1. Introduction
Welcome to Sway. This Privacy Policy explains how Sway ("we", "our", or "us") collects, uses, discloses, and protects your personal data when you use our mobile application, website, and related services (collectively, the "Platform"). By accessing or using Sway, you agree to the terms of this Privacy Policy. If you do not agree, please do not use our Platform.
Sway SRL is a company based in Belgium, under enterprise number BE1037531992, Clos des Colombes 23, 1342 Limelette, Belgium.
2. Definitions
| Term | Definition |
|---|---|
| Personal Data | Any information relating to an identified or identifiable natural person. |
| User | Any individual who accesses or uses the Platform, including event attendees, page holders, Artists, and Venues. |
| Page holder | Any natural or legal person using the Platform to organize an Event and sell Tickets, or to manage a page. |
| Client / Attendee | Any natural person purchasing a Ticket on the Platform for private, non-professional purposes. |
| Platform | The Sway mobile application, website, and any related services. |
| Account | The personalized digital environment provided by Sway to registered Users. |
| Legal Basis | The basis on which we process personal data under the GDPR (consent, contract performance, legal obligation, or legitimate interest). |
| Data Processor | A third-party company processing personal data on behalf of Sway. |
3. Data We Collect and How We Process It
3.1 Types of data we collect
We may collect and process the following categories of personal data:
- Account information: name, email address, date of birth, username, profile picture, biography, contact details provided during registration.
- Event data: events browsed, attended, or organized; ticket purchase history; event preferences; interest and attendance status.
- Payment data: your transaction history and, received from Stripe once you have paid, the type of payment method with its brand and last four digits, the bank name and the account holder's name verified by the bank for a Bancontact or iDEAL payment, or the PayPal account email, used to find your tickets again and to answer your support requests. Card details are entered on Stripe's payment page and processed by Stripe; we never store card numbers. A ticket purchase asks for no billing address. You may also give your name at checkout: it is optional, appears on your order confirmation and on the order the page holder sees, and is erased with your email address when your account is deleted.
- Invoice request data: only if you ask for an invoice for a ticket order, the name, address, VAT number and email address you enter for the invoice, and your own reference if you give one. See section 3.17.
- Usage data: IP address, device information, browser type, session data, browsing behavior on the Platform, collected via cookies and similar technologies.
- Location data (GPS / shared location): approximate device location collected only when you explicitly grant permission via your device settings (iOS or Android), to enable the interactive map and proximity search. If you turn on location sharing, an approximate location point (and its source) is stored server-side so that nearby and social features can show your approximate area to other Users. You can disable location sharing at any time via the in-app toggle ("ghost mode"), which stops sharing and removes the stored point. See section 3.3.
- Location data (IP): we derive your approximate country and city from your IP address via ipinfo.io, in order to display nearby events and venues and personalize the interface. This data is stored server-side for a rolling period of 30 days, then automatically deleted. See section 3.3 for the legal basis.
- Chat data: content of private, group, and community messages; sender and recipient identity; timestamps.
- Content uploaded: images, visuals, and other media uploaded by Users to their profile or pages, which are screened for inappropriate content by our own moderation server (openmod).
- AI feature data (page holders only): when a page holder uses the AI-powered page analytics feature, selected page data is transmitted for processing to OpenRouter, which routes the request to a model host inside the European Union (Google Gemini answers when that path is unavailable). The question itself is also sent to TypeSafe, which decides what the assistant should look up. See section 3.5 for details.
- Social-boundary relationships: when a User blocks, restricts, hides, or mutes another User, we store that relationship to enforce the chosen boundary.
- Privacy and visibility settings: your account privacy mode (public or private), the audience chosen for each profile section (profile, statistics, attended and upcoming events, followed artists/venues/promoters/genres, followers list, XP league), your who-can-message preference, follow requests and message requests, and your leaderboard / attendee-list opt-outs.
- Gamification data: experience points (XP) derived from your activity, your level and league, streaks and check-ins, used to operate leaderboards and engagement features.
- Personalization data: in-app activity (events browsed, pages followed, attendance) used to tailor event, artist, and venue recommendations.
- Shop order data: when you buy merchandise, your email address, your name and, for a delivery, your telephone number and delivery address, together with the products, amounts, delivery or pickup details, and any withdrawal request. See section 3.15.
- Seller tax information (page holders): legal form, legal name, tax identification number and its issuing country, VAT number, company number, date of birth for a natural person, and address, entered in the Payouts tab. See section 3.16.
- Support data: any information you provide when contacting our support team.
