Privacy Policy

Last updated: September 2026

1. Controller

The controller responsible for the processing of personal data in connection with the use of the Swipe platform is:

Swipe UG (haftungsbeschränkt)
Karl-Scheele-Straße 2
60320 Frankfurt am Main
Germany
Email: info@swipe-service.de
Represented by its managing director, Mousa Hilaneh

2. Data Protection Contact

If you have any questions about data protection, the exercise of your rights, or this Privacy Policy, you can contact us at any time at info@swipe-service.de or by mail at the address above.

3. Scope of this Privacy Policy

This Privacy Policy applies to the websites, mobile applications, and related services provided by Swipe, in particular to the use of the platform under the domain swipe-service.de, to web and app functions, to communication and support processes, and to related contractual, payment, and verification workflows.

4. What Personal Data We Process

Depending on how you use the platform, we process the following categories of personal data in particular:

4.1 Account and Profile Data

We process the data you provide when registering and maintaining your profile, including first name, last name, email address, phone number, password hash, user role, user status, preferred language, and, for providers, additional company details, service categories, service area, company description, profile picture, and portfolio files.

4.2 Request, Job, and Offer Data

When clients post requests or providers submit offers, we process project descriptions, scheduling preferences, location and address data, categories, photos or other uploaded files, offer amounts, offer notes, and status information for matching and execution purposes.

4.3 Communication and Support Data

We process messages and other communication content within the platform, including file attachments in chats, support requests, follow-up questions about jobs, and the information you provide when submitting reports or complaints.

4.4 Provider Onboarding, Evidence, and Verification

For providers, we process company details, uploaded evidence such as trade licenses or similar documents, portfolio files, profile pictures, as well as status and session data from identity verification processes during registration and activation.

4.5 Payment and Billing Data

Where payments, fees, invoices, payouts, or billing processes are involved, we process billing address data, tax-related information, payment status, transaction references, Stripe customer or account identifiers, and billing-related documents.

4.6 Notification and Device Data

For notifications, we process push tokens, device identifiers, platform information, app versions, delivery and activity information, and your notification settings, such as email notifications, marketing emails, quiet hours, and time zone.

4.7 Technical Usage Data

When you use the platform, we process technical data such as IP address, timestamps of requests, request and response metadata, security and session information, authentication and refresh sessions, CSRF-related information, and browser-side storage values, for example for language settings or temporary drafts.

4.8 Legal Documents and Consents

We store which versions of privacy, cookie, or contractual documents you accepted and when such acceptance took place, for providers their confirmation that they act as a business, and the withdrawal declarations you send us, in order to meet our accountability and documentation obligations. For the cookie banner, we also keep a consent record on our server (see section 14.2).

4.9 Data When Using AI-Supported Functions

When you use AI-supported functions or content is checked automatically, we process the texts and photos required for this, such as job descriptions, answers from the request form, offers, profile texts, chat messages, review texts or the photos of requests and provider profiles, as well as the suggestions and check results generated from them (see section 11).

4.10 Usage Data for Statistics and Marketing

Only if you have given your consent via our cookie banner do we process usage data with Google Analytics and the Meta Pixel, such as pages visited, times, device and browser information, online identifiers from cookies, and certain events on our website (see section 14).

5. Purposes and Legal Bases of Processing

We process personal data only where permitted under the applicable data protection law.

Where the General Data Protection Regulation (GDPR) applies, we rely in particular on Article 6(1)(a), (b), (c), and (f) GDPR.

Where we store information on your device or access information already stored on your device, we do so pursuant to Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) only with your consent or, where this is strictly necessary to provide a service you have expressly requested, pursuant to Section 25(2) no. 2 TDDDG.

