This Privacy Policy explains how Swapstay ("we," "us," or "our") collects, uses, shares, and protects your personal data when you use our website, mobile applications, and services (collectively, the "Platform"). We are committed to protecting your privacy and handling your personal data in compliance with the General Data Protection Regulation (GDPR) and the ePrivacy Directive. [13, 9, 49, 14, 45, 50]

 

A. Introduction and Data Controller Information

 

Data Controller: Swapstay is the data controller responsible for the processing of your personal data under this Privacy Policy.

Contact Details: Philip Montsho

Email: hello@swapstay.io

Data Protection Officer (DPO):

We are committed to upholding the principles of GDPR, ensuring that your personal data is processed lawfully, fairly, and transparently, collected for specified, explicit, and legitimate purposes, limited to what is necessary, accurate, kept only as long as needed, and protected with appropriate security measures. We are accountable for our compliance. [34, 9]

 

B. Personal Data Collected

 

We collect various categories of personal data to provide and improve our services.

1. Information You Provide Directly to Us:

• Account Registration Data: When you create an account, we collect your name, email address, phone number, physical address, profile picture, and a short biographical description. [37, 13, 14, 45, 40, 15]

• Property Listing Data: If you list a property, we collect interior photos of your home, its city, neighborhood, detailed property descriptions, and amenities. [37, 13]

• Booking and Swap Request Data: Information related to your travel dates, number of guests, and any pets accompanying you. [16, 33]

• Identity Verification Data: For security and trust, we may collect government-issued identification (e.g., passport, national ID card) and/or proof of address during our member verification process. This data is also used for background checks. [13]

• Insurance-Related Data: To facilitate enrollment in third-party insurance policies on your behalf, we may collect additional property details (e.g., property value, specific features relevant for coverage assessment) and personal details required by the insurance provider.

• Communications: Records of your communications with other Members through the Platform's messaging system, and with our customer support team. [49, 45]

• Payment Data: If applicable for fees or deposits, your billing address and payment confirmation details (though full payment card numbers are typically processed by third-party payment processors and not stored by us). [14, 15]

• Sensitive Health Information: In rare cases, and only with your explicit consent, we may collect sensitive health information if it is directly relevant to facilitating a safe and appropriate swap (e.g., accessibility needs for a property). [49, 45]

2. Information Collected Automatically:

• Usage Data: We collect information about your interactions with the Platform, including your IP address, device information (e.g., device type, operating system), browser type, pages visited, time spent on pages, and features used. [17, 18, 40]

• Location Data: We may collect your city and neighborhood based on your IP address or, if enabled by you, precise location data from your mobile device. [37, 13, 40]

• Cookies and Tracking Technologies: We use cookies and similar technologies to collect information about your browsing behavior. Our Cookie Policy provides detailed information on the types of cookies used, the data collected, and their purposes. [17, 51, 1, 11, 12, 52, 45]

3. Information from Third Parties:

• Identity Verification Providers: We may receive information from third-party identity verification services to confirm your identity. [7, 13, 27, 53, 44]

• Background Check Providers: We may receive information from third-party background check providers to enhance the security and trust of our community. [13]

• Third-Party Insurance Providers: We may receive confirmation or policy details from third-party insurance providers after facilitating your enrollment.

• Social Media Accounts: If you choose to connect your Swapstay account with a third-party social media service, we may receive information from that service in accordance with your privacy settings on that service. [44]

• Payment Processors: We receive transaction data from our third-party payment processors regarding your payments for fees and deposits. [14, 15]

 

C. How Personal Data is Used (Purposes and Legal Bases)

 

We use your personal data for the following purposes, based on the specified legal bases under GDPR:

Purpose of Processing

Legal Basis under GDPR

Service Provision: To facilitate home swaps, manage your account, process fees and deposits, provide customer support, and enable communication between Members.

Performance of a contract with you. [14, 15]

Personalization: To tailor your user experience, recommend homes or swaps, and display relevant content.