3.2 Purposes and legal bases for processing
| # | Processing | Purpose | Legal Basis |
|---|---|---|---|
| 1 | Account creation and management | Create and maintain your Account | Performance of the contract (art. 6(1)(b)) |
| 2 | User authentication | Identify Users when they log in | Performance of the contract (art. 6(1)(b)) |
| 3 | Ticketing and payment processing | Process ticket purchases, issue tickets, manage orders | Performance of the contract (art. 6(1)(b)) |
| 4 | Sharing attendee data with page holders | Enable access control, event management, and, with your consent, page holder marketing | Contract performance + joint controllership (art. 26 GDPR) |
| 5 | IP-based location personalization | Derive approximate country and city from IP to display nearby events and personalize the interface | Legitimate interest (art. 6(1)(f)) |
| 6 | GPS-based location | Enable interactive map and proximity search | Consent (art. 6(1)(a)) |
| 7 | Product analytics (PostHog) | Analyze Platform usage to improve features and user experience | Consent (art. 6(1)(a)) |
| 8 | Error monitoring (Rustrak, self-hosted) | Detect and resolve technical bugs | Legitimate interest (art. 6(1)(f)) |
| 9 | Content moderation (openmod, self-hosted) | Automatically detect illegal or inappropriate images upon upload | Legal obligation / Legitimate interest (art. 6(1)(f)) |
| 10 | Chat and messaging | Enable private, group, and community messaging between Users | Performance of the contract (art. 6(1)(b)) |
| 11 | AI page analytics (TypeSafe for the routing judgments, OpenRouter EU for the answer, Google Gemini fallback) | Enable page holders to query their page data through a conversational AI interface | Contract performance (art. 6(1)(b)) for the page holder using it, and legitimate interest (art. 6(1)(f)) in providing the feature |
| 12 | Sway marketing communications | Send updates, newsletters, and promotional content about the Platform | Consent (art. 6(1)(a)) |
| 13 | Accounting and tax compliance | Fulfill accounting and tax obligations; archive transaction records | Legal obligation (art. 6(1)(c)) |
| 14 | Fraud prevention | Detect and prevent fraudulent use of the Platform | Legitimate interest (art. 6(1)(f)) |
| 15 | Social boundaries (block, restrict, hide, mute) | Enforce the social boundaries a User chooses against another User | Legitimate interest (art. 6(1)(f)) |
| 16 | Platform security | Protect the Platform against unauthorized access and attacks | Legitimate interest (art. 6(1)(f)) |
| 17 | Legal defense | Organize Sway's defense in case of litigation or pre-litigation | Legitimate interest (art. 6(1)(f)) |
| 18 | Personalized recommendations | Tailor event, artist, and venue recommendations to your in-app activity | Consent (art. 6(1)(a)) |
| 19 | Gamification and engagement | Award XP and operate leagues, leaderboards, streaks, and check-ins | Legitimate interest (art. 6(1)(f)) |
| 20 | Privacy and visibility controls | Apply your account privacy mode, per-section visibility, messaging, and leaderboard preferences | Performance of the contract (art. 6(1)(b)) + consent where applicable |
| 21 | Promotional contests run by Sway | Administer entries, verify eligibility, judge answers, designate a winner, pay the prize and keep proof of a fair process | Performance of the contest rules (art. 6(1)(b)) + legitimate interest in preventing fraud and proving the process (art. 6(1)(f)) |
| 22 | Shop orders | Process merchandise orders, deliver them or hand them over at a pickup point, handle withdrawals, refunds and the legal guarantee, and share each order with its seller | Performance of the contract (art. 6(1)(b)) + joint controllership (art. 26 GDPR) |
| 23 | Seller identity shown to buyers | Show buyers who they are buying from before they pay | Legal obligation (art. 6(1)(c)) where the seller is a trader; performance of the contract (art. 6(1)(b)) otherwise |
| 24 | DAC7 tax reporting | Collect seller tax information and report shop sales to the Belgian tax administration | Legal obligation (art. 6(1)(c)), Council Directive (EU) 2021/514 |
| 25 | Invoice requests on ticket orders | Pass your invoice request to the page holder that sold the tickets, which issues the invoice | Performance of the contract (art. 6(1)(b)) + joint controllership (art. 26 GDPR) |
| 26 | Sway's own advertising measurement | Measure the reach and results of Sway's own advertising campaigns on Meta and X, and build audiences for them from visits to the public pages of the website | Consent (art. 6(1)(a)) |
3.3 Location data - details
GPS / shared location (consent-based):
When you use the map or proximity search features, Sway may request access to your GPS location via your device's permission system. This access is entirely optional and subject to your explicit authorization. You can withdraw this permission at any time in your device settings. Separately, if you turn on location sharing in the app, Sway stores an approximate location point (and its source) server-side so that nearby and social features can display your approximate area to other Users. You can disable location sharing at any time using the in-app toggle ("ghost mode"); disabling it stops further sharing and removes the stored point. Read access to these location fields is restricted server-side. Legal basis: consent (art. 6(1)(a)).
IP-based location (automatic):
We use your IP address to derive an approximate country and city via our service provider ipinfo.io. This allows us to display nearby events and venues and adapt the interface language and content. IP-based geolocation data is stored server-side for a rolling period of 30 days, then automatically deleted. It is never used for advertising purposes and is not shared with third parties beyond the processing necessary for this purpose. You may object to this processing at any time by contacting contact@sway.events. Legal basis: legitimate interest (art. 6(1)(f) GDPR) for service personalization and fraud prevention.
3.4 Chat and messaging - details
Sway offers messaging features between Users (private messages, group chats, and community discussions around pages and events). Data processed includes: message content, timestamps, and the identity of the sender and recipient(s). This data is hosted in our database on Supabase (European Union, Frankfurt). Sway does not access the content of private messages except when required by law or in response to a validated report. Chat messages are retained for the lifetime of the conversation. When a user deletes a conversation, all related messages are permanently deleted within 30 days. You control who can message you (everyone, people you follow, or nobody); messages from senders you have not approved are quarantined as message requests until you accept them. See section 6 for retention periods.
3.5 AI-powered page analytics - details
Sway offers page holders a conversational analytics feature powered by a large language model, accessed through the Vercel AI SDK. The request is served through OpenRouter, using its in-region routing endpoint for the European Union: the request is decrypted and processed inside the EU, and only model hosts operating in the EU may serve it. The model itself is an open-weight DeepSeek build run by one of those hosts, not by DeepSeek. Google Gemini answers when that path is unavailable.
Before the language model is called, the question is sent to TypeSafe (the Jev model), which returns typed judgments rather than text: which kind of data the assistant should look up, which documentation sections are relevant, and which of the computed findings answers the question. TypeSafe receives the question itself, the kind of page it was asked on, and Sway's own documentation text. It does not receive the page figures, any attendee data, or the name of the page. Where TypeSafe is unavailable or not configured, the assistant behaves exactly as it does without it.
When it runs: only when a page holder actively opens the assistant and sends a message. Nothing is transmitted in the background, and it is never triggered by an attendee or a visitor.
What is transmitted: the question the page holder typed, plus the page data needed to answer it - sales and order statistics, audience and traffic figures, event performance, ticket and product configuration, email campaign statistics, and the shape of the booking pipeline (candidate names and their stage). Artist booking fees and agency names are deliberately excluded and are never sent.
What is not transmitted: attendee names, attendee email addresses, payment details and any other directly identifying information about individual buyers.
Legal basis: performance of the contract with the page holder (art. 6(1)(b)) for the page holder who chooses to use it, and our legitimate interest (art. 6(1)(f)) in offering analytics tooling. Because the assistant is only ever invoked by a deliberate action of the page holder, and the data concerns their own page, we do not rely on consent for this processing. A page holder who does not want it simply does not use it, and may ask us to disable it for their page at any time using the contact details in section 12.
