swipesign GmbH (swipesign.io) Privacy policy — 75/100 (Medium privacy risk)
Last analyzed
swipesign GmbH · swipesign.io
Report details
Medium privacy riskswipesign collects a lot of your data and shares it with many third parties (like Stripe and Twilio), but stores most of it in the EU and lets you exercise GDPR rights.
swipesign GmbH demonstrates strong GDPR alignment with EU-based hosting (OVH) and clear user rights, but its reliance on numerous third-party processors (including US-based ones) and broad data collection introduces compliance risks. Transparency is high, but gaps remain in transfer safeguards and data minimization justifications.
Category Assessment
Breakdown of the policy across key compliance areas. Good = strong, fair = mixed, poor = concerning.
Collects broad categories of data (e.g., chat contents, preferences) without clear necessity justification for all use cases.
Policy is detailed and specific about data categories, purposes, and third parties, though some operational details (e.g., consent management) are vague.
Extensive sharing with named processors (Stripe, Twilio, etc.) under DPAs, but lacks clarity on non-EU transfer safeguards and subprocessor oversight.
Platform hosted in EU (OVH), but website (Vercel) and other processors (e.g., Twilio, Stripe) may involve US transfers under SCCs; no mention of supplementary measures.
No evidence of user data being used for AI/model training, but this is not explicitly addressed.
All GDPR rights (access, rectification, erasure, etc.) are listed with a clear contact point, but no details on response timelines or verification processes.
Key Findings
Notable clauses, issues, or positive practices discovered (critical first)
Extensive data collection may exceed necessity for some use cases
The policy explicitly lists broad categories of personal data collected, including sensitive financial and interaction data (e.g., bank details, chat contents). While comprehensive, this raises the bar for data minimization justification under GDPR Art. 5(1)(c).
Third-party data sharing lacks granularity on safeguards for non-EU transfers
Third-party processors (Vercel, OVH, Stripe, Twilio, Zendesk, Cloudflare, Brevo, Refindie, LinkedIn, Google) are named, and DPAs are linked for most. However, the policy does not clarify whether all subprocessors are contractually bound to GDPR standards or if transfers rely solely on SCCs without supplementary measures.
Legitimate interest processing for marketing lacks explicit opt-out clarity
The policy mentions 'legitimate interests' (Art. 6(1)(f)) for marketing and website security but does not provide a clear balancing test or opt-out mechanism for marketing communications beyond generic references.
Mixed hosting locations: EU for platform, unclear for website
The platform is hosted in EU data centers (OVH in Germany/France), which is a strong privacy signal. However, the website (swipesign.io) is hosted by Vercel, which may process data in the US. The policy does not specify if Vercel’s processing is limited to EU regions.
Consent-dependent tracking is disclosed but lacks operational details
Affiliate tracking via Refindie uses cookies storing referral identifiers and timestamps, but the policy states this only occurs after user consent via a cookie banner. This aligns with GDPR Art. 6(1)(a) but lacks detail on how consent is recorded or withdrawn.
Silence on AI/model training implies non-use, but not explicitly stated
No explicit mention of AI or model training using user data. The absence of such language suggests it may not occur, but this is not confirmed.
Consumer Takeaway
Your data is processed under GDPR with strong EU hosting, but shared with multiple third parties (e.g., Stripe, Twilio, Zendesk) under DPAs. Some tracking occurs with consent.
Compliance Posture
GDPR-aligned with notable third-party dependencies
EU Transfers
Data primarily hosted in EU (OVH in Germany/France), but third-party processors (e.g., Vercel, Twilio, Stripe, Zendesk, Cloudflare) may involve transfers to US/other jurisdictions under SCCs or adequacy decisions.
Detected Signals
Specific data points and practices identified in the text
Evidence Snippets
Direct quotes from the policy supporting these findings
We process various categories of data from you, including: Contact and identification data such as name, address, email address, telephone number, customer number
The platform runs on ISO 27001-certified servers in German data centres operated by OVH (OVH SAS, 2 rue Kellermann, 59100 Roubaix, France)
Our website (swipesign.io) is hosted by Vercel. When you access or use the website, technical access data (e.g., IP address, device and browser information, time of access, referring URL) may be processed
Payments are processed via Stripe; subscription handling is managed in cooperation with swipesign OÜ. SMS authentication codes are sent via Twilio.
You have the right to access, rectification, erasure, restriction of processing, objection, data portability, and withdrawal of consent, among others.
Missing or Unclear
- No explicit statement on whether Vercel’s hosting is limited to EU data centers.
- No details on supplementary measures (e.g., encryption, pseudonymization) for non-EU data transfers beyond SCCs.
- No mention of data retention periods for specific data categories (e.g., server logs, cookies).
- No explicit opt-out mechanism for legitimate interest-based marketing.
- No confirmation on whether user data is ever used for AI/model training.
- No clarity on how consent for cookies/tracking is recorded, stored, or withdrawn.
Questions to Ask
- Are Vercel’s hosting services for swipesign.io configured to process and store data exclusively within the EU?
- What supplementary measures (e.g., encryption, access controls) are in place for data transfers to third parties like Twilio or Stripe under SCCs?
- How is user consent for cookies (e.g., Refindie, LinkedIn Insight Tag) recorded, and how can users withdraw it?
- Is there an explicit opt-out mechanism for marketing communications processed under legitimate interests (Art. 6(1)(f))?
- Are any user data (e.g., signatures, chat contents) used for AI/model training, and if so, is there an opt-out?
- What are the specific retention periods for server log data, cookies, and other temporary data?
Share this analysis
Anyone with this link can view the result above.
Built by DentroChat
100% European AI chat for everyone
Chat with AI, work with files, generate images, and search the web. Data stays in Europe.
Other analysed privacy policies
View allsykik.ai
78/100
Medium privacy riskSykik offers EU-hosted AI agents with strong data localization and GDPR-aligned practices, but lacks explicit details on data minimization, AI training opt-outs, and third-party sharing controls.
View report →apple.com
72/100
Medium privacy riskApple's Messages privacy disclosure shows strong encryption and short data retention but leaves critical EU compliance gaps—no mention of international transfers, GDPR user rights, or whether message metadata trains AI models.
View report →about.qwant.com
72/100
Medium privacy riskQwant offers strong privacy by default without tracking cookies, but creating an account or consenting to cookies shares significant data with Microsoft, and the policy lacks clarity on international transfers and AI training.
View report →signal.org
72/100
Medium privacy riskSignal genuinely collects almost nothing and encrypts everything, but its legal documentation is outdated and missing critical GDPR-mandated disclosures like transfer safeguards, retention periods, and user rights procedures.
View report →