Privacy Policy
This English translation is provided for convenience only. The French version is the only legally binding text and prevails in case of any discrepancy.
Product
version Last updated: 22/10/2026
1. Introduction
At swap-iit, we take your privacy seriously. We tell you everything, simply, without any unnecessary legal jargon.
This policy explains what data we collect, why, how long we keep it, and how you can exercise your rights. It covers two situations: that of a person on the waiting list prior to the launch, and that of a member who has created an account.
Data controller:
LEAN GRUP SLU
NRT number: L-715548-L
3 Avinguda de la Bartra, AD200 Encamp, Andorra
Contact: hello@swap-iit.com
Important note: as swap-iit is operated by an Andorran company that processes the data of European residents, we voluntarily apply the standards of the European General Data Protection Regulation (GDPR) to all our data processing activities.
2. What data do we collect?
If you signed up to the waiting list before accounts opened:
- Your email address, required;
- your first name, the brands you collect, an indication of how many duplicates you have – all of this is optional;
- your IP address, your browser, the source of your visit and the date you registered;
- a personal referral code that we generate.
If you create an account, the following are added:
To create an account, you’ll need your email address, your username, your password (which we never store in plain text) and your date of birth, which is used to verify that you’re of the minimum age.
If you provide them, include your first name, a short biography, your region and a profile photo.
If you list your collection, you can specify the figures you own, the ones you’re looking for, their condition, and the photos you’ve taken.
If you take part in a swap, your postal address and telephone number, which are required for posting; your conversations with the other member; and your swap history.
If a swap involves a sum of money, your wallet balance, any transactions, and the reference numbers for top-ups will be displayed. Your bank details are never transmitted via swap-iit: your card details are entered with our payment processing provider, and we only retain the transaction reference and amount.
Automatically: your last login and your most recent activity, so as not to send you an email when you’re already at your screen; actions taken by our team on your account, logged; your notification subscriptions, if you’ve opted in.
If you enable two-factor authentication, a secret key and recovery codes are stored in hashed form.
3. Why do people collect them?
How the service works: managing your account, displaying your collection, suggesting swaps, dispatching your parcels, collecting payments where due, and notifying you of anything that concerns you.
Protecting members: verifying the minimum age, limiting fraudulent registrations, identifying attempts to take the swap off the platform – where members would no longer be covered – and mediating disputes.
Meeting our obligations: retaining records of financial transactions for as long as required by law.
Improving the product: understanding which brands you collect and where you’re from.
4. Legal basis for processing
- Contract fulfilment: account, collection, matching, exchange, dispatch, wallet. Without this data, the service does not exist.
- Consent: newsletter, notifications on your device, optional profile information. You may withdraw your consent at any time.
- Legitimate interests: security, fraud prevention, moderation, audience measurement (Matomo, with no advertising or cross-referencing with other sites; see the cookie policy).
- Legal requirement: retention of payment-related documents.
5. What you need to know, even if it works against us
Four points we’d rather spell out clearly rather than leave you to figure them out for yourselves.
A dispute resolution process provides access to the entire conversation. When someone reports a message, a member of our team reads the thread, not just the reported message: a sentence taken out of context is sometimes a response to something worse than the message itself. We never read a conversation unless it has been reported or is the subject of an ongoing dispute.
A message blocked by the filter is retained. If you include a telephone number or a link to another messaging service, the message will not be delivered to the recipient, but it will remain visible to our team. This enables us to distinguish between an honest mistake and a repeated attempt to circumvent the system.
Your collection may be accessed by our team, subject to a written request and following a set procedure. It is never displayed alongside your account in our administration tool, and our performance metrics are calculated without ever naming anyone. To view it, an administrator must state the reason for doing so; their name, the date and this reason are then recorded in a log that the whole team can review and which we cannot delete. There are three situations in which this is justified: resolving a dispute, investigating a report, or responding to a request you have sent us. If you wish to know whether your collection has been accessed, and why, please write to us: we will provide you with the relevant entries from the log.
Deleting your account makes it anonymous; it does not delete it entirely. Your trades and messages will remain, marked as ‘Account deleted’. There are two reasons for this: our accounting obligations, and the fact that the other party is entitled to their own transaction history. Your email address, postal address, photos and profile details, however, are permanently deleted. Any penalties remain in place; otherwise, it would simply be a matter of creating a new account.
6. How long do we keep your data?
- Your account: for as long as it exists. Anonymisation takes place immediately upon deletion.
- A conversation with no new messages: 12 months, then automatic deletion.
- An unpaid top-up: 2 hours.