Retention by the model providers: every assistant request Sway sends through OpenRouter carries two instructions with it, on the request itself rather than as an account setting: zero data retention, and no training. OpenRouter therefore routes only to model hosts that retain neither the prompt nor the response beyond serving it, and that do not use it to train. Content may still be held transiently in memory for the time it takes to answer, which is inherent to running an inference request. Sway does not enable OpenRouter's own request logging. OpenRouter, Inc. is established in the United States. Its data processing agreement, incorporated into its terms of service, includes the European Commission's standard contractual clauses (module 2, controller to processor), and offers EU-only processing for requests sent through its EU endpoint, under which they are processed and stored exclusively in EU/EEA infrastructure. Sway sends every assistant request through that endpoint, and has requested a copy of the agreement signed by both parties. Google processes the data solely to generate the response, does not use it to train its models under the API terms, and does not retain it beyond the processing of the request. TypeSafe states that it does not train or fine-tune models on API input and does not disclose it to third parties other than its own service providers; it publishes no fixed retention window, and zero data retention is available on enterprise plans. Its services are hosted in the United States.
Assistant requests routed through OpenRouter's EU endpoint are processed and stored inside the EEA. Because OpenRouter, Inc. is established in the United States, its processing is also covered by standard contractual clauses. Transfers to TypeSafe and Google servers located outside the EEA are governed by standard contractual clauses (see section 7).
3.6 Content moderation - details
When a User uploads an image (profile picture, event visual, gallery photo, chat image, page content), it is automatically checked before it is stored by openmod, open-source moderation software that Sway runs on its own server in the European Union. The image is analysed in memory and is not kept by the moderation software; only the images it accepts are stored. A refused image is not published, and the person who uploaded it is told which category was detected (for example nudity or a firearm). This processing is necessary to comply with our obligations under the Digital Services Act and to protect Users from illegal or inappropriate content. No image is sent to a third party for moderation.
3.7 Sharing attendee data with page holders - joint controllership
When you purchase a ticket, Sway shares the following information with the page holders of the event: your email address, your name if you gave it at checkout, order status, the amount of any tip or donation you chose to add, and, if you have given your consent, your marketing opt-in for the seller's communications. An event can be organized by several promoter, artist or venue pages (Terms, section 8.11): each of them receives this information and adds you to its contacts, but your marketing opt-in goes to the seller alone, the page that receives the payment (Terms, section 6.2). If you ask for an invoice, Sway also shares the invoicing details you enter (section 3.17).
Sway and each of these page holders act as joint controllers within the meaning of article 26 GDPR for these processing operations. Each page holder undertakes contractually to use this data solely for event management and, where applicable, marketing communications, and not to transfer it to any third party.
Stripe acts as a data processor for both Sway and the page holder for payment data. For its own purposes, such as fraud prevention and the obligations it has as a regulated payment institution, Stripe acts as an independent controller under its own privacy policy (stripe.com/privacy). Sway does not store any payment card data.
3.8 Tracking pixels configured by organizers - joint controllership
Pages hosted on Sway may include third-party tracking pixels (Meta Pixel, Google Analytics 4, TikTok Pixel) configured by their respective page holders. These pixels send data to the page holder's own accounts on those platforms. An event page that has no pixel of its own may run the pixels of the pages that organize the event, for each organizer page its managers leave enabled.
For the processing performed via these pixels on Sway, the page holder and Sway act as joint controllers within the meaning of article 26 GDPR. The respective responsibilities are as follows:
- Sway: provides the technical means for pixel integration, manages user consent via its cookie consent platform (CMP), ensures that pixels are not triggered without consent
- Page holder: configures the pixels with their own credentials, declares this processing in their own privacy policy, ensures the lawfulness of the data collected, responds to data subject requests concerning data sent to their accounts
The page holder is responsible for declaring these processing operations in their own privacy notice and for the lawfulness of the data collected via their pixels. User consent for page holder-configured pixels is managed through Sway's cookie consent platform. Users can refuse or withdraw their consent at any time via the cookie preferences interface.
3.9 Your privacy controls
Sway gives you granular control over your visibility and interactions:
- Private account: you can switch your account to private, so that following you requires your approval via follow requests.
- Per-section visibility: you can choose the audience (everyone / followers / nobody) for each section of your profile - profile details, statistics, attended and upcoming events, followed artists, venues, promoters and genres, your followers list, and your XP league.
- Messaging controls: you can choose who may message you (everyone / people you follow / nobody). Messages from senders you have not approved are placed in a separate message-requests area.
- Leaderboards and lists: you can opt out of appearing on public leaderboards and on event attendee lists.
- Social boundaries: you can block, restrict, hide, or mute other Users (see section 3.1).
3.10 Gamification - XP, leagues, and leaderboards
Your engagement on the Platform (such as attending events, check-ins, and streaks) generates experience points (XP), which determine your level and league and may appear on public leaderboards. This processing supports the Platform's engagement features. Legal basis: legitimate interest (art. 6(1)(f)). You can opt out of public leaderboards and hide your XP league at any time in your settings.
3.11 Personalized recommendations
When personalization is enabled, Sway uses your in-app activity (events you browse, pages you follow, events you attend) to tailor the event, artist, and venue recommendations shown to you. Personalization is enabled by default and recorded as a per-user preference. Legal basis: consent (art. 6(1)(a)).
3.12 Campaign attribution for ticket sales
When you open a Sway page, the address you arrived on may carry campaign labels added by
whoever shared the link (the utm_source, utm_medium, utm_campaign, utm_content andutm_term parameters), and your browser may report the website you came from. If you then
buy a ticket, we record those values alongside your order so that the page holder can see
which of their announcements, posts or advertisements actually led to ticket sales.
What is recorded: the campaign labels present in the address, the domain of the
referring website (for example instagram.com, never the full page you came from), and the
path of the page you landed on. These are attached to the order, not to your person: we do
not build a browsing profile from them, and they are not used to target advertising at you.
How it is held before purchase: these values are kept in your browser's memory for the
duration of your visit only. We do not write a cookie and do not use local storage
for this purpose. Closing the tab discards them.