The processing serves the following purposes in particular:

• providing, operating, and securing the platform
• registration, login, session management, and account maintenance
• matching clients and providers
• submission, management, and choice of offers
• pre-contractual steps and job execution
• provider onboarding and verification
• payment processing, invoicing, and documentation
• communication between users and with our support team
• sending email and push notifications
• providing AI-supported functions, for example for automatically filling in requests, offer suggestions, translations, and summaries
• prevention of abuse, fraud, and circumvention
• handling reports, moderation actions, and legal defense
• publication and display of public provider profiles, ratings, and portfolio content where this is part of the platform function
• fulfillment of record-keeping, archiving, and accountability obligations
• monitoring the availability, performance, and errors of the platform
• statistical analysis of the use of our website (only with your consent)
• measuring and optimizing our advertising (only with your consent)
• contacting local businesses by email and phone about waiting requests (see section 9.1)

6. Matching, Job Execution, and Communication

Swipe’s core function is to connect clients and providers. For this purpose, we process the project and location information posted by clients as well as the offer and communication data submitted by providers.

Once a provider has paid the platform fee for an offer that a client chose, we share with each of the two the contact and job details of the other that are necessary to agree on and carry out the job directly.

Communication within the platform may be stored and processed where required for service delivery, evidence, dispute handling, abuse prevention, or enforcement of our platform rules.

7. Provider Profiles, Public Content, Ratings, and Portfolio

Certain provider information is public or visible to other users because this is part of how the platform functions. This may include company name, company description, service area, ratings, profile picture, and portfolio files published by the provider.

Please do not upload any information to public profile areas that you do not want to be publicly visible.

Client project or job content may be shown to suitable providers where necessary for matching.

8. Location, Maps, and Search Functions

When you enter places, postal codes, cities, or addresses, or use map features, we process the related location and geodata in order to provide search results, service areas, map views, and location-based functions.

According to the current product setup, no permanent background location tracking takes place. Location and address data are processed in particular when you enter them yourself or where a map or search feature requires those details.

9. Notifications and Marketing

We use your contact details to send transactional messages, such as those relating to registration, login, security events, messages, jobs, offers, status changes, payments, or reviews.

Where you give the relevant consent or enable the relevant setting, we may also use your email address for promotional information about our services. You can unsubscribe at any time with effect for the future.

9.1 Businesses We Contact

If only few providers registered with us cover a request, or a request receives no offer for some time, we tell local businesses of the matching trade near the job about it, by email and by phone. For this purpose, we take the name, phone number, address, website, and, where listed, email address of businesses from OpenStreetMap, a publicly accessible source (© OpenStreetMap contributors); where no email address is listed there, we take it from the contact or imprint page of the business's own website. This data relates to you if you run your business as a sole trader.

We only write or call about a real waiting job in the business's own trade within about 65 km. Our email names the job, the area, and the client's description with a link to the request, names us as the sender, and contains a link to unsubscribe; we write to an address at most once per trade. On a call, we say at the start who we are and where we got the number, and we do not call again if the business does not want to be called.

The data reaches our team in an internal email about the waiting request, which we delete once the request is closed; our server keeps the lookup result for up to seven days. So that we never write to a business twice about the same trade and can respect an unsubscribe, we keep the email address, the name of the business, the trade, the website the address came from, the date of our email, and, if you unsubscribe, the date of the unsubscribe; we keep this record for as long as we contact businesses in this way, and an unsubscribe permanently. The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in finding a provider for a waiting request and giving the business the chance of a job. You can object at any time (see section 16.1): with the unsubscribe link in the email, on the call, or by writing to info@swipe-service.de.

10. Checks, Reports, and Moderation

To protect the platform and its users, we may process data in order to detect, review, and document abuse, fraud, harassment, unlawful content, circumvention attempts, security incidents, or other violations of our rules.

Where content, users, messages, ratings, or posts are reported, we process the report data, moderation decisions, reasons, and any other case-related information as required.

Before saving, we check texts that other users read before a contact is unlocked (requests, offers, profile texts and reviews) on our own servers for contact details, and we refuse texts that contain them. In addition, we automatically check these texts and the photos of requests and provider profiles for possible rule violations with the help of an AI model. Details can be found in section 11.

