple, not SWAPWARE)
• Data for advertising trackers — we do not run ads and do not share your data with ad networks

3. Legal bases for processing (GDPR Art. 6)

3.1. Agricultural CRM contact database

SWAPWARE maintains a CRM database of B2B contacts in the Ukrainian agricultural sector, partially compiled from the company director's professional contacts accumulated over more than 20 years in the industry. The legal basis is legitimate interest (GDPR Art. 6(1)(f)) for conducting business communication between legal entities and representatives of agricultural enterprises.

If you are in our CRM and do not wish your contact data to be processed:

• Email privacy@swapware.com.ua with the subject "Data deletion"
• We will delete your data within 30 days and send confirmation
• If we have a contract with you as a legal entity, data may be retained as required by Ukrainian and Austrian accounting law (typically 3-7 years)

4. Solomia AI and Google Gemini text processing

Solomia is an AI assistant built on Google Gemini API. Technical architecture:

• Your message is sent from your device to a SWAPWARE server (Hetzner, Germany)
• From there, the text is forwarded to Google LLC (USA) via Gemini API
• Google generates a response and returns it through our infrastructure
• We store messages in a SQLite database (Hetzner, Germany) for conversation history and to improve AI response quality

Do not enter confidential information into Solomia (passwords, banking details, third parties' personal medical data, etc.). Data transfer to the USA is based on the EU Standard Contractual Clauses.

Google AI Studio / Gemini API privacy policy: ai.google.dev/gemini-api/terms

5. Voice calls via Twilio (when activated)

The telephony function is built on Twilio (USA). Recordings are stored for up to 90 days, encrypted, and used solely for quality assurance of Solomia AI. You may request deletion of your recordings at any time via privacy@swapware.com.ua.

6. Who we share data with (Processors)

We share data with the parties below under Data Processing Agreements (DPAs) that bind them to GDPR standards:

We do NOT sell your data to third parties for marketing or advertising purposes.

7. Data retention and deletion

• Active account data — for as long as you use the service
• Deleted account data — completely erased within 30 days
• Backups — daily, retained for 30 days
• Security logs (IP hash, timestamps) — 90 days, then deleted
• Voice call recordings — up to 90 days
• Accounting documents (invoices, contracts) — per Austrian and Ukrainian law (typically 7 years)

8. Your rights

Under GDPR (Art. 15-22) and the Ukrainian Law on Personal Data Protection, you have the right to:

• Access — receive a copy of all data we hold about you
• Rectification — update inaccurate or incomplete data
• Erasure ("right to be forgotten") — full deletion of your account and CRM record
• Restriction of processing — temporarily halt processing
• Portability — receive your data in machine-readable format (JSON)
• Object — opt out of processing based on legitimate interest (Art. 21 GDPR)
• Withdraw consent — where processing is based on consent (e.g., digest)
• Lodge a complaint with a supervisory authority: Datenschutzbehörde (Austria, dsb.gv.at) or the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua)

To exercise any right, email privacy@swapware.com.ua. We respond within 30 days (one-time extension up to 2 months possible for complex requests).

9. Data security

• HTTPS/TLS encryption for all client-server connections
• Passwords and tokens stored only as cryptographic hashes (bcrypt, SHA-256)
• Database access restricted on a least-privilege basis
• Regular infrastructure security audits
• SMS codes and session tokens have limited lifetime
• Backup encryption

If a data breach affecting your rights is detected, we will notify the supervisory authority within 72 hours and you personally (if high risk), per GDPR Art. 33-34.

10. Cross-border data transfers

Your data is processed in three jurisdictions:

• Ukraine (Mirohost) — primary web and MySQL
• Germany / EU (Hetzner) — AI infrastructure, voice server
• USA (Google for Gemini API, Twilio for voice, Apple for App Store) — based on EU Standard Contractual Clauses (SCC)

Data transfers from EU/Ukraine to the USA are governed by SCCs and Data Processing Addendums (DPAs) with respective processors.

11. Children

SWAPWARE is intended exclusively for business users over 18. We do not knowingly collect data from persons under 18. If you discover that a child has provided us with personal data, contact us immediately for deletion.

12. Changes to this policy

We may update this Policy. We will notify users of material changes via the app and email (for registered users) at least 30 days in advance. The date of the latest revision is shown at the top of the page.

13. Contact