Advertising click identifiers (such as fbclid from Meta, gclid from Google,ttclid from TikTok) are treated separately and more strictly, because they are minted by
an advertising network to single out one specific click. They are recorded only where
you have given consent for marketing purposes, and are never transmitted to an advertising
network without that consent.
Legal basis: legitimate interest (art. 6(1)(f)) for the campaign labels, the referring
domain and the landing path, our interest being to measure the effectiveness of the
promotion of an event you chose to attend. Consent (art. 6(1)(a)) for advertising click
identifiers and for any transmission to an advertising network.
Retention: attribution attached to a completed order is kept for the same period as the
order itself (see section 6). Attribution recorded for a checkout that was never completed
is deleted automatically after 30 days.
Your rights: you may object to this processing at any time (art. 21) using the contact
details in section 12. Objecting does not affect your ability to buy a ticket.
3.13 Ambassador programmes - joint controllership
A page holder may run an ambassador programme: members of their community register
through a link, each receives a personal promotional code, and - where the page holder has
enabled it - accrues credits on sales made through that code and exchanges them for rewards
the page holder provides.
What is collected when you register: your first name, your last name, your mobile
telephone number, optionally your email address, and the interface language you registered
in. No Sway account is required, and none is created.
Why the telephone number: it identifies you within that page holder's programme, so that
filling the form twice returns your existing code rather than creating a second ambassador.
It is never shown publicly. It is not used for advertising, and it is not verified by SMS.
What is recorded afterwards: the code issued to you, the events it has been opened on,
the orders attributed to it (count, tickets and value, never the buyers' identities), your
credit balance and every ledger entry behind it, the rewards you claim and what you answered
when claiming them, and - where the page holder emailed you - whether you unsubscribed.
Who controls what. For the ambassador programme, the page holder and Sway are joint
controllers within the meaning of art. 26 GDPR: the page holder decides to run the
programme, who may join, what a sale earns and what rewards exist, while Sway provides the
platform and determines the technical means. Sway acts as the page holder's processor for
the delivery of programme emails they initiate. The page holder is solely responsible for
delivering the rewards you claim.
Legal basis: performance of your participation in the programme and the legitimate
interest of the page holder in running it and of Sway in operating the platform
(art. 6(1)(b) and 6(1)(f)). Providing an email address is optional and is not treated as a
subscription to that page holder's marketing communications; programme emails carry a
one-click unsubscribe that needs no account, and unsubscribing affects neither your code nor
your credits.
What is visible to others. Where the page holder has enabled the leaderboard, other
ambassadors in the same programme see your first name and the initial of your surname
alongside your results - never your telephone number, never your email, never your address.
The page holder sees your full registration details and your programme activity.
Your ambassador page is reached through a personal link containing a secret token. Anyone
holding that link can see the page, so treat it as you would a password. Ask the page holder
if you lose it.
Your CRM contact. If you give an email address, it is added to the page holder's contact
list with the source ambassador. Your marketing subscription status is not changed by
registering.
Retention: your ambassador record and its ledger are kept for as long as the page holder
runs the programme, and then for the period in section 6 applicable to their account data.
The ledger is append-only, so a correction is recorded as a new entry rather than by erasing
an old one; a valid erasure request is honoured by deleting the ambassador record itself.
Your rights: you may exercise every right in section 8 against either joint controller.
Requests concerning the programme's content - who was rewarded and why - are best addressed
to the page holder; requests concerning the platform to Sway, using the contact details in
section 12.
3.14 Promotional contests - details
When you enter a contest Sway runs from Backstage, we process your answer, your tie-break
answer, the promoter page and event you entered with, the country of establishment of your
connected payout account, and a record of the eligibility checks that were run at that moment.
Sway is the sole controller of this processing; there is no joint controllership, because Sway
runs the contest for itself.
Your IP address and browser user-agent are recorded on the entry for fraud prevention only,
and are purged automatically after 90 days. They are never used to judge an answer.
If you win, your promoter page name and your answer are published on the contest page and in
the announcement - that is the point of a contest judged on its answers. You may decline
publication without losing the prize; write to us at the address in section 12 and the entry is
published under the page name alone. Nothing else about you is published: not your email, not
your figures, not your account.
The full detail - who judges, on what criteria, what happens to an entry that is disqualified,
and how to complain - is in the contest rules at sway.events/contest-rules.
3.15 Shop orders: joint controllership
When you buy merchandise from a page on Sway, from an event page, or from a seller's own website connected to Sway, the seller is the page holder shown at checkout, not Sway (Terms, sections 14 and 15).
What is collected: your email address, always, and your name when Stripe's payment page asks for it, as it always does for a delivery. For a delivery, also your telephone number and delivery address. You enter them on Stripe's payment page, and Stripe passes them to us with the order. No Sway account is required. When you buy through a seller's own website, that website gives us your email address so that we can open the payment page.
What is recorded: the products, amounts and delivery method, the pickup code, the carrier and tracking number the seller enters, the status of the order, any withdrawal request and refund, and a log of the emails sent about the order.
What the seller receives: your email address, name, telephone number and delivery address, the order and its status, and whether you ticked the box to receive the seller's news. You are added to the seller's contacts; you are subscribed to its news only if you ticked that box, and you can leave from any message. The emails about your order come from Sway, with the seller's contact address as the reply-to address.
Who controls what: as for tickets (section 3.7), Sway and the seller act as joint controllers within the meaning of article 26 GDPR for the collection of this data at checkout and its transmission to the seller. The seller then decides alone how it fulfils your order, and undertakes contractually to use your data only to fulfil the order, to handle withdrawals, refunds and the legal guarantee, and to send you its news if you asked for it, and not to pass it to any third party other than the carrier that delivers the order. Stripe acts as a processor for the payment and checkout data, and as an independent controller for its own purposes (section 3.7). Sway does not use your shop orders for its own marketing.
Legal basis: performance of the contract (art. 6(1)(b)); your consent (art. 6(1)(a)) for the seller's news.