A member of our team reviews everything the automatic check flags and decides whether to restrict it. If we restrict your content or your account, we tell you the reasons, including whether automated means were involved, and how you can contest the decision.

11. AI-Supported Functions

Some Swipe functions use an AI language model provided by OpenAI. The model generates suggestions, translations, summaries, and review notes. It does not make decisions that produce legal effects concerning you or similarly significantly affect you.

11.1 Functions and Data Processed

• "Auto-fill" when creating a request (for guests and clients, in the web application and in the apps): the text in which you describe your job (up to 2,000 characters) is sent to the AI model together with our category catalog. The model suggests a suitable category and entries for the request form. You can review and change the suggestions; the request is only published once you submit it yourself.
• "Suggest price & note" for providers: if a provider uses this function for a request, we send the client's job description, the category, the answers in the request form including free-text answers, as well as market and currency information, so that the model can suggest a price range and an offer text. The provider can change the suggestion before submitting the offer.
• "Translate" in the chat (for logged-in users): if you have a chat message translated, the text of this message is sent together with the target language. This also applies to messages from the other party.
• "Summarize reviews" (for logged-in users on the public provider profile): the texts and star ratings of up to 50 of a provider's most recent visible reviews are sent, without the reviewers' names, to create a summary.
• Automatic check of content: the texts of requests, offers, provider profiles and reviews, and the photos of requests and provider profiles, are checked automatically when they are saved. The result is only a note for our team. Photos you upload lose their metadata (for example the location where they were taken) before other users can see them.
• Reviews by our team: for moderation, reports, and disputes, our team may use an AI-supported analysis. In this case, the description of the request, offer details (price, status, and offer note), up to 40 chat messages between the client and the provider, and the file names of attachments may be sent.

We send OpenAI texts and, for the automatic check, the photos of requests and provider profiles; no documents or other files. Photos are sent only after their metadata has been removed, as a time-limited link to our storage. The requests to OpenAI are made by our server; your device does not connect to OpenAI. We do not add your name, contact details, user ID, or IP address. However, if the texts or photos sent contain such information themselves, it is sent along with them. Please therefore only enter in descriptions and messages, and only show in photos, what is necessary for your job, and in particular no health data or other particularly sensitive data.

11.2 Legal Bases

Where you use an AI function yourself, we process your data in order to provide the function you requested within the user relationship or to take pre-contractual steps (Article 6(1)(b) GDPR). We base the processing of other users' content, such as the chat messages of the other party, clients' job descriptions in the offer suggestion, or review texts, as well as the automatic check of content and the reviews by our team, on Article 6(1)(f) GDPR. Our legitimate interests lie in comprehensible communication between users, meaningful offers, protecting the platform against unlawful content and content that violates our rules, and handling reports and disputes efficiently.

11.3 Recipient and Transfers to Third Countries

The provider of the AI model is OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. OpenAI processes the data on our behalf under a data processing agreement (Article 28 GDPR). According to OpenAI, data sent via the API is not used to train its AI models.

The processing currently does not take place exclusively within the European Economic Area, but in particular also in the USA, by affiliates and sub-processors of OpenAI. OpenAI is not certified under the EU-U.S. Data Privacy Framework; the transfer is based on the European Commission's standard contractual clauses (Article 46(2)(c) GDPR) agreed in the contract with OpenAI.

11.4 Retention

With every request, we instruct OpenAI not to store the request and the response for later use. According to OpenAI, however, the content is stored for up to 30 days to detect and prevent abuse, unless longer storage is required by law.

Swipe itself does not store suggestions, translations, or summaries in its database; they are only displayed. Only what you adopt and submit yourself, such as a request or an offer, is stored. We store the result of the automatic check as an internal note for as long as the checked content is stored.

11.5 Usage Limits and Protection Against Automated Requests

To prevent abuse, we limit the number of AI requests per user account and, for users who are not logged in, per IP address. For this purpose, we briefly store a counter linked to your user ID or IP address, for no longer than about one day. The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in protecting the platform against abuse and excessive use.

