Sway One privacy policy
Last updated: 20 October 2026
Version françaiseArticle 1: Preamble
Sway One is published by Sway, a French simplified joint-stock company (SASU) with a share capital of EUR 1,000, registered with the Bourg-en-Bresse Trade and Companies Register under number 978 848 414, whose registered office is at 785 rue de la Goutteronne, 01480 Jassans-Riottier, France.
This policy explains which personal data Sway processes through the Sway One application (app.swone.fr), the Sway One app installed from the Shopify App Store and the Sway One API, why we process it, how long we keep it and how you can exercise your rights. It applies to merchants who use Sway One, to the members of their team and, where relevant, to the customers of their stores.
It is written to comply with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and the French Data Protection Act of 6 January 1978 as amended.
Article 2: Principles
In line with Article 5 of the GDPR, Sway processes personal data:
- lawfully, fairly and transparently;
- only for specified, explicit and legitimate purposes;
- only as far as needed for those purposes (data minimisation): Sway One never asks for more than it uses;
- keeping it accurate and up to date;
- for no longer than needed, with the retention periods set out in Article 3.4;
- with appropriate security, confidentiality and integrity;
- while being able to demonstrate compliance with these principles.
Each processing relies on one of the lawful bases of Article 6 of the GDPR: the performance of the contract between you and Sway, a legal obligation (for example accounting rules), Sway's legitimate interest in keeping the service secure and working, or your consent where it is required.
Article 3: Data collected
3.1 Data collected and purposes
Data read from your Shopify store. When you connect your store, Sway One reads through the Shopify API:
- your products, variants, SKUs, prices, compare-at prices, tags and collections;
- your locations, available quantities per location and the unit cost of your items;
- your order and refund line items: product, variant, SKU, quantity, unit price, dates and order ID;
- your live or scheduled automatic discounts and the fixed prices of your Markets catalogs.
Sway One never reads your customers' name, email, phone or address, and does not request access to your customer records (no read_customers scope). The order ID is only used to group items bought together; it is never used to identify or contact a buyer.
When you approve a recommendation, Sway One writes to your store exactly what you saw in the preview (price, compare-at price, automatic discount, tag, collection order, available quantity), then restores the original values when the action ends.
Data you provide:
- your account and your team's accounts: name, email, role;
- your company: legal name, address, VAT number;
- your payment method, entered at Stripe and never stored by Sway;
- what you enter in the app: suppliers, lead times, product categories, settings.
Data about your store's customers. Sway One collects nothing directly from your customers: no script or cookie on your storefront, no email, no tracking. Only the order ID described above is kept with each sales line.
Purposes and lawful bases:
- providing the service: computing your recommendations, inventory and sales indicators, applying the actions you approve and measuring their result (performance of the contract);
- billing the subscription (performance of the contract and accounting obligations);
- keeping the service secure and fixing errors (legitimate interest).
We do not sell any data, run no targeted advertising and do not use your data to train third-party AI models. Recommendations are about products, never about people: Sway One makes no automated decision with legal or similarly significant effects on a person.
The swone.fr website (contact form, newsletter, audience measurement and cookies) has its own rules, described in its legal notice. Read the legal notice (in French)
3.2 How data is collected
Store data is read through the official API of each tool you connect (Shopify and, if you choose to, other sales or inventory tools), only after you authorize the connection and only within the access scopes you grant. Account and company data is entered by you or your team when signing up, inviting a member or subscribing.
3.3 Hosting and subprocessors
The Sway One application, its API and its database are hosted by Hostinger International Ltd. in a data center located in France. Sway relies on the following subprocessors:
| Subprocessor | Purpose | Location |
|---|---|---|
| Hostinger International Ltd. | Hosting of the app, API and database | France |
| Cloudflare, Inc. | Delivery of the website and interface | United States, global network |
| Clerk, Inc. | Sign-in and user accounts | United States |
| Stripe Payments Europe Ltd. | Payments and invoices | Ireland, United States |
| Mistral AI | Writing explanations and the assistant, from product and sales data | France, European Union |
| Functional Software, Inc. (Sentry) | Technical error monitoring | European Union (Germany) |
When a subprocessor processes data outside the European Union, the transfer relies on the EU-US Data Privacy Framework where the subprocessor is certified, and otherwise on the European Commission's standard contractual clauses.
3.4 Retention
- Store data: kept while your account and the connection exist, then erased within 30 days after you uninstall the app (Shopify shop/redact request) or