Retention: your name, telephone number and delivery address, and the tracking number, are deleted three years after delivery or pickup, or after cancellation for an order that never ships. This covers the two-year legal guarantee of conformity and the time to act on it. The order itself is then kept without your identity for the ten years accounting law requires (section 6). If you delete your Sway account, these details are deleted at once for every order already shipped, handed over or cancelled; an order still being prepared keeps them until it ships or is cancelled, and they are deleted then. The seller keeps its own copy of what it received, under its own retention policy.
Your rights: you may exercise the rights in section 8 against Sway or against the seller. Questions about delivery, returns or the guarantee are best sent to the seller, at the contact address shown on your order page; questions about the platform to Sway, using the contact details in section 12.
3.16 Shop sellers: identity, tax information and DAC7
What is collected: to open a shop, a page holder enters its legal identity and tax information in the Payouts tab: legal form, legal name, tax identification number and the country that issued it, VAT number, company number, date of birth for a natural person, and address. The same information is used to check eligibility for Community Boost payouts (Terms, section 12). Sway does not store bank details: they stay with Stripe.
How it is protected: the tax identification number and the VAT number are stored encrypted, and Sway's interface shows only their last four characters. Only authorised Sway staff decrypt them, to prepare the tax report described below.
What buyers see: before any purchase, buyers see the seller's name and legal name, one address, the company number of a company, the seller's contact email, its VAT status and who pays for returns. The address is the public address the seller gives, which for a natural person need not be their home, or else a company's registered address; the address a natural person enters for tax purposes is never shown. Legal basis: legal obligation (art. 6(1)(c)) where the seller sells as a trader, because consumer law requires buyers to know who they are buying from; performance of the contract (art. 6(1)(b)) otherwise.
DAC7 reporting: Council Directive (EU) 2021/514 (DAC7), as transposed into Belgian law, requires Sway, as a platform operator, to report sellers of goods and their sales to the Belgian Federal Public Service Finance, which passes the information on to the tax authority of the seller's Member State of residence. For each calendar year, before 31 January of the following year, Sway reports the seller's identity as above and, for each quarter, the total paid for the goods sold through Sway, the fees Sway kept and the number of sales. A seller with fewer than 30 sales and no more than €2,000 in the year is not reported, although its information is still collected. Sway sends each reported seller the information reported about them by the same date. Legal basis: legal obligation (art. 6(1)(c)).
Retention: ten years after the end of the year a report concerns. The rights in section 8 apply within the limits of this legal obligation: we cannot delete information we are required to report or to keep.
3.17 Invoice requests on ticket orders
Sway does not issue invoices for tickets: the page holder that sold them does (Terms, section 6.8). No billing address is asked when you buy a ticket.
What is collected: only if you ask for an invoice, from the "Need an invoice?" link of your order: the name of the company or organisation to invoice, its address, its VAT number if it has one, the email address the invoice should be sent to and, if you wish, your own reference, such as a purchase order number. You can correct these details until the page holder marks the invoice as issued.
What the page holder receives: these details, on your order. The members who manage the event's orders are told that a request is waiting. The page holder issues the invoice with its own tools and sends it to you by email or through an electronic invoicing network; Sway does not see, keep or send the invoice.
Who controls what: as for the rest of your ticket order (section 3.7), Sway and the page holder act as joint controllers within the meaning of article 26 GDPR for the collection of these details and their transmission to the page holder. The page holder then decides alone how it issues the invoice, and keeps it under its own accounting obligations.
Legal basis: performance of the contract (art. 6(1)(b)), at your request; for the page holder, its legal obligation to issue an invoice (art. 6(1)(c)).
Retention: the details are deleted from Sway 30 days after the page holder marks the invoice as issued, or one year after your request if it is never handled. If you delete your account, a request already marked as issued is deleted at once; a request still waiting stays until it is handled or the year runs out, because the page holder still owes you that invoice. The page holder keeps the invoice, and the details on it, for as long as accounting law requires.
3.18 Import from Google Photos
People who manage an event's gallery can add photos to it from their own Google Photos library, on the website.
What is collected: nothing until you choose to connect Google Photos. When you do, Google asks you to let Sway see the photos you pick, through Google's Photos Picker. Sway then receives, for the photos you pick and for those alone, their file name, their size in pixels and a temporary address from which to download them. Sway never sees the rest of your library, your albums or your Google account details.
How it is used: each photo you pick is downloaded once, resized, moderated (section 3.6) and stored in the event's gallery like a photo uploaded from your device, without its location and camera details. The access token Google issues stays in your browser for at most one hour; Sway's servers use it only to download the photos you picked, and neither store nor log it. Once the photos are in, Sway asks Google to close the picking session.
Google user data: Sway's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Sway uses this information only to add the photos you picked to the gallery. It does not use it for advertising, does not sell it, does not use it to train artificial intelligence models, and lets no person read it, except with your consent, for security, or to comply with the law.
Legal basis: performance of the contract (art. 6(1)(b)), at your request.
Retention: the information received from Google (the token, the picking session and the temporary addresses) is not kept. The photos added stay in the gallery until they, or their album, are deleted.
3.19 Fraud and abuse prevention
To protect the Platform and its Users, Sway runs openfraud, open-source fraud detection software that Sway operates on its own server in the European Union. It receives signals about what happens on the Platform: your IP address and the country derived from it, your browser's user agent and language, the random device identifier described in section 9, whether your browser reports automation software, the age of your account, failed sign-in and password-reset attempts (with the email address typed), payment-card screening results at the start of a trial (card country and type, whether the cardholder name matches), and the first addresses of a mailing audience before a campaign is sent. No data is sent to a third party for this purpose.
Today openfraud only records what it would have decided and does not restrict anyone. If it is switched to enforcement, an action can be held for review or an account quarantined; any such measure is reviewed by a human and you may contest it through the contact details in section 12.
Legal basis: legitimate interest (art. 6(1)(f)) in preventing fraud and abuse. Retention: 366 days in openfraud; records kept for a specific fraud case follow the period in section 6. You may object at any time (art. 21) through section 12.
3.20 Sway's own advertising pixels
On the public pages of the website, and only if you have accepted the Marketing category in the cookie banner, Sway loads its own Meta Pixel (Meta Platforms Ireland Limited) and X Pixel (X Corp.). They tell Sway's accounts at Meta and X that a page was viewed. They receive the address of the page, the page you came from, your IP address, your browser and its identifiers, and the cookies those providers set or already hold on your browser. Sway uses this to measure its own advertising campaigns and to build audiences for them. Sway switches off Meta's automatic capture of form fields and button labels.
