Privacy policy
Last updated: 14 October 2026
This page is an English translation, provided for information only. SwimUp is operated from France: French law applies and the French text is the authentic version. If the two versions differ, the French version prevails. This is not legal advice.
This page explains which personal data SwimUp uses, why, how long it is kept, who receives it and how you stay in control. It applies to visitors, clients and members.
1. Who is responsible
The data controller is Enzo TIMELLI (Sole proprietor (micro-entrepreneur)), Private address, not published. Contact: noreply@swimup.net. There is no data protection officer: the contact address above is used for all requests.
2. What we do with your data
| Why | Which data | Legal basis | How long |
|---|---|---|---|
| Creating and managing your account, logging you in | Email, password (hashed), role, date of last login, two-factor authentication if turned on | Contract (terms of use) | As long as your account exists, then deletion on your request |
| Preventing fraud and duplicate accounts | IP address at sign-up and at login | Legitimate interest (protecting the service and members’ pay) | As long as your account exists (it is updated at each login) |
| Processing review orders and payments | Email, link to the listing, name and type of business, review instructions, amount, Stripe or PayPal payment identifier | Contract (terms of sale) and legal obligation (accounting) | Accounting records: 10 years (legal obligation). The rest: as long as your account exists |
| Paying members | PayPal email, balance, history of earnings and withdrawals, Discord identifier (help and verification) | Contract (terms of use) and legal obligation (accounting) | Earnings and withdrawals: 10 years (accounting). PayPal email and Discord identifier: as long as your account exists |
| Providing the business tools | Review link settings, histories, analyses, campaigns (see below for their retention periods) | Contract | See the list of periods below |
| Sending service emails | Email, content of the message (verification, order, reminders, forgotten password) | Contract | Technical sending log: 6 months |
| Contacting shopkeepers to present SwimUp (business-to-business prospecting) | Business name, address, phone, website and email from the Google listing, rating and number of reviews | Legitimate interest (approaching businesses with an offer related to their activity) | Until you object, and 3 months after the last exchange |
| Counting visits to public pages | Page visited, with no IP address and no cookie | Legitimate interest (knowing which pages are read) | Aggregated statistics: 1 year |
| Helping users | Messages, tickets, technical errors | Contract and legitimate interest | Technical errors: 30 days. Tickets: 30 days |
No advertising, no resale of data, no automated decision that produces a legal effect on you. Passwords are stored hashed (unreadable).
3. Shopkeepers contacted by SwimUp
To present SwimUp, we write to businesses using the public information of their Google listing (source: Google Places). The message says where the address comes from. You can object at any time by clicking “Unsubscribe me” in the email or by writing to noreply@swimup.net: we then never write to you again. To keep that promise, we keep an encrypted fingerprint of your address (not the address itself) so as not to contact you again if your listing is found later. Each contact receives at most one follow-up.
4. Your customers’ addresses (campaigns)
When a business launches a review email campaign, it decides to write to its customers: it is responsible for those addresses and SwimUp acts on its behalf (processor). The addresses are kept for the time of sending (and of the chosen reminder), then erased at the end of the campaign, after 45 days at most. SwimUp only keeps a non-reversible fingerprint of each address so as not to ask the same person for a review again and to respect unsubscriptions. Each email contains an unsubscribe link. The addresses are never included in the business’s export.
5. Who receives your data
Only the people who administer SwimUp have access to it. We use these providers, which process data on our behalf:
- Railway: Hosts the site and the API. Location and transfer safeguard: United States; Data Privacy Framework or standard contractual clauses depending on their processing agreement (section 9.2).
- Turso: Hosts the database. Location and transfer safeguard: Ireland.
- Resend: Sends emails (service, review requests, campaigns). Location and transfer safeguard: United States; certified under the Data Privacy Framework.
- Stripe: Collects card payments and subscriptions. SwimUp never sees your card number. Location and transfer safeguard: United States; certified under the Data Privacy Framework, with standard contractual clauses as a fallback.
- PayPal: Receives payments from clients and pays out members’ earnings. Location and transfer safeguard: Luxembourg (PayPal (Europe) S.à r.l. et Cie, S.C.A.). PayPal acts as an independent controller: any transfers it makes outside the EU fall under its own privacy policy.
- Google (Places): Provides the latest reviews of a listing, local search results and the listings used for prospecting. Location and transfer safeguard: United States; certified under the Data Privacy Framework, with standard contractual clauses as a fallback.
- Groq: Writes draft replies to reviews and analysis summaries. It receives the text of the review to work on it. Location and transfer safeguard: United States; EU standard contractual clauses.
- Umami: Counts visits to public pages, with no cookie, no profile and no IP address. Location and transfer safeguard: United States (Umami Software, Inc.); EU standard contractual clauses, data processing agreement accepted at sign-up.
- Discord: Help and exchanges with members, if you join the server. Location and transfer safeguard: Discord alone decides how your data is used on its server.
Several of these providers are located outside the European Union, mostly in the United States. Transfers then rely on the EU–US Data Privacy Framework or on standard contractual clauses, as indicated above. Authorities and administrations may also receive data when the law requires it.
6. How long for the business tools
Loading…
7. Your rights
You can ask for access to your data, its correction, its erasure, restriction of processing, its portability, and object to processing based on legitimate interest (including prospecting, without having to justify yourself). Where processing relies on your consent, you can withdraw it at any time. You can also give instructions on what happens to your data after your death.
For the business tools, you download a copy of your data and erase it yourself: Reputation, Settings tab. Erasure keeps the review link (your printed QR code keeps working), the unsubscriptions and the payments.
For any other request (correction, account deletion, objection), write to noreply@swimup.net. You can also go through the SwimUp Discord server, but email remains the official channel. We answer within one month. Payment records cannot be erased: the law requires us to keep them.
8. Complaint
If you think your rights are not respected, you can first write to us. You can also contact the CNIL (the French data protection authority): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or online at cnil.fr/fr/plaintes. If you live in another EU country, you can also contact your own data protection authority.
9. Cookies
The only cookie keeps you logged in. No advertising cookie. The detail is on the cookies page.
10. What the tools do not do
- Google only provides the latest reviews of a listing (5 at most): the analyses are based on those.
- Visibility positions are indicative readings, not an official Google ranking.
- A click on your review link does not mean a review was published.
This page is updated when practices change. The date is at the top of the page.