Privacy Policy

This policy covers the Swipped website, apps, support, business dashboards, rides, orders, bookings, referrals and mini-apps. The controller and contact details are in our Legal Notice. Questions and rights requests can be sent to privacy@swipped.co.uk.

• Account and identity: name, date of birth or verification data where required, contact details, credentials, role and profile media.
• Transaction data: baskets, orders, bookings, reservations, jobs, ride routes, dates, addresses, instructions, prices, tips, refunds and disputes.
• Business, provider and tax-reporting data: trading and registration details, licences, insurance, vehicle, catalogue, staff, tax identification numbers, date of birth, financial account and payout onboarding information where required.
• Payment data: provider tokens, customer or connected-account IDs, limited card details, payment status, chargebacks and fraud signals; full card data is generally handled by the payment provider.
• Communications and content: chats, support contacts, reviews, reports, evidence, photographs, mini-app inputs and outputs, moderation decisions and notification choices.
• Technical and usage data: IP address, device/app/browser identifiers, logs, crash/security events, consent choices and approximate or precise location when enabled.
• Sensitive data: health or accessibility information, biometric/identity evidence, criminal-allegation or safeguarding information only where a feature, legal duty or safety case genuinely requires it. We minimise access and document an additional legal condition where special-category or criminal-offence rules apply.

Where identity verification is requested, Plaid processes the identity details, document images and any configured selfie or liveness evidence. Swipped stores the Plaid attempt identifier, overall status, step-status summary, Swipped review decision and relevant consent, submission, completion and review timestamps; it does not copy Plaid document or selfie files into the Swipped application database. The screen identifies Plaid and links to its end-user privacy policy before consent is recorded.

We receive data from you, people acting for your organisation, counterparties to a transaction, devices and app permissions, sellers/providers/drivers, payment and identity providers, mapping services, app stores, fraud-prevention sources and public registers where lawful.

• Contract: create and secure accounts; quote, arrange and fulfil orders, rides, jobs, reservations and payments; provide support.
• Legal obligation: tax and accounting records, digital-platform seller reporting, regulatory requests, product and transport safety, data-rights handling and prevention of unlawful transactions.
• Legitimate interests: secure and improve the Platform, prevent fraud and abuse, investigate disputes, moderate content, protect users, measure essential performance and operate business relationships—balanced against your rights.
• Consent: non-essential device storage, optional marketing, certain precise-location uses and permissions where consent is the appropriate basis. You may withdraw consent prospectively.
• Special-category or criminal-offence information: only where an Article 9 condition and any required UK Data Protection Act condition or other applicable local condition has been identified and documented.
• Vital interests or public task only in exceptional circumstances permitted by law.

With device permission, rides and location-aware features may process precise pickup, destination and live journey location. We use it to quote, match, navigate, track safety and resolve incidents. You can disable device permission, but live ride functions may not work; manual address entry is available where practicable.

We share only what is reasonably needed with the customer, seller, venue, driver, provider or affiliate involved; Stripe and other payment providers; Mapbox and mapping/location services; hosting, storage, email, support, analytics and security processors; professional advisers, insurers and auditors; app stores; and authorities or affected parties where law, safety, fraud prevention or legal claims require it. Where seller-reporting rules apply, we may share verified seller identity, tax, financial-account, consideration and fee information with HMRC or another competent tax authority and provide the seller with the required copy. We do not sell personal data for money and do not use it for cross-context behavioural advertising without the choice and disclosures required by law.

Identity and related device data needed for a configured check is shared with Plaid for identity, document, fraud and any configured liveness checks. Plaid's privacy policy is shown before the check starts. Results and protected document evidence may be reviewed by specifically authorised Swipped operators in Plaid's controlled dashboard or through Swipped's protected admin viewer, which retrieves evidence on demand and records operator access and may be used to decide whether payout, provider, driver, business or affiliate access can proceed. Customer checks may complete without a separate Swipped manual approval unless fraud, recovery, safety or another documented risk reason requires review.

When you use our AI support assistant, Swipped may send the text of a general help question to Cloudflare Workers AI to identify the relevant help topic. The assistant replies using Swipped's reviewed help text; it does not receive your account, order or payment records or uploaded files. Questions that appear to contain sensitive details, require an account-specific decision, or ask for a person are passed to our support team instead. Please do not include passwords, sign-in codes or full payment-card details in chat. Support conversations are retained under the chat and complaint periods above, and you can ask for human support at any time.

When a store chooses to generate listing suggestions from a product photo, Swipped sends a reduced copy of that photo and the permitted product categories to Cloudflare Workers AI. Embedded photo metadata is removed before transmission. This request does not include customer account, order or payment records. The store reviews suggested text and approximate packaged dimensions before applying them; nothing is published automatically. Optional plain-background cleanup runs on Swipped's server, and the original listing photo is retained when the store chooses a cleaned version. Avoid including people or private documents in product photos.

Swipped also processes a product's title, description and category in the background after creation or relevant edits to estimate its packaged size and weight for delivery, including when the store does not use photo suggestions. This product information may be sent to Cloudflare Workers AI; customer account, address, order and payment records are excluded. Approximate delivery estimates are stored separately from seller measurements and used with basket quantities and vehicle capacity rules. They do not change published listing text. Measurements take precedence, and unusual or bulky goods may require correction and confirmation that the driver's actual vehicle can carry the load.