Your explicit consent (for profiling activities) or legitimate interest (where strictly necessary for service improvement and not overridden by your rights). [34, 26, 9, 10, 51, 1, 11, 38, 54, 2, 39, 47, 49, 14, 43, 45, 15]

Security & Fraud Prevention: To verify your identity, perform background checks, cross-validate data, and detect and prevent fraudulent, malicious, or unauthorized activity on the Platform.

Legitimate interest (protecting our Platform and users) and legal obligation (e.g., anti-fraud laws). [13]

Marketing & Communication: To send you platform updates, promotions, newsletters, and information about new features or services.

Your explicit, opt-in consent. You can withdraw consent at any time. [10, 38, 54, 2, 49, 14, 45, 40, 50]

Analytics & Improvement: To analyze user behavior, understand platform usage patterns, troubleshoot, and continually improve platform functionality and user experience.

Legitimate interest (improving our services) or your explicit consent (for non-essential analytics cookies). [49, 45]

Legal Compliance: To comply with legal obligations (e.g., tax, consumer protection, data protection laws), enforce our Terms of Service, and respond to legitimate legal requests from authorities.

Legal obligation. [14, 15]

Insurance Enrollment: To facilitate your enrollment in third-party insurance policies as part of the Swapstay service.

Performance of a contract with you.

 

D. How Personal Data is Shared

 

We share your personal data only as described in this Privacy Policy:

1. With the Public (via Public Profiles/Listings): To facilitate the discovery of homes and promote the Swapstay community, a public profile of your listing may be accessible to anyone on the internet who has a link to it. This public profile includes only limited, non-sensitive information necessary for a potential swap to be considered. The information that is publicly viewable includes:

• Your first name.

• The city and neighborhood of your property.

• Your profile picture.

• A short bio you have provided.

• Photos and a description of your property.

• The general availability of your property.

By creating a listing on Swapstay, you are consenting to this public display of information for the purpose of promoting your home and the Platform. You can manage the visibility of your public profile and certain data points within your account settings.

2. With Other Approved Members (After Account Verification): Once you have been verified and approved as a Swapstay member, you will have access to the full profiles of other approved members. This is a closed, trusted network.

• Pre-Confirmation: Before a Swap is confirmed, only the limited public profile information (your first name, city, neighborhood, profile picture, and a short bio) is visible to other approved Members on the app.

• Post-Confirmation: After a Swap has been mutually confirmed, your full name, contact information (email address and phone number), full property address, and detailed access instructions will be shared with the other party to facilitate the exchange. This sensitive information is never shared publicly or before a confirmed booking.

4. With Third-Party Service Providers: We engage trusted third-party service providers to perform functions on our behalf and to assist us in providing the Platform. These may include:

• Cleaning service providers (if applicable).

• Payment processors.

• Identity verification services.

• Background check providers. [13]

• Third-party insurance providers (e.g., Feather Insurance): We share necessary personal and property data with these providers to enroll you in the required insurance policies on your behalf, as outlined in our Terms of Service.

• Cloud hosting providers.

• Analytics providers.

• Customer support tools.

• Key management service providers (in the future).

We enter into data processing agreements (DPAs) with these providers to ensure they process your data only on our instructions, adhere to strict GDPR compliance standards, and implement adequate security measures. [9, 49, 14, 15]

5. For Legal Compliance and Enforcement: We may disclose your personal data to law enforcement, governmental authorities, or other third parties if required by law, in response to a valid legal request (e.g., subpoena, court order), or when we believe it is necessary to protect our rights, property, or safety, or the rights, property, or safety of our Members or others. [14, 15, 21]

6. Specifics on Sharing Profiles via Social Media (Instagram, TikTok, LinkedIn, others)

Swapstay's core functionality is built on a social discovery model, where a user's listing is made public to allow potential guests to find and be inspired by available homes. To facilitate this, your profile and listing are designed to be shareable, discoverable, and promote the community.

By creating a listing on Swapstay and agreeing to these Terms, you understand and agree that your public profile and listing information may be shared by Swapstay and other users for promotional and discovery purposes on various platforms, including social media (such as Instagram, TikTok, and others). This is a fundamental part of the service provided by Swapstay.

