Information provided under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and of Italian Legislative Decree 196/2003, as amended by Legislative Decree 101/2018.
| Document | Privacy Notice — SwipeOut Business console |
| Version | 2026-10-24 |
| In force from | Date of publication |
| Replaces version | 2026-10-03 |
| Public URL | https://swipeout.it/legal/business/privacy-policy/en |
| Languages | Italian and English. Both versions have the same content |
| Addressee | The natural person who registers and uses a SwipeOut Business account |
Summary of changes
1.1 Controller.
Vittorio Barile
Via Don Angelo Sanzò 37 — 86017 Sepino (CB), Italy
VAT number (partita IVA) 01826370700
Controller's email: info@swipeout.it
1.2 Where to write to us. To exercise your rights, ask a question or make a complaint, write to info@swipeout.it. It is the same contact as in the SwipeOut app privacy notice: the same person can manage a venue and use the app, and a single channel avoids different answers to the same question.
1.3 Data protection officer. We have not appointed a data protection officer (DPO).
1.4 If the business moves to a company. If the business is transferred to a company, this notice will be reissued with the company's details and we will tell you as described in §14.
2.1 It is about you as a natural person. An organisation is not a data subject under the GDPR: you are, as the person using its account.
2.2 The sole trader exception. If you operate as a sole trader or self-employed professional, your business data — trading name, VAT number, registered address, contact details — also identifies you. In that case this notice applies to that data too.
2.3 You read it, you do not accept it. At registration we ask for your acknowledgement of receipt (presa visione) of this notice and record the date and version. It is not consent: the legal basis of the relationship is the contract, and asking for consent would suggest a revocability that does not exist.
| Data | Required | Where it comes from |
|---|---|---|
| First name and surname | Yes | From you |
| Yes | From you, or from your Google or Apple account | |
| Password | Yes, if you sign in with email | From you. We store it only in non-reversible form |
| Google or Apple account identifier | Only if you choose that method | From the provider |
| Console language | No | From your choice |
Name, type and address of the organisation, public contact details of the listing. When you activate a paid plan or buy a campaign: company or trading name, VAT number or codice fiscale (Italian tax code), registered address, SdI recipient code or PEC (Italian certified electronic mail) address.
When you claim a listing we record the channel through which we sent you the code (voice call, SMS, email or Instagram direct message), the public contact to which we sent it, the outcome, the date and time, any operator note and the statement by which you declare that you are the venue owner or authorised by them.
Content you publish (listing, menu, posts, events, campaigns), the audit log of listing changes, outcomes of automated checks and moderation, complaints you submit, requests to support.
For each contractual document you accept we record type, version, date and time, the clauses specifically approved, the context (registration, payment, new version) and technical session data, such as the IP address. For the acknowledgement of this notice we record version and date.
IP address, session identifiers, sign-in outcomes, date and time of operations.
If you connect the organisation's Instagram profile to import posts, we receive from Meta the profile identifier and the content you choose to import, and we keep the authorisation code Meta issues to us until you disconnect the profile.
If you choose to give it — it is optional — we use it to understand what is not working.
Only with your consent, collected through the cookie banner: screens visited, actions taken, type of device and browser. Details are in the Cookie policy.
Venue and organiser listings exist before you sign up: we build them from public sources and data providers (including Google Places, Meta and event data providers), with automatic enrichment. A listing may contain data about a person, for example the name of a sole trader or a contact detail.
If a listing contains data about you that is wrong, or that you do not want there, write to info@swipeout.it: we will correct or remove it. You do not need to be signed up.
Before launch you can leave your business contact on swipeout.it to be told when SwipeOut Business is available. We collect whether you run a venue or organise events, the name of the business, your first name, last name, city and email, the language of the page and, if you came from a link in one of our campaigns, the link parameters (source, medium, campaign). We do not store your IP address.