If you use "Auto-fill" without being logged in, we additionally use Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA ("Cloudflare"), which distinguishes automated requests from people. For this purpose, your browser or the app loads a check element from Cloudflare's servers. Cloudflare processes technical signals such as your IP address, a TLS fingerprint, and information about your browser (user agent) and, according to Cloudflare, uses cookies and local storage to maintain the state of the check. Our server then has Cloudflare confirm the check result, stating your IP address. Cloudflare acts as our processor for the check; where Cloudflare uses the signals to improve its bot detection, Cloudflare is itself responsible for this. Further information can be found in Cloudflare's Turnstile Privacy Addendum (www.cloudflare.com/turnstile-privacy-policy/).

The legal basis for using Turnstile is Article 6(1)(f) GDPR; our legitimate interest lies in protecting this function against automated requests and abuse. Where information is stored on or read from your device in the process, this is strictly necessary for the function you requested (Section 25(2) no. 2 TDDDG). For transfers to the USA, see section 13.

12. Recipients and Services Used

We use external service providers and technical platforms to provide our services. Personal data may be transferred to the following categories of recipients where necessary for the respective function:

12.1 Microsoft Azure

We use Microsoft Azure infrastructure and storage services, in particular for hosting, file storage, and serving uploaded content such as profile pictures, portfolio files, post files, chat attachments, and invoice documents.

To monitor the availability, performance, and errors of our server, we also use Azure Application Insights (Azure Monitor). In this context, technical telemetry data is processed, such as the interfaces and addresses called, times, response times, status codes, error messages, server log entries, and connections to other services. According to Microsoft, your IP address is only used temporarily to determine an approximate location and is not stored. The telemetry data is stored in the Azure region West Europe and deleted after 90 days. The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in the secure and stable operation of the platform.

12.2 Stripe

We use Stripe services for payment processing and identity-related verification processes. Depending on the process, Stripe may process data both as a processor and as an independent controller, in particular for payment processing, fraud prevention, regulatory review, and identity verification.

12.3 Firebase Cloud Messaging

We use Firebase Cloud Messaging for push notifications in the mobile apps. In this context, push tokens, device information, and delivery-related data are processed to the extent required for delivering notifications.

12.4 Mapping and Geocoding Services

Depending on the technical configuration, we use in particular Google Maps Platform as well as Nominatim and OpenStreetMap for address lookup, geocoding, and map-related functions. We also use OpenStreetMap map tiles to display maps.

12.5 Fonts and Icons

The web application's fonts and icons are delivered together with the web application by our hosting (see section 12.1). No connection is made to Google or any other font provider for them.

The mobile apps do not load fonts or icons from Google servers either.

12.6 Email Service Providers

For sending system and service emails, we use an email or SMTP service configured by us.

12.7 AI Service, Protection Against Automated Requests, Statistics, and Marketing

We use OpenAI for AI-supported functions and Cloudflare Turnstile to protect the "Auto-fill" function (see section 11). Only with your consent do we use Google Analytics 4 of Google Ireland Limited and the Meta Pixel of Meta Platforms Ireland Limited (see section 14).

12.8 Other Recipients

In addition, data may be transferred to advisers, auditors, public authorities, courts, payment or debt collection service providers, or other recipients where this is legally required, contractually necessary, or necessary for the establishment, exercise, or defense of legal claims.

13. International Data Transfers

Depending on the market from which you use Swipe and on the services involved in the individual case, personal data may be processed in Germany, in other countries of the European Economic Area, or in other countries.

Where the applicable data protection law requires specific safeguards for cross-border transfers, we rely on appropriate safeguards or other legally permitted transfer mechanisms, in particular standard contractual clauses or comparable recognized safeguards.