The information that may be shared for this purpose includes:

• Your first name.

• Your profile picture.

• The city and neighborhood of your listing.

• Photos and a description of your property.

We will provide clear tools within your account settings to manage the public visibility of your listing. You have the right to remove your listing at any time, which will cease the sharing of your information. The legal basis for this processing is the performance of the contract between you and Swapstay, as this sharing is a necessary component of the Platform's core functionality.

Member's Own Sharing: Please be aware that if you choose to share your own Swapstay-related content on your personal social media profiles, the privacy policies of those social media platforms will apply to your content. We are not responsible for the privacy or security of any information that you make publicly available or for the accuracy, use, or misuse of any information that you disclose or receive from third parties. [14, 15]

 

E. Data Security Measures

 

We implement appropriate technical and organizational measures to protect your personal data from unauthorized access, loss, misuse, alteration, or destruction. These measures include, but are not limited to, data encryption, strict access controls, regular security audits, and secure server infrastructure. While we strive to protect your personal data, no method of transmission over the internet or electronic storage is 100% secure. [34, 9, 49, 14, 45, 15]

 

F. Data Retention Periods

 

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including for the duration of your membership, to provide our services, to comply with legal obligations (e.g., tax, accounting, consumer protection laws), to resolve disputes, and to enforce our agreements. Once your data is no longer needed, we will securely delete or anonymize it. We maintain a clear data retention schedule. [34, 51, 45, 50]

 

G. Your Rights Under GDPR

 

As a data subject in the EU, you have the following comprehensive rights regarding your personal data:

1. Right to be Informed (Articles 12-14 GDPR): You have the right to be informed about the collection and use of your personal data. This Privacy Policy serves to fulfill this right. [34, 26, 9, 11, 38, 54, 2, 49, 43]

2. Right of Access (Article 15 GDPR): You have the right to request copies of the personal data we hold about you. [34, 26, 9, 11, 38, 54, 2, 49, 43, 45]

3. Right to Rectification (Article 16 GDPR): You have the right to request that inaccurate or incomplete personal data about you be corrected or updated. [34, 26, 9, 11, 38, 54, 2, 49, 43, 45]

4. Right to Erasure ("Right to be Forgotten") (Article 17 GDPR): You have the right to request the deletion of your personal data. Please note that this right is not absolute and may be subject to certain legal exemptions (e.g., for legal compliance, dispute resolution, or maintaining the integrity of our review system by anonymizing past reviews). [34, 26, 9, 11, 38, 54, 2, 49, 43, 50]

5. Right to Restriction of Processing (Article 18 GDPR): You have the right to request the restriction or suppression of the processing of your personal data under certain circumstances. [34, 26, 9, 11, 38, 54, 2, 49, 43]

6. Right to Data Portability (Article 20 GDPR): You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller, where technically feasible. [34, 26, 9, 11, 38, 54, 2, 49, 43]

7. Right to Object (Article 21 GDPR): You have the right to object to the processing of your personal data for certain activities, such as direct marketing or profiling. [34, 26, 9, 11, 38, 2, 49, 43]

8. Right to Withdraw Consent (Article 7 GDPR): Where we rely on your consent as the legal basis for processing, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal. [37, 34, 9, 1, 11, 12, 2]

To exercise any of these rights, please contact our Privacy Officer at. We will respond to your request within a reasonable timeframe, typically one month. [49, 45]

Right to Lodge a Complaint: You also have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you believe that the processing of your personal data infringes GDPR.

 

H. International Data Transfers

 

Your personal data may be transferred to, and processed in, countries outside the European Economic Area (EEA) where data protection laws may not be as protective as those in your jurisdiction. If we transfer your personal data outside the EEA, we will ensure that appropriate safeguards are in place, such as relying on an adequacy decision by the European Commission, implementing Standard Contractual Clauses (SCCs) approved by the European Commission, or obtaining your explicit consent for the specific transfer. [55, 14, 15, 56]

 

I. Children's Privacy

 

Our services are not intended for children under the age of 18, and we do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child under 18, we will take steps to delete such information as quickly as possible. [14, 40, 15]