| Purpose | Legal basis | |
|---|---|---|
| a) | Creating and managing your account and letting you use the console | Contract (Art. 6(1)(b)) |
| b) | Checking that you are entitled to claim the listing and handling ownership disputes | Legitimate interest in preventing abusive claims and defending ourselves (Art. 6(1)(f)) |
| c) | Publishing the content you upload and importing the content you choose from Instagram | Contract (Art. 6(1)(b)) |
| d) | Checking and moderating content, handling notices and complaints | Legal obligations on digital services (Art. 6(1)(c)) and legitimate interest in keeping the platform lawful (Art. 6(1)(f)) |
| e) | Managing bookings, campaigns and service communications | Contract (Art. 6(1)(b)) |
| f) | Collecting subscription and campaign payments | Contract (Art. 6(1)(b)) |
| g) | Issuing and keeping invoices | Legal obligation (Art. 6(1)(c)) |
| h) | Keeping evidence of what you accepted | Legitimate interest in proving the contract and defending ourselves (Art. 6(1)(f)) |
| i) | Producing aggregated data on platform use and the comparison with similar venues | Legitimate interest (Art. 6(1)(f)). Never referred to you as a person |
| j) | Understanding why customers cancel | Legitimate interest (Art. 6(1)(f)), on data you provide if you wish |
| k) | Security, prevention of fraud and abuse, legal defence | Legitimate interest (Art. 6(1)(f)) |
| l) | Sending you commercial communications from SwipeOut | Consent (Art. 6(1)(a)). Optional, can be withdrawn, blocks nothing |
| m) | Console usage statistics in the browser | Consent (Art. 6(1)(a)), collected through the cookie banner |
| n) | Telling you when SwipeOut Business opens, if you pre-register on the website (§3.11) | Consent (art. 6.1.a) |
4.1 What happens if you do not provide the data. The data in points a), c), e) and f) is needed to provide the service: without it, you cannot use the console. Tax data is needed only for paid plans and campaigns. The consents in points l) and m) are free: if you do not give them, the service does not change.
4.2 The comparison with similar venues. Your organisation joins a benchmark peer set with other businesses of the same category and area, to produce the comparison you see in the console. The set is formed only with at least 8 organisations; below that threshold we widen the category and then the area, and we say so. No organisation in the set can be recognised by the others. If you are a sole trader you can object (Art. 21 GDPR) by writing to info@swipeout.it.
4.3 Legitimate interests assessment. For processing based on legitimate interest we have carried out a balancing assessment. You can ask for a summary at info@swipeout.it.
5.1 Bookings made in the SwipeOut app. In the console you see the name and contact details of the person who booked, date, time, party size, notes and, only if the person gave explicit consent, their allergies and their tastes for that booking. For this data you act as a processor on our behalf (Art. 28 GDPR), under the instructions in the Terms §9: you consult it in the console and use it only to manage that booking.
5.2 Bookings you enter yourself. If you record in the console a booking received in other ways (phone, in person), the customer's data is yours: you are its controller and we process it on your behalf as processor, under the conditions of the Terms §9.
5.3 How long it stays visible. Name and contact details for 90 days from the booked date; notes and allergies for 30 days. After that, the row remains in the statistics without personal data.
5.4 Allergies can never be exported, on any plan and in any format.
5.5 In the dashboard you never see an individual user. You see aggregated figures, with the thresholds in the Terms §10.
5.6 A customer's requests about their own data are handled by us. If you receive one, forward it to info@swipeout.it.
6.1 We do not process your card details. Payment takes place on the Stripe page: card and SEPA mandate details are collected and stored by Stripe. We receive the outcome and minimal payment data: amount, date, last digits of the instrument, status.
6.2 Each organisation has a separate customer profile with Stripe.
6.3 The Stripe receipt is not the invoice. We issue the electronic invoice, and it reaches you through the Sistema di Interscambio (SdI, the Italian e-invoicing exchange system), at the recipient code or PEC address you provided.
6.4 Invoices survive account deletion. The law requires us to keep them for 10 years. They remain disconnected from the account and are no longer visible in the console. You can ask for a copy at info@swipeout.it.
7.1 Content and campaign texts go through automated checks. Content may be hidden, or a campaign not approved, as a result of those checks.
7.2 We tell you the reason for the decision and how to appeal. You can always ask for a person to review the decision by writing to info@swipeout.it: we reply within 14 days.
7.3 We do not take decisions based solely on automated processing that produce legal effects on you as a person, within the meaning of Art. 22 GDPR. Human review remains guaranteed in any case.
8.1 Providers processing data on our behalf (processors, Art. 28 GDPR):
| Provider | What it does |
|---|---|
| Amazon Web Services | Servers, file storage and sign-in system |
| OneSignal | Delivery of service emails and notifications |
| Twilio | SMS and voice calls with the listing claim verification code |
| OpenAI and Anthropic | Language models for menu import, suggested post texts and dashboard insights |
| Google (Firebase) | Console usage statistics, only with your consent |
| Electronic invoicing service provider | Issuing invoices and sending them to the Sistema di Interscambio |
| Cookie consent management tool provider | Recording your choices on the banner |
8.2 Parties processing data as independent controllers:
8.3 Authorities, where the law requires it, and professionals who assist us in defending a right.
8.4 Transfer of the business. If the business passes to a company or a third party, the data passes to the new controller. We will tell you 30 days in advance.