These pixels never load on account, login, checkout-return, backstage, console or token-link pages, nor on any address that carries a code or token. If you refuse or withdraw marketing consent, Sway stops sending page views to both providers at once, and their scripts are gone at your next page load.
Sway and each provider act as joint controllers for the collection and the transmission of this data (art. 26 GDPR). What each provider does afterwards is governed by its own privacy policy. Legal basis: consent (art. 6(1)(a)), purpose 26.
4. Data Sharing, Transfers, and Processors
We do not sell your personal data to third parties.
We share your personal data only with the following categories of recipients:
- Data Processors acting on our behalf (see section 5 for the full list)
- The page holder of an event you purchased a ticket for (see section 3.7)
- Legal authorities when required by law or necessary to protect our rights
- Acquirer or successor entity in the event of a merger, acquisition, or asset transfer, provided Users are informed in advance
5. Sub-processors and Third-party Service Providers
The following sub-processors may process personal data on behalf of Sway. All transfers outside the European Economic Area (EEA) are governed by standard contractual clauses (SCC) adopted by the European Commission.
| Provider | Role | Data Concerned | Location | EEA Transfer Safeguard |
|---|---|---|---|---|
| Supabase | Database, authentication | All user data | EU (Frankfurt) | N/A |
| Hetzner | VPS hosting (website, self-hosted apps, support mailbox and helpdesk) | Data hosted on that server | EU (Germany) | N/A |
| Cloudflare | CDN, reverse proxy, DDoS protection; delivery of transactional emails (account emails, order confirmations, tickets, invitations) | IP addresses, HTTP requests; for emails: recipient email, message content, delivery events | US / EU | SCC |
| Cloudflare R2 | File storage, media CDN | Uploaded images and assets | EU (per bucket) | N/A |
| Stripe | Subscription billing (Starter, Studio, Roster plans) | Billing data, payment method, invoicing | US / EU | SCC |
| Stripe Connect | Ticket and shop payment processing | Transaction data, page holder KYC, and for a shop delivery the buyer's name, telephone number and delivery address | US / EU | SCC |
| RevenueCat | In-app purchase management (iOS/Android) | Purchase data, user identifier | US | SCC |
| PostHog | Product analytics | User behavior, events | EU | N/A |
| Sentry | Error monitoring for versions of the mobile app released before October 2026, until they are no longer in use | Technical logs, error reports | US | SCC |
| openmod | Image content moderation (self-hosted) | User-uploaded images | EU (our own server) | N/A |
| ipinfo.io | IP geolocation | IP address, derived country and city | US | SCC |
| TypeSafe AI | AI page analytics (routing and relevance judgments) | The question asked, the page type, Sway's own documentation text | US | SCC |
| OpenRouter (OpenRouter, Inc.) | AI page analytics (primary model, routed to an EU model host) | Page data submitted by page holders | Requests processed in the European Union (in-region routing); company established in the United States | SCC (module 2); EU-only processing of requests; zero retention and no training asserted per request |
| Google (Gemini API) | AI page analytics (fallback model) | Page data submitted by page holders | US / EU | SCC |
| OpenAI | Daily internal security report, and structuring of public event listings | A 24-hour summary of server logs (may include IP addresses); public event descriptions | US | SCC / EU-US Data Privacy Framework where certified |
| Rustrak | Error monitoring (self-hosted) | Technical logs, error reports, performance traces | EU (our own server) | N/A |
| Notifuse | Email marketing platform (self-hosted) | Contact email, name, campaign engagement | EU (our own server) | N/A |
| Hyvor Relay | Outbound email delivery (self-hosted relay) | Recipient email, message content | EU (our own server) | N/A |
| Support (helpdesk and mail server) | Support requests and tickets (self-hosted) | Name, email address, message content | EU (our own server) | N/A |
| Telegram | Internal operations alerts to Sway staff | Alert text, which may include an IP address or an account identifier | Outside the EEA possible | SCC where offered by the provider |
| CARTO | Map tiles on the website | IP address, requested map area | Outside the EEA possible | SCC where offered by the provider |
| Cloudflare Turnstile | Anti-bot verification on sign-up and forms | IP address, browser signals | US / EU | SCC |
| Google Firebase Cloud Messaging | Mobile push notifications | Device push token, notification content | US | SCC |
| Meta (Conversions API) | Advertising measurement, only where a page holder has configured a pixel and the visitor has consented to marketing | Hashed email, click and browser identifiers, IP address, user agent | US | SCC |
| Meta Platforms Ireland (Meta Pixel) | Measurement of Sway's own advertising, only if the visitor has consented to marketing | Page address, referrer, IP address, user agent, browser identifiers and cookies | US possible | SCC |
| X Corp. (X Pixel) | Measurement of Sway's own advertising, only if the visitor has consented to marketing | Page address, referrer, IP address, user agent, browser identifiers and cookies | US | SCC |
Page holders may additionally configure their own advertising pixels (Meta, Google Analytics 4, TikTok) on their pages. Where they do, that provider becomes a recipient of the data described in section 3.8, under the joint-controller arrangement set out there, and only with your marketing consent.
6. Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Beyond the applicable period, data is either anonymized or permanently deleted.
| Category | Retention Period | Justification |
|---|---|---|
| Account data (profile, email, preferences) | Duration of account + 2 years of inactivity | Contract performance |
| Order data (tickets, purchases), except the shop delivery details below | Duration of account + 3 years after last purchase | Legal obligation |
| Accounting and tax records | 10 years (pseudonymized after account deletion) | Art. III.86 Belgian Code of Economic Law + Art. 60 Belgian VAT Code |
| IP-based location (country/city) | 30 days rolling period, then automatically deleted | Legitimate interest |
| GPS location (device permission) | Session only (not stored server-side) | Consent |
| Shared location point | Stored while location sharing is on; deleted when sharing is turned off (ghost mode) or account deleted | Consent |
| Chat messages | Retained for the lifetime of the conversation; deleted within 30 days after conversation deletion | Contract performance |
| Error logs (Rustrak, and Sentry for older app versions) | 90 days | Legitimate interest |
| Analytics data (PostHog) | 13 months | Consent |
| Images checked by moderation (openmod) | Not retained by the moderation software after the check; an accepted image is kept with the content it belongs to | Legitimate interest |
| Data submitted to AI (TypeSafe) | Not used for training under its privacy policy; no fixed retention window published | TypeSafe API terms |
| Data submitted to AI (Gemini) | Not used for training by Google under API terms | Google API contract |
| Data submitted to AI (OpenRouter EU) | Not retained beyond serving the request; processed inside the EU | Per-request zero-retention instruction |
| Social-boundary relationships (block, restrict, hide, mute) | Until removed or account deleted | Legitimate interest |
| Gamification data (XP, leagues, streaks, check-ins) | Duration of account | Legitimate interest |
| Personalization activity | Duration of account, or until personalization is disabled | Consent |
| Privacy and visibility settings | Duration of account | Contract performance |
| Marketing preferences (opt-in/out) | Until consent withdrawn | Consent |
| Fraud prevention signals (openfraud: IP, user-agent, device identifier) | 366 days; records kept for a specific fraud case: 5 years after case resolution | Legitimate interest |
| Consent and authorisation logs (terms section 9.8) | Duration of the relationship + 10 years | Legal obligation |
| Backups of the database and server data | Encrypted copies kept for a limited period: the database provider's own daily backups for 7 days, and encrypted server backups copied to EU storage at another provider for up to 30 days. Data erased from the live service leaves the backups when they expire | Security and continuity (legitimate interest) |
| Campaign attribution attached to an order | Same period as the order it belongs to | Legitimate interest |
| Campaign attribution for an abandoned checkout | 30 days, then automatically deleted | Legitimate interest |
| Link-click records (vanity and short links) | 13 months, then the partition is dropped | Legitimate interest |
| Contest entries (answer, tie-break, verdict, eligibility record) | 5 years after the edition closes | Proof of a fair process and defence against a claim |
| IP address and browser user-agent recorded on a contest entry | 90 days, then automatically purged | Fraud prevention, limited to the period during which a duplicate can still be detected |
| Shop delivery details (name, telephone number, delivery address, tracking number) | 3 years after delivery, pickup or cancellation, then deleted; sooner if you delete your account (section 3.15) | Contract performance and legal guarantee |
| Shop order records (products, amounts, dates), without the buyer's identity | 10 years | Art. III.86 Belgian Code of Economic Law + Art. 60 Belgian VAT Code |
| Seller tax information and DAC7 reports | 10 years after the end of the year a report concerns | Legal obligation (DAC7) |
| Invoice request details (name, address, VAT number, invoice email, reference) | 30 days after the page holder marks the invoice as issued, or 1 year after the request if it is never handled, then deleted (section 3.17) | Contract performance |
Account deletion: when you delete your Sway account, all personal data linked to your profile (follows, preferences, images, etc.) is permanently erased. However, European and Belgian accounting law (Belgian Code of Economic Law, art. III.86) requires us to retain transactional records for 10 years. To comply with both this obligation and article 17 §3(b) GDPR, we retain order records but pseudonymize all personal identifiers (your user ID and email are replaced with an irreversible hash). These records cannot be linked back to you. For shop orders, your name, telephone number and delivery address are deleted as well, except for an order still being prepared, which keeps them until it ships or is cancelled (section 3.15).
Backups: Sway keeps a weekly encrypted copy of the database and a nightly encrypted copy of the server, stored in the European Union at another provider (Cloudflare R2), in addition to the database provider's own daily backups, which are kept for 7 days. Not every item of data is covered by these copies. An account you delete can remain in backups until they expire. Backups are not restored into the live service except to recover from an incident, and any erasure already requested is applied again after such a restore.
7. International Data Transfers
Personal data processed by Sway is primarily hosted within the European Economic Area (EEA) on Supabase (Frankfurt) and Hetzner (Germany) infrastructure.
Certain sub-processors (Stripe, Cloudflare, Sentry, ipinfo.io, TypeSafe AI, Google Gemini, OpenAI, RevenueCat, Telegram, CARTO) may process data on servers located in the United States or other countries outside the EEA. In each case, transfers are governed by standard contractual clauses (SCC) adopted by the European Commission under article 46(2)(c) GDPR, ensuring an adequate level of protection. OpenRouter, Inc. is established in the United States and is covered by standard contractual clauses as well, although the assistant requests Sway sends it are processed and stored inside the European Union.
You may obtain more information about these transfer mechanisms by contacting us at contact@sway.events.
8. Your Rights
Under applicable data protection law, you have the following rights regarding your personal data:
| Right | Description |
|---|---|
| Access | Request a copy of the personal data we hold about you. |
| Rectification | Request correction of inaccurate or incomplete data. |
| Erasure | Request deletion of your personal data, subject to legal retention obligations. |
| Restriction | Request limitation of processing under certain conditions. |
| Data portability | Receive your data in a structured, commonly used, machine-readable format. |
| Objection | Object to processing based on legitimate interest, including IP geolocation. |
| Withdrawal of consent | Withdraw consent at any time for consent-based processing (GPS location, marketing, organizer pixels, and analytics or personalization where they are consent-based). Withdrawal does not affect the lawfulness of prior processing. |
| Complaint | Lodge a complaint with the Belgian Data Protection Authority (APD/GBA): www.dataprotectionauthority.be. |
To exercise any of these rights, contact us at: contact@sway.events
We will respond within 30 days. We may ask you to verify your identity before processing your request.
Sway has not appointed a data protection officer, because the law does not require one for its activities. contact@sway.events is the contact point for every privacy request. If you disagree with our answer you may complain to the Belgian Data Protection Authority (APD/GBA), Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be.
Self-service tools: You can exercise some of these rights directly in the app. "Download my data" lets you export your personal data in a structured, machine-readable format (data portability), including the orders placed from your account or with its verified email address and any invoice request attached to them, and "Deactivate account" temporarily disables your account and hides your profile. Deactivation is reversible - signing in again reactivates the account. Permanent account deletion is immediate (see section 6).