Businesses receiving customer information must use it only to fulfil and support the relevant transaction or another lawful disclosed purpose, keep it secure, honour data rights, and not add customers to marketing lists without a valid basis. Their own privacy notice may also apply.

Some suppliers may process data outside the UK. Where the destination is not covered by UK adequacy regulations, we use an approved safeguard such as the UK International Data Transfer Agreement or UK Addendum, plus supplementary measures where appropriate. Saudi personal data is transferred outside the Kingdom only after the Saudi PDPL transfer conditions, including any assessment or approval requirement, have been addressed. Details of relevant safeguards may be requested.

• Account/profile data: while active; during a documented closure request while activity and money are settled; then deleted or anonymised unless a specific lawful purpose remains.
• Orders, payments, commissions, payouts and tax records: six years from the end of the company financial year they concern where UK company-record rules apply (which can span roughly seven calendar years depending on timing), or longer only where another duty or legal hold requires it.
• Bookings, rides, jobs, chats, complaints and safety evidence: normally up to 6 years after completion, shorter where risk and legal needs permit.
• Verification and fraud records: for the verification relationship and a proportionate period afterwards, subject to provider and legal requirements.
• Consent, policy acceptance and rights-request records: while relied on and for the period needed to demonstrate compliance, including the decision, searches, disclosures and completion evidence.
• Backups: removed on the documented secure rotation schedule; upheld erasures are placed on a suppression record so deleted data is not restored to active use.

Swipped retains the minimum Plaid verification status, audit reference and consent evidence for the verification relationship and a proportionate period afterwards for fraud, payout, dispute, safety and compliance needs. Plaid's separately disclosed retention and deletion controls also apply. An active or pending-review check must first be reconciled before permanent account closure; afterwards Swipped detaches the retained audit record from the active profile where lawful deletion is completed.

We use access controls, encryption in transit, credential protections, logging, role separation, supplier review and incident procedures proportionate to risk. We assess suspected personal-data breaches, contain and document them, and notify regulators or affected people where the legal threshold and deadline are met. No system is perfectly secure; users must protect credentials and report suspected compromise promptly.

Depending on the circumstances, you may request access, correction, erasure, restriction, portability, objection, and information about automated decisions; withdraw consent; and complain to the UK Information Commissioner’s Office. Rights can be limited by exemptions, competing rights, legal obligations and legal claims. We normally respond within one month after any necessary identity verification, with a lawful extension for complex or multiple requests.

We may use rules and risk signals to prioritise, match, flag or temporarily restrict activity. We do not intend to make a solely automated decision with legal or similarly significant effects unless authorised by law with required safeguards. Where applicable, you may request human review and contest the outcome.

Plaid results and other risk rules may temporarily restrict payouts or marketplace activity while a check is incomplete, unsuccessful or under review. Provider, driver, shop, restaurant and affiliate accounts must pass the configured Plaid check and receive a separate manual Swipped approval before protected marketplace actions are enabled. A Plaid pass does not guarantee marketplace approval. Authorised Swipped operators review the result, role, account context and relevant protected evidence, record an approval or rejection with an audit trail, and may require a new check where lawful and proportionate. Customer checks do not normally require that second manual approval unless fraud, recovery, safety or another documented risk reason applies. You may contact Swipped support to contest a result, provide context and request human review; we do not intend to make a solely automated decision with legal or similarly significant effects unless lawfully authorised with the required safeguards.

Service messages are sent where necessary to operate your account or transaction. Electronic marketing is sent with consent or another route specifically permitted by applicable direct-marketing law, with the sender identified and a working opt-out. Purchased, scraped or affiliate-supplied lists may not be used without documented permission. Opting out of marketing does not stop essential operational or legal notices.

Swipped accounts and transactions are for adults. We do not knowingly offer accounts to children under 18. A parent or guardian who believes a child supplied data should contact us so we can investigate and delete it where appropriate.

We use cookies, secure storage and related technologies as described in the Cookie & Device Storage Notice. Strictly necessary storage operates without optional consent where permitted; analytics, personalisation and marketing storage remain off until the required consent is given.

You can initiate deletion in the website and mobile app. We record the request even if final deletion must wait for active bookings, orders or reservations; an open refund or complaint; earnings, commission or business payouts; positive or negative wallet entries; payment reversals or chargebacks; or payment-provider balances and payouts still moving. We do not treat a closure request as forfeiture of money validly owed to you, or as cancellation of money validly owed by you.

During settlement, access is limited to what is reasonably necessary to resolve the account and we retain only the identity, contact, transaction, complaint and payout information needed for that purpose. When checks pass, the active profile is closed, eligible content and device links are removed or anonymised, and payment or payout profiles are deleted or disconnected where we have authority. Finance, tax, fraud, safety, dispute and legal-claim records may remain with restricted access until their documented retention trigger expires.

We normally respond to an erasure request without undue delay and within one calendar month after any necessary identity verification. Complex or multiple requests may lawfully take longer; if so, we will explain the extension. Where we cannot erase a record, we will identify the relevant category and reason rather than representing the entire record as deleted.

We will post changes here and notify users of material changes where appropriate. Contact privacy@swipped.co.uk first. UK users may complain to the Information Commissioner’s Office at ico.org.uk. If the Saudi Personal Data Protection Law applies, residents of the Kingdom may exercise the rights available under that law, including rights to be informed, access and obtain a copy, correction and destruction where applicable, and may complain through the competent Saudi authority. Users elsewhere may contact the regulator or court available under their mandatory local law. None of these routes removes another available remedy.