This policy explains how Sway SRL handles personal data in openshield. It follows articles 13 and 14 of the General Data Protection Regulation (GDPR).
Who is responsible
Sway SRL, Clos des Colombes 23, 1342 Limelette, Belgium (enterprise number BE1037531992) is the data controller for the data described in "Data we handle as controller". Write to contact@sway.events for any question about personal data.
For the images and texts that our customers send to the API, Sway SRL is a processor acting on the customer's instructions. See "Content our customers send us".
Content our customers send us
A customer sends images and texts to the API to have them moderated. The customer decides what is sent and is the controller of that content. We process it only to return the moderation result, under the data processing agreement.
- Content is checked in memory and forgotten when the answer is sent. We keep no copy, no thumbnail, no excerpt and no hash of it, in logs or anywhere else.
- We do not use content to train models.
- The decision journal keeps the result of each check, never the content itself. A customer may attach a short reference of its own choosing to a check (the
reffield), which is kept in the journal. Customers should not put personal data in it.
If you appear in content that one of our customers sent, that customer is the one to ask. We help the customer answer you.
Data we handle as controller
| Data | Why | Legal basis (GDPR article 6) | How long |
|---|---|---|---|
| Account: email address, name if you give one, password (kept only as a hash), sign-in method, two-factor secret | To create your account, sign you in and protect it | Contract (6.1.b) | While the account exists |
| Acceptance records: for each document you accept (the terms, the privacy policy and the acceptable use policy when you create an account; the terms and the data processing agreement when an owner starts a paid plan), your user id, the organization for a paid plan, the document and its version, the date and time, and the full IP address you used. Deleting an account or an organization does not delete these records: they are our proof of what was accepted | To prove what you accepted and when | Contract (6.1.b) and legal obligation (6.1.c) | The duration of the contract plus 10 years, in line with Belgian accounting and tax law |
| Sessions: the IP address and the browser of each device signed in, and when | To show you where you are signed in and to protect the account | Legitimate interest in security (6.1.f) | Until the session expires, 7 days after your last activity, or until you sign out |
| Organization: name, members and their roles, invitations, plan, spending cap | To run the service for your team | Contract (6.1.b) | While the organization exists |
| API keys: name, scopes, creation and last use. The key itself is kept only as a hash | To authenticate calls to the API | Contract (6.1.b) | Until the organization is deleted |
| Billing: customer and subscription records at Stripe, invoices, billing address and VAT number if you give them. Card data stays with Stripe | To bill you, collect payment and meet accounting and tax duties | Contract (6.1.b) and legal obligation (6.1.c) | 10 years, as Belgian accounting law requires (article III.86 of the Code of Economic Law) |
| Usage counters: checks per hour, key, workflow and kind. No content | Quotas, billing and usage charts | Contract (6.1.b) | While the organization exists |
| Decision journal: for each check, the time, request id, key, kind, workflow and version, decision, reasons with scores and thresholds, duration, size and your reference. Never the content, never the IP address or browser of the customer's users | The journal feature, support and proof of what the service answered | Contract (6.1.b) and legitimate interest in service records (6.1.f) | 7 days on the free plan, 30 days on paid plans |
| Audit log: who did what in the dashboard (action, target, time) with the network prefix of the IP address (the first 24 bits of an IPv4 address, the first 48 bits of an IPv6 address, never the full address) | Accountability and security | Legitimate interest in security (6.1.f) | While the organization exists |
| Abuse prevention: rate-limit counters (a keyed hash of your IP address, the route and the start of the time window, never the address itself) kept in our database, and the signals Turnstile uses to tell a person from a bot (processed by Cloudflare) | To keep the service available and protect forms from abuse | Legitimate interest in security (6.1.f) | Our counters: deleted a day after their window began (a minute at most). Turnstile's: as long as Cloudflare's own settings keep them, then deleted |
| Messages: the emails you send to contact@sway.events, and the transactional emails we send you (verification, sign-in link, invitation, billing and security notices) | To answer you and to run your account | Contract (6.1.b) and legitimate interest (6.1.f) | As long as needed to answer you and keep a record of the exchange |
Copies of the databases are kept as backups for 30 days, in Cloudflare's EU jurisdiction, to restore the service after an incident; they are then deleted. A deletion therefore leaves the backups within those 30 days.
We do not use analytics, advertising trackers or profiling.
Who receives it
- Our sub-processors, who help us run the service and are bound by data protection terms: Cloudflare (hosting, databases, file storage, email, bot protection), Hetzner (the checking server) and Stripe (payments and tax). The sub-processors page says what each one does and where.
- Authorities, when the law requires us to hand data over.
We do not sell personal data.
Transfers outside the European Union
Account, organization, usage and journal data is stored in the European Union: the databases and the file storage are created in Cloudflare's EU jurisdiction. The checking server is in the European Union.
The website, the dashboard and the front door of the API are delivered through Cloudflare's global network, and a request is handled in the Cloudflare location closest to the visitor. That location can be outside the European Union, because Cloudflare reserves regional pinning of this layer for its enterprise plans.
Cloudflare, Inc. and Stripe are United States companies. The transfers to them rely on the EU-U.S. Data Privacy Framework, to which each of them says it is certified, with the standard contractual clauses of their data processing terms as the fallback if the certification lapses. Write to us for a copy of these safeguards.
Your rights
You can ask us, free of charge, for:
- access to the data we hold about you, and a copy;
- correction of data that is wrong;
- erasure of your data;
- a limit on how we use it;
- your data in a portable format;
- to stop a use that rests on our legitimate interest (the right to object).
Write to contact@sway.events. We may ask you to prove who you are. We answer within one month, as article 12 of the GDPR sets. An organization's owners can also export their workflows, journal and usage from the dashboard at any time.
For account data that sits in an organization, the organization's owners may also act on it.
Complaints
If you think we handle your data unlawfully, write to us first so we can put it right. You may also complain to the Belgian data protection authority, the Autorité de protection des données (in Dutch, Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be. Its website is autoriteprotectiondonnees.be (French) and gegevensbeschermingsautoriteit.be (Dutch). You may also complain to the authority of the country where you live or work.
Automated decisions
We take no decision about you that rests only on automated processing and has legal or similarly significant effects. openshield returns a moderation result to our customers. The decisions about content and about people are theirs.
Security
Connections are encrypted. Passwords and API keys are stored as hashes. Account owners must turn on two-factor authentication before starting a paid plan. The systems that make up the service talk to each other through signed requests.
Cookies
See the cookie page: sign-in cookies and two preference cookies, no tracking.
Changes
The version date is at the top of this page. When a change matters to you, we tell the owners of each organization by email before it takes effect.