In particular with OpenAI, Cloudflare, Google, and Meta, personal data is also transferred to or processed in the USA. The European Commission has adopted an adequacy decision for companies certified under the EU-U.S. Data Privacy Framework (Article 45 GDPR). Google LLC, Meta Platforms, Inc., and Cloudflare, Inc. are certified under this framework (as of September 2026); to that extent, we base the transfer on this decision. Where a recipient is not certified, as is currently the case for OpenAI, we base the transfer on the European Commission's standard contractual clauses (Article 46(2)(c) GDPR).

14. Cookies, Similar Technologies, Statistics, and Marketing

14.1 Required Cookies and Browser Storage

In the web application, we use required cookies and similar technologies in particular for authentication, session management, security, and CSRF protection.

We also use browser-side storage mechanisms such as Local Storage or Session Storage where this is necessary for language settings, storing your cookie choice, handling one-time tokens and email addresses from links in our emails, market-related development functions, or temporary drafts.

The legal basis for this is Section 25(2) no. 2 TDDDG and, for the associated processing of personal data, Article 6(1)(b) and (f) GDPR. An overview of the individual cookies and storage entries with provider, purpose, and retention period can be found in our Cookie Policy.

14.2 Consent via the Cookie Banner and Withdrawal

We only use statistics and marketing technologies if you have consented to the relevant category ("Statistics" or "Marketing") in the cookie banner. Both categories are switched off by default. We store your choice together with the time of your decision in your browser (Local Storage) so that we can respect it.

So that we can prove your consent (Article 7(1) GDPR), our server also records each choice with a random consent ID (which is also stored in your browser), the time, the version of the banner, and the categories chosen, without your IP address or your user account. We delete these records after three years. The legal basis is Article 6(1)(c) in conjunction with Article 7(1) GDPR.

You can withdraw your consent or change your choice at any time with effect for the future by opening the cookie settings via the "Cookie settings" link in the footer of our website. This does not affect the lawfulness of processing carried out before the withdrawal. The mobile apps contain neither Google Analytics nor the Meta Pixel.

14.3 Web Analytics with Google Analytics 4

If you consent to the "Statistics" category, we use Google Analytics 4 on our website, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). We use separate analytics properties for swipe-service.de and swipe-service.ae.

Google Analytics sets cookies that recognize your browser by means of a randomly generated identifier and collects information about your use of our website, such as the pages visited and their addresses, the referring website, the time and duration of the visit, interactions, information about your device and browser, language settings, and your approximate location (such as country, region, and city). We also send certain events: a completed registration (stating whether you registered as a client or a provider), a published request, a submitted identity verification, a submitted offer (with amount and currency), and a chosen offer (with amount, currency, and offer number). We use this information to analyze the use of our website statistically and to improve our services.

According to Google, Google Analytics 4 does not store IP addresses. For users in the EU, the IP address is only used on servers in the EU to derive the approximate location and is then discarded.

Google processes the data as our processor (Article 28 GDPR); Google's data processing terms for its advertising products, which also cover Google Analytics, apply. Data may also be transferred to Google LLC in the USA (see section 13). Google explains how it processes data from websites that use Google services at policies.google.com/technologies/partner-sites.

The legal basis is your consent (Section 25(1) TDDDG, Article 6(1)(a) GDPR). The cookies have a lifetime of up to two years. The data stored by Google at the level of individual users and events is deleted after the retention period we have set, which is no longer than 14 months.

Without this consent, Google Analytics is not loaded and no connection to Google is established. If you withdraw your consent, no further data is sent to Google from that moment on.

14.4 Meta Pixel

If you consent to the "Marketing" category, we integrate the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta") on our website. Without this consent, the Meta Pixel is not loaded and no connection to Meta is established. We use the Meta Pixel to measure the effectiveness of our ads on Facebook and Instagram, to build audiences for our advertising, and to optimize the delivery of our ads.