- An unanswered swap offer: 7 days.
- A password reset link: 1 hour.
- Waiting list details: for as long as you’re on the list, and for a maximum of 12 months if you don’t create an account.
- After unsubscribing: 30 days.
- IP addresses and technical data: 12 months at most.
- Payment-related items: the period stipulated by accounting legislation.
- Backups: 90 days after deletion, before being overwritten.
7. Who we share your data with
Principle: we never sell your data, and we do not share it with anyone for commercial purposes.
| Service provider | Role | Localisation |
|---|---|---|
| Infomaniak Network SA | Hosting | Switzerland |
| Anthropic | Analysis of figure photos: quality of the photograph, condition of the item, assistance with identification | Outside the European Union |
| Payment processing provider | Payment by card | Andorra |
| Courier services (Mondial Relay) | Parcel dispatch | European Union |
| Self-hosted Matomo | Audience measurement, without cookies | Switzerland |
What the other member of a swap can see: your username, your region (if you’ve provided it), your trust rating, and, when it’s time to post, the postal address required for delivery.
Authorities: only upon a binding legal request.
8. Transfers outside Europe
Two processing operations take place outside the European Economic Area, and we prefer to state this clearly.
Photos of your figurines are analysed by an artificial intelligence service hosted outside the European Union to check the quality of the photograph and assess the condition of the item. These photos show figurines, not people. They are not used to train any models.
Payments are processed from Andorra, which benefits from a partial adequacy decision with the European Union.
The rest of your data is hosted in Switzerland, a country covered by an adequacy decision.
9. Data security
We implement technical and organisational measures to protect your data:
- HTTPS encryption is mandatory across the entire site
- Password encryption using the Argon2ID algorithm (state of the art)
- Regular encrypted automatic backups
- Restricted access to personal data (only the team that needs it has access)
- Logging of access events to detect intrusions
- Rate limiting to prevent automated attacks
- Hosted by Infomaniak in Switzerland (ISO 27001 and 9001 certified)
In the event of a data breach that could pose a risk to your rights and freedoms, we undertake to notify the CNIL and to inform you within 72 hours in accordance with the GDPR.
10. Cookies
Good news: we only use technical cookies that are strictly necessary for the website to function.
No advertising tracking cookies, no third-party analytics cookies (Google Analytics, Meta Pixel, etc.).
Details of the cookies used:
| Name | Purpose | Duration | Type |
|---|---|---|---|
| session | Security and session persistence | Close browser | Technique |
| csrf_token | Anti-CSRF protection | Session | Technique |
These cookies are exempt from the requirement for consent in accordance with the CNIL, as they are strictly necessary for the service to function.
11. Your rights
In accordance with the GDPR, you have the following rights:
- Right of access: to obtain a copy of the data we hold about you
- Right to rectification: to correct inaccurate data
- Right to erasure (“right to be forgotten”): request the deletion of your data
- Right to restriction of processing: requesting that processing be suspended
- Right to data portability: retrieve your data in a structured format
- Right to object: to object to processing based on legitimate interests
- You have the right to withdraw your consent at any time
- The right to set out instructions regarding what should happen to your data after your death
How to exercise your rights:
Simply email us at hello@swap-iit.com with your enquiry. We’ll reply within 30 days (usually within 48 to 72 hours).
To unsubscribe from the newsletter, there is a “Unsubscribe” link in every email we send you. All it takes is a single click.
Right to lodge a complaint: if you believe that we are not respecting your rights, you may lodge a complaint with the data protection authority in your country of residence (in France: the CNIL, https://www.cnil.fr).
12. Minors
The swap-iit platform is open to anyone aged 15 and over, subject to parental consent for minors.
If you’re under 15, you can’t create an account.
If you are aged between 15 and 17, by registering you confirm that you have the permission of your parents or legal guardians. Upon request, we may need to verify this permission.
The legal representatives of a registered minor may contact us at hello@swap-iit.com to exercise GDPR rights on behalf of the child.
13. Changes to this policy
We may need to amend this privacy policy, for example when a new feature processes new types of data.
You will be notified of any substantial changes by email at least 15 days before they come into effect. You may then, if you wish, withdraw your consent.
The date of the last update is always shown at the top of this page.
14. Contact and enquiries
If you have any questions regarding this privacy policy or your personal data:
Email: hello@swap-iit.com
Postal address:
LEAN GRUP SLU, Data
Protection, 3 Avinguda de la Bartra, AD200 Encamp
, Andorra
Regulatory authority:
In France: Commission Nationale de l’Informatique et des Libertés (CNIL)
https://www.cnil.fr