8.5 No sale. We do not sell your data and do not share it with advertising intermediaries or data brokers.
9.1 Our servers and files are in data centres located in the European Union. Our team works from Italy and does not access the systems from outside the European Economic Area.
9.2 When data leaves the European Union. Some providers in §8 are based in the United States or may process data from there, even if only for technical support: Amazon Web Services, OneSignal, Twilio, OpenAI, Anthropic, Google, Stripe and Meta. In these cases the transfer is covered:
9.3 You can ask us for a copy of the safeguards adopted by writing to info@swipeout.it.
| Data | How long |
|---|---|
| Account and organisation data | For the duration of the relationship |
| Published content | Deleted within 30 days of your leaving the organisation |
| Invoices and the tax data they contain | 10 years, disconnected from the account |
| Evidence of what you accepted | For the duration of the relationship and 10 years after it ends |
| Claim verification log and authorisation statement | 5 years |
| Audit log of listing changes | 24 months |
| Access and security log | 12 months |
| Booking data visible in the console | 90 days name and contact details, 30 days notes and allergies |
| Instagram authorisation code | Until you disconnect the profile or leave the organisation |
| Cancellation reason | The link with your identity is removed after 24 months |
| Status of consent to commercial communications | Until withdrawn |
| Evidence of consent to commercial communications | 5 years from withdrawal |
| Requests to support | For the time needed to close them and to defend ourselves in case of dispute |
| Console usage statistics | As stated in the Cookie policy |
| Pre-registration on the website | Until the launch notice, 12 months at most; if you do not confirm it, the link expires after 7 days |
| Aggregated data | No limit: it no longer relates to a person |
10.1 Backups. Data deleted from production systems expires from backups through normal rotation, within 12 months.
11.1 You can exercise at any time the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection to processing based on legitimate interest (Art. 21) and to withdraw consent (Art. 7(3)), without the withdrawal affecting what was done before.
11.2 How. Write to info@swipeout.it. You can also change your consent to commercial communications from your profile in the console, and your consent to statistics from the cookie preferences.
11.3 Timing. We reply within one month, which may be extended by two months for particularly complex requests, in which case we tell you.
11.4 A limit to be aware of. The rights concern your data. For the data of customers who book through the app you are a processor, not a data subject.
11.5 Complaint. You can lodge a complaint with the Garante per la protezione dei dati personali (Italian data protection authority) — Piazza Venezia 11, 00187 Rome — garante@gpdp.it — protocollo@pec.gpdp.it — www.gpdp.it.
12.1 You can request deletion of your account from the console, where the function is available, or by writing to info@swipeout.it from the account's email address. We carry it out within 30 days of the request.
12.2 Before deletion the rules of the Terms §13 apply: confirmed bookings in the next 15 days must be handled, and the subscription ends without refund.
12.3 What remains: invoices (§6.4), evidence of what you accepted, the claim verification log for its retention period, evidence of consent to commercial communications and anything the law requires us to keep.
12.4 The listing does not always disappear. If we had built it from external sources and you claimed it, it returns to its pre-claim state and remains visible in the SwipeOut app. If you had created it, it is deleted.
We use encrypted connections, store passwords only in non-reversible form, limit access to systems by role, log administrative access and make backups.
If a personal data breach poses a risk to your rights, we notify the Garante within 72 hours and, where the risk is high, we also tell you.
14.1 Each version carries a date. If we change something significant we tell you by email, with a short summary.
14.2 At your first sign-in after the change, the console shows you the summary and asks for your acknowledgement of receipt of the new version. We do not ask you to accept it, because it is not a contract.
14.3 Previous versions can be requested at info@swipeout.it.
Vittorio Barile — controller
Via Don Angelo Sanzò 37, 86017 Sepino (CB), Italy — VAT number 01826370700
Controller's email: info@swipeout.it
For your data and to exercise your rights: info@swipeout.it
Version 2026-10-24. The controller's contact and the web addresses move to the new domain: info@swipeout.it and business.swipeout.it. New §3.11 and purpose n): pre-registration from the website. Nothing else changes.
Version 2026-10-10. The service is renamed SwipeOut. Nothing else changes.
Version 2026-10-03. Controller contact: info@easyvent.it. Providers updated: OneSignal for service emails, Twilio for verification codes, OpenAI and Anthropic for artificial intelligence services, Google Firebase for usage statistics with consent. New paragraphs on bookings entered by the venue (§5.2), Instagram connection (§3.7), evidence of acceptances (§3.5) and transfers outside the European Union (§9). Account deletion is carried out within 30 days of the request.
Version 2026-08-17. First publication.