Privacy Policy
This is a translation for convenience; the English version is authoritative.
Last updated: 7 July 2026
This policy explains how we process your personal data when you use Swipeless (swipeless.ai), our AI video creation platform. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Cyprus law.
1. Data controller
The controller responsible for your personal data is Sanava LTD, a company registered in Cyprus at Ανθυπολοχαγού Γεωργίου Μ. Σάββα, 26, SHOP 1-2, 8201, Πάφος, Κύπρος. You can reach us at [email protected] for any privacy matter.
2. What data we process
- Account data: your name, email address and a securely hashed password.
- Content you provide and create: scripts, uploaded audio or video, source links, and the videos and images generated for you.
- Usage and billing data: credits consumed, projects created, and payment records.
- Technical data: request and security logs (such as IP address and timestamps) needed to operate and protect the service.
- Product usage data: which features of the platform you use and when you are active (for example page visits and actions inside the app, and session durations derived from them), collected first-party so we can understand and improve the product.
- Optional integration credentials: if you connect your own provider accounts (a Google Cloud service account, ElevenLabs, OpenRouter or Gemini API keys, or YouTube OAuth credentials), we store them encrypted at rest and use them only to run your generations and uploads on your accounts. You can disconnect them at any time in Settings.
3. Purposes and legal bases
- Providing the service (your account, generating the media you request): performance of a contract, Art. 6(1)(b) GDPR.
- Billing, accounting and tax records: compliance with a legal obligation, Art. 6(1)(c) GDPR.
- Security, abuse prevention and improving the service: our legitimate interests, Art. 6(1)(f) GDPR. This includes the first-party product usage analytics described above: it runs entirely on our own servers, uses no third-party analytics tools and no additional cookies or identifiers (only the session that already signs you in), and is never shared or used for advertising.
- Any optional communications you opt into: your consent, Art. 6(1)(a) GDPR, which you may withdraw at any time.
4. Processors and recipients
We share the minimum data necessary with service providers who act as our processors:
- Google Cloud (Vertex AI): script, image and video generation.
- Google / YouTube APIs: uploading finished videos to YouTube channels you connect.
- OpenRouter: AI text generation for scripts and prompts.
- ElevenLabs: AI voiceover generation.
- Bright Data: retrieval of public web content (pages and posts you point the research features at); your account data is not shared with them.
- Stripe: payment processing.
- Cloudflare: hosting, content delivery, media storage, backups and security.
We do not sell your personal data.
5. International transfers
Some of these providers may process data outside the European Economic Area, including in the United States. Where this happens, the transfer is safeguarded by the European Commission Standard Contractual Clauses and, where applicable, the EU U.S. Data Privacy Framework.
6. Retention
We keep your account data and content for as long as your account is active. In addition:
- Deleted projects stay in your trash for 30 days (so you can restore them), then they and their media files are permanently removed.
- Database backups are retained for 72 hours and then expire automatically, so deleted data also disappears from backups within 3 days.
- Billing records (invoices, credit transactions) are kept for as long as legal retention obligations require, even after account deletion.
- Product usage events (raw page visits and in-app actions) are deleted after 90 days; only daily per-account aggregates are kept for the lifetime of the account. Both are included in your data export and erased when you delete your account.
When you delete your account, all other personal data — profile, projects, media, uploaded files and stored integration credentials — is removed immediately.
7. Your rights
Under the GDPR you have the right to:
- access your personal data and receive a copy,
- rectify inaccurate data,
- erase your data ("right to be forgotten"),
- restrict or object to processing,
- data portability,
- withdraw consent at any time, without affecting prior processing.
You can exercise the most important rights yourself, at any time: Settings → Privacy & data lets you download a full copy of your data (access and portability) and permanently delete your account (erasure). For anything else, contact us at [email protected]. We respond within one month.
8. Right to complain
You may lodge a complaint with a supervisory authority. In Cyprus this is the Office of the Commissioner for Personal Data Protection (dataprotection.gov.cy). You may also contact the authority in your own EU country of residence.
9. Cookies and local storage
We use only strictly necessary browser storage: a session cookie (httpOnly) that keeps you signed in, and local storage for your profile display data and theme preference. We do not use advertising or third-party tracking cookies, so no consent banner is required.
10. Automated decision making
Swipeless uses AI models to generate content at your request. We do not make automated decisions that produce legal or similarly significant effects about you within the meaning of Art. 22 GDPR.
11. Changes
We may update this policy. We will post the new version here and update the date above. Material changes will be communicated where appropriate.
12. Contact
Sanava LTD, Ανθυπολοχαγού Γεωργίου Μ. Σάββα, 26, SHOP 1-2, 8201, Πάφος, Κύπρος. Email: [email protected]