In the process, the following data in particular is transmitted to Meta: your IP address, information about your browser and device, the pages of our website you visit and the referring page, times, identifiers from the _fbp and _fbc cookies, as well as clicks on buttons and page metadata. We also send the events page view, completed registration (with user role), published request, submitted identity verification, submitted offer, and chosen offer (the last two each with amount and currency). We do not use the matching of contact details (Advanced Matching). Meta may link the data to your Facebook or Instagram account if you have one, and may also use it for its own purposes, for example to personalize ads, features, and content and to improve and secure the Meta Products.

We and Meta are joint controllers for the collection of data on our website and its transmission to Meta (Article 26 GDPR). For this purpose, we have concluded a joint controller agreement with Meta (Controller Addendum, available at www.facebook.com/legal/controller_addendum). Under this agreement, we are in particular responsible for informing you about the joint processing; Meta is responsible for fulfilling your rights under Articles 15 to 20 GDPR with regard to the data that Meta stores after the joint processing. You can also exercise your rights directly against Meta; we forward requests addressed to us to Meta. Meta is solely responsible for any further processing after the transmission. Details on how Meta processes data and how you can exercise your rights against Meta can be found in Meta's Privacy Policy at www.facebook.com/privacy/policy.

Meta may also transfer the data to Meta Platforms, Inc. in the USA (see section 13). The legal basis is your consent (Section 25(1) TDDDG, Article 6(1)(a) GDPR). The _fbp cookie has a lifetime of up to 90 days; the lifetime of the _fbc cookie is set by Meta. How long Meta stores the transmitted data is governed by Meta's Privacy Policy.

15. Retention Periods

We store personal data only for as long as it is necessary for the respective purposes or where legal retention obligations apply.

We generally store account and profile data for the duration of the user relationship and beyond where necessary to handle open matters, defend legal claims, or comply with legal obligations.

Contract, payment, invoice, tax, and similar records are stored in accordance with applicable commercial, tax, or other statutory retention periods.

Notification, security, moderation, and evidence-related data are stored for as long as necessary for the relevant security, documentation, or legal purpose.

Publicly visible profile and portfolio content generally remains available until it is removed, replaced, or the relevant account is deleted.

For AI-supported functions, telemetry data, Google Analytics, and the Meta Pixel, the periods stated in sections 11, 12.1, and 14 also apply.

16. Your Rights

Depending on the applicable data protection law, in particular under the GDPR, you may have the following rights, subject to the statutory requirements:

• the right to access information about the processing of your personal data
• the right to rectify inaccurate or incomplete data
• the right to erasure of your data, provided that no legal or contractual retention obligations prevent this
• the right to restrict or stop certain processing activities where provided by law
• the right to data portability where provided by law
• the right to object to certain processing activities or to withdraw any consent given with effect for the future
• the right to lodge a complaint with a competent data protection or supervisory authority

You can withdraw any consent you have given at any time with effect for the future, for statistics and marketing technologies via the cookie settings (see section 14.2).

16.1 Your Right to Object (Article 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Article 6(1)(f) GDPR. This concerns in particular the processing of other users' content by AI-supported functions and the automatic check of content (section 11), usage limits and Cloudflare Turnstile (section 11.5), telemetry with Azure Application Insights (section 12.1), and emails and phone calls to businesses about waiting requests (section 9.1). If you object, we will no longer process your personal data for these purposes unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.

Where we process your personal data for direct marketing, you can object to this at any time; we will then no longer process your data for this purpose.

A short message to info@swipe-service.de is enough to object.

17. Data Security

We take appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access, unauthorized disclosure, alteration, or destruction. These measures include, in particular, role-based access restrictions, security mechanisms for authentication and sessions, and technical measures to protect stored and transmitted data.

18. Links to Other Websites and Services

Our platform may contain links to third-party websites or services. Their respective providers are solely responsible for their content and privacy practices.

19. Currency and Changes to this Privacy Policy

We update this Privacy Policy if platform functions, data processing activities, or the legal framework change. The version published on the platform from time to time shall apply.

Where we are legally required to do so or where changes are material, we will also inform you in an appropriate manner, for example by email.