8.1 Is providing your data required?
(GDPR art. 13(2)(e))
Providing personal data to Sway is never a statutory requirement. Some of it is, however, necessary to enter into or perform a contract with us:
- To create an Account: an email address and a username. Without them we cannot create or secure the Account.
- To buy a Ticket: an email address, so the Ticket can be delivered and the order recovered. Your name is optional. Payment details are collected directly by Stripe, not by us.
- To get an invoice for a ticket order: the name and address to invoice and the email address to send it to (the VAT number and your reference are optional). Without them, the page holder cannot issue the invoice; asking for one is optional.
- To sell Tickets as a page holder: the identity and banking information required by Stripe for legal know-your-customer and anti-money-laundering checks. Without them, payouts cannot be made.
If you do not provide this data, we simply cannot provide the corresponding service. Everything else - profile picture, biography, location, marketing preferences - is entirely optional, and refusing it has no consequence beyond the related feature being unavailable.
8.2 Automated decision-making and profiling
(GDPR art. 13(2)(f))
Sway does not carry out automated decision-making producing legal effects concerning you or similarly significantly affecting you, within the meaning of art. 22 GDPR.
Three features involve automated processing, and none takes a decision about you without human review:
- Personalized recommendations (section 3.11) rank the events, artists and venues shown to you based on your in-app activity. The logic is a relevance score; the consequence is the order of a list. You can disable personalization at any time in your settings.
- Automated image moderation (openmod, on our own server) screens uploaded images for illegal or prohibited content and refuses them before they are published; the uploader is told which category was detected. Content may be removed automatically, but any account measure that follows is reviewed by a human, and you may contest it via the contact details in section 12.
- Fraud and abuse prevention (section 3.19) scores activity and, once enforcement is on, may hold an action or quarantine an account. A person reviews any account measure.
8.3 Where we obtain data about you from others
(GDPR art. 14)
Most data we hold comes from you directly. In a few cases we receive it from someone else:
| Source | Data | Why |
|---|---|---|
| A page holder | Your email address and order details, where they issue you a guest-list or complimentary ticket | So the Ticket can be issued and scanned at the door |
| A page holder | Contact details imported into their CRM | So they can manage their own audience; they are the controller for that import and must have their own legal basis |
| Another User | Your identity as the recipient of a message, a follow, or a social boundary (block, mute) | To operate the corresponding feature |
| A seller's website connected to Sway | Your email address, when you buy merchandise on that website | To open the payment page and send you the emails about your order |
| Stripe | Payment and payout status, KYC verification outcome, and for a shop delivery the name, telephone number and delivery address you enter on its payment page | To complete a purchase or a payout, and to deliver a shop order |
| Cloudflare / ipinfo.io | Approximate country and city derived from your IP | See section 3.3 |
| An advertising platform | Campaign labels and click identifiers present in the link you followed | See section 3.12 |
| Google Photos | The photos you pick in your own library, with their file name and size, when you import them into an event gallery | See section 3.18 |
Where we receive personal data about you from a third party, we inform you within one month at the latest, or at the first communication with you, unless you already have the information or providing it proves impossible or disproportionate.
9. Cookies and Tracking Technologies
We use cookies and similar tracking technologies on our website and application.
Strictly necessary cookies (no consent required)
These cookies are essential for the Platform to function and cannot be disabled:
- Session cookies: maintain your authenticated session.
- Preference cookies: remember your language and display preferences.
- Cookie consent cookies: store your cookie preferences.
- Security cookies: a random device identifier (
sway_device, kept for one year, also stored in your browser's local storage) and, only when your browser reports that it is driven by automation software, a flag (sway_automated, deleted when the browser closes). They are used only to detect fraud, fake accounts and account takeover (purpose 14, legitimate interest). The identifier is generated at random: it reveals nothing about you or your device, and no fingerprinting is done. Clearing your browser's data for the Platform resets it.
Analytics and performance cookies
On the website, these cookies are placed in accordance with your choice in the cookie banner. In the mobile app, product analytics and personalization are enabled by default and can be turned off at any time in your privacy settings. The website cookie banner and the in-app analytics setting are separate, independent mechanisms and are not linked: changing one does not change the other.
- PostHog: product analytics - tracks usage patterns and feature interactions to help us improve the Platform. Data is retained for 13 months.
Advertising and tracking pixels (consent required)
These pixels are only active if you have given your consent. Sway runs its own Meta Pixel and X Pixel on the public pages of the website (section 3.20). Page holders may add the following pixels to their own pages (section 3.8):
- Meta Pixel: conversion tracking for advertising campaigns on Meta platforms.
- Google Analytics 4 (GA4): audience analytics and campaign performance measurement.
- TikTok Pixel: conversion tracking for advertising campaigns on TikTok.
You can manage your cookie preferences at any time via the cookie banner on the Platform or through your browser settings. Disabling certain cookies may affect your experience.
10. Security
We implement appropriate technical, organizational, and physical measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:
- Encrypted connections (HTTPS/TLS) for all data in transit.
- Access controls and authentication for all systems containing personal data.
- Access to personal data limited to the people who need it, and two-factor authentication on the tools that hold our source code.
- Encrypted backups, with restores tested.
- Software updates and security monitoring.
- Infrastructure hosted within the European Union (Supabase, Hetzner).
- Regular error and security monitoring on our own servers (Rustrak).
- Automatic image moderation on our own server (openmod) to prevent illegal content.
No method of transmission or storage is free of risk, and we cannot guarantee that an incident will never happen.
Personal data breach. If a breach is likely to put your rights and freedoms at risk, we notify the Belgian Data Protection Authority (APD/GBA) within 72 hours of becoming aware of it, where feasible. If the breach is likely to result in a high risk for you, we also tell you without undue delay, in clear language, with what happened, what data is concerned, what we are doing about it and what you can do. We record every breach, whether or not it is notified.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. If material changes are made, we will notify you via the Platform or by email at least 15 days before the changes take effect.
The current version is always available at: sway.events/privacy
12. Contact
If you have any questions or concerns about this Privacy Policy or our data practices, please contact us:
Sway SRL
Enterprise number: BE1037531992
Clos des Colombes 23, 1342 Limelette, Belgium
contact@sway.events