Your privacy matters to us. Here is exactly how we collect, use, and protect your data.
Last updated: 11 July 2026
SwapWithUs is a peer-to-peer platform that lets people exchange homes, clothes, books, and caravans. The platform is operated by SwapWithUs Oy, a company registered in Finland.
SwapWithUs Oy is the data controller for all personal data collected through this website and the services described in this policy.
Privacy contact: [email protected]
Collected when you register:
Collected when you create a listing:
We only process your data when we have a lawful basis to do so. The table below explains which basis applies to each type of processing.
| Processing activity | Lawful basis |
|---|---|
| Creating and managing your account | Contract — necessary to provide the service (Art. 6(1)(b)) |
| Displaying your listings to other users | Contract — necessary to provide the service (Art. 6(1)(b)) |
| Sending messages between users | Contract — necessary to provide the service (Art. 6(1)(b)) |
| Optional profile fields (photo, phone, social links) | Consent — you choose to provide these (Art. 6(1)(a)) |
| Security, rate limiting, fraud prevention | Legitimate interest — protecting the platform and its users (Art. 6(1)(f)) |
| Saving favourite listings | Legitimate interest — improving your experience (Art. 6(1)(f)) |
| Sending marketing or newsletter emails | Consent — only if you opt in at registration (Art. 6(1)(a)) |
| Data type | Retention period |
|---|---|
| Account and profile data | Until you delete your account, then permanently erased within 30 days |
| Listings and photos | Until you delete the listing or your account |
| Messages | Until you delete your account |
| Reviews | Until the reviewing user deletes their account |
| IP address / security logs | 90 days |
We use the following sub-processors to operate the platform. Each processes data on our behalf under a data processing agreement.
Google Firebase & Google Cloud Platform
Role: Authentication, real-time messaging, file storage, and CDN
Location: Primary storage: europe-north1 (Finland). Some Firebase Auth processing may occur in the US under EU Standard Contractual Clauses (SCCs).
Google Cloud SQL (PostgreSQL)
Role: Main application database for user profiles, listings, swaps, and reviews
Location: europe-north1 (Finland) — within the EEA
Redis Cloud
Role: Rate limiting and temporary security data
Location: EU region
Google reCAPTCHA v3
Role: Bot and abuse prevention (Firebase App Check)
Location: Google infrastructure, processed under Google's privacy policy
Your data is stored primarily within the EEA (europe-north1, Finland). Some data processed by Google Firebase Authentication may be transferred to servers in the United States.
Where data is transferred outside the EEA, we ensure appropriate safeguards are in place under GDPR Art. 46, specifically EU Standard Contractual Clauses (SCCs) with Google LLC. You may request a copy of these safeguards by emailing [email protected].
These cookies are strictly necessary for the platform to function. They do not require your consent. We do not use any analytics, advertising, or tracking cookies.
We do not sell your personal data. We share data only in these circumstances:
Under GDPR you have the following rights. To exercise any of them, email [email protected]. We will respond within one month of receiving your request, as required by GDPR Art. 12(3). Where a request is complex or we receive a high volume of requests, this period may be extended by up to two further months — if so, we will let you know within the first month and explain why.
Right of access (Art. 15)
Request a copy of all personal data we hold about you.
Right to rectification (Art. 16)
Correct inaccurate or incomplete data. You can update most profile data yourself in your account settings.
Right to erasure (Art. 17)
Delete your account and all associated data. You can do this directly in Profile → Settings → Delete Account.
Right to restriction (Art. 18)
Ask us to pause processing of your data while a dispute is resolved — for example if you contest the accuracy of the data we hold.
Right to data portability (Art. 20)
Receive your data in a structured, machine-readable format (JSON) and transfer it to another service.
Right to object (Art. 21)
Object to processing based on legitimate interests (e.g. saving your favourite listings). You may also unsubscribe from marketing emails at any time using the link in the email.
Right to withdraw consent (Art. 7(3))
Withdraw consent for optional processing, such as marketing emails, at any time. This does not affect the lawfulness of processing before withdrawal.
Right to lodge a complaint (Art. 77)
If you believe we have handled your data unlawfully, you have the right to lodge a complaint with the Finnish data protection supervisory authority.
SwapWithUs is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected data from a minor, please contact us at [email protected] and we will delete it promptly.
We may update this policy to reflect changes in our services or legal requirements. If we make a material change, we will notify you by email at least 14 days before it takes effect. The "Last updated" date at the top of this page will always reflect the current version. Continued use of the platform after the effective date constitutes acceptance of the updated policy.
For any privacy-related questions or to exercise your rights, contact us:
If you are not satisfied with our response, you have the right to lodge a complaint with the Finnish supervisory authority:
Tietosuojavaltuutetun toimisto
(Office of the Data Protection Ombudsman)
Website: tietosuoja.fi
Email: [email protected]