Privacy Policy

1. Data Controller

The data controller responsible for personal data processing on this website in accordance with Art. 4 No. 7 GDPR is:

2. Website Access & Technical Server Logs

When you visit or use SwipeVera, our web servers and edge infrastructure automatically process technical connection data necessary to deliver web pages securely and reliably. This data includes:

• IP address of the requesting device
• Date, time, and timezone of access
• Requested URL / endpoint and HTTP method
• HTTP response status code and transferred bytes
• Browser type, version, and operating system (User-Agent)

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in ensuring technical stability, cybersecurity, and preventing abuse).

3. User Accounts & Account Data

When you register for a SwipeVera account, purchase products, or access saved analyses, we process the following account data:

• Email address and encrypted password hash (via Supabase Auth)
• Unique User Identifier (UUID) and account creation timestamp
• Product entitlements and purchase records (e.g., Deep AI, Profile & Prompts, AI Photos, Ultimate)
• Usage balances and event history (generation credit tracking)
• Saved profile analysis results, generated bios, and prompt selections

Legal basis: Art. 6(1)(b) GDPR (performance of the user contract and provision of purchased services).

4. Uploaded Profile Data & Photos

To provide personalized dating profile analysis and recommendations, you may voluntarily submit dating profile details, including:

• Target dating platform (e.g. Tinder, Hinge, Bumble)
• Dating goals, target audience, and preferred tone / vibe
• Profile bio text, prompt responses, or dating preferences
• Profile photos and screenshots uploaded for analysis and rating

Legal basis: Art. 6(1)(b) GDPR (contractual performance) and Art. 6(1)(a) GDPR (explicit consent for image and biometric profile analysis).

5. AI Processing & Third-Party AI Providers

SwipeVera utilizes state-of-the-art Artificial Intelligence to analyze dating profiles and generate customized text recommendations. Our verified AI integrations are invoked strictly server-side via Supabase Edge Functions:

API credentials remain strictly isolated on server-side edge functions and are never exposed to user clients.

6. AI Photo Pack Generation

When purchasing or generating the AI Photo Pack, your uploaded reference photos are processed by our automated image pipeline to synthesize enhanced dating photographs (e.g. Travel, Candid, City, Casual, Lifestyle, Dressed Up styles).

Generated images are synthetic AI outputs based on your uploaded reference likeness. The synthesized photos are saved to your secure authenticated account storage and may be reviewed or deleted by you at any time.

7. Data Storage & Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy or to comply with statutory retention requirements:

• Active Account Data: Retained for the duration of your registered account or until you request account deletion.
• Uploaded Photos & Temporary Processing Assets: [RETENTION PERIOD CONFIGURABLE - default 30 days for processing assets or until deleted in Account Settings].
• Billing & Tax Records: Invoices, transaction identifiers, and purchase confirmations are retained for mandatory statutory periods under German commercial and tax laws (typically up to 10 years per § 147 AO / § 257 HGB).

8. Payment Processing via Stripe

All payment transactions on SwipeVera are processed securely through Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland).

During checkout, your payment card number, expiration date, and security code are entered directly into Stripe’s encrypted PCI-DSS Level 1 certified checkout interface. SwipeVera does not store, transmit, or have access to your full payment card number. We receive only transaction confirmation metadata (Stripe Checkout Session ID, transaction status, amount, currency, and product purchased) necessary to activate your product entitlement.

Legal basis: Art. 6(1)(b) GDPR (execution of payment contract).

9. Database, Storage & Authentication (Supabase)

SwipeVera’s backend database, user authentication infrastructure, file storage, and serverless edge functions are hosted using Supabase (Supabase, Inc.).

Supabase operates under strict Data Processing Agreements (DPA) incorporating Standard Contractual Clauses (SCCs) to ensure data confidentiality, database row-level security (RLS), and encrypted data transmission.

10. Customer Support Inquiries

When you contact us via our Support Center (/support) or email (support@swipevera.com), we collect your email address, inquiry category, subject line, message text, and optional order/session ID.

This data is used solely to process and answer your support ticket. Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR.

11. Cookies & Local Storage Technologies

SwipeVera uses only strictly necessary browser storage technologies (session tokens and authentication state) essential to keep you logged in and enable secure page navigation.

We do not use invasive third-party cross-site advertising pixels or sale of personal data.

12. Legal Bases for Data Processing (GDPR)

• Consent (Art. 6(1)(a) GDPR): Upload of facial reference photos and profile generation requests.
• Contract Performance (Art. 6(1)(b) GDPR): Account registration, delivery of profile analyses, credits, and Stripe purchases.
• Legal Obligation (Art. 6(1)(c) GDPR): Statutory accounting, tax compliance, and commercial record retention.
• Legitimate Interests (Art. 6(1)(f) GDPR): Ensuring website security, error prevention, and defending against fraudulent transactions.

13. Categories of Recipients & Data Processors

Personal data is disclosed only to verified service providers acting as data processors under contractual data protection terms:

• Database & Authentication: Supabase, Inc.
• Payment Services: Stripe Payments Europe, Ltd.
• Text AI Processing: OpenAI Ireland Ltd. / OpenAI, Inc.
• Computer Vision & Image Synthesis: Google Ireland Ltd. / Google LLC

14. International Data Transfers

Where data is transferred to entities outside the European Economic Area (EEA), such transfers are governed by appropriate safeguards in accordance with Art. 44 et seq. GDPR, including the European Commission’s Standard Contractual Clauses (SCCs) and Data Privacy Framework adequacy decisions.

15. Your Rights as a Data Subject

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access (Art. 15 GDPR): Request confirmation and details of data stored about you.
• Right to Rectification (Art. 16 GDPR): Request correction of inaccurate personal data.
• Right to Erasure (Art. 17 GDPR): Request deletion of your personal data ("Right to be Forgotten").
• Right to Restriction of Processing (Art. 18 GDPR): Request limited processing in specific circumstances.
• Right to Data Portability (Art. 20 GDPR): Receive your personal data in a structured, machine-readable format.
• Right to Object (Art. 21 GDPR): Object to processing based on legitimate interests.
• Right to Withdraw Consent (Art. 7(3) GDPR): Withdraw any granted consent at any time with future effect.
• Right to Lodge a Complaint (Art. 77 GDPR): Lodge a complaint with a competent data protection supervisory authority.

To exercise any of these rights, please contact us at support@swipevera.com or submit a request via our Support Center.

16. Account Deletion & Statutory Archiving

You can request full deletion of your account and associated profile analyses directly through Account Settings (/settings). Upon deletion, your active profile data, uploaded images, and generated bios are permanently removed, except where statutory retention obligations (e.g. tax and commercial accounting regulations) mandate continued storage of transaction receipts.

17. Age Requirement (Strictly 18+)

SwipeVera is exclusively intended for adult individuals aged 18 and older. We do not knowingly collect or process data from minors. If we discover that personal data of a person under 18 has been submitted, it will be deleted immediately.

18. Technical Security & Policy Updates

We implement reasonable technical and organizational security measures (including TLS encryption, database access tokens, and server-side secret management) to safeguard your data against accidental loss, unauthorized access, and alteration. We may update this Privacy Policy periodically to reflect technical enhancements or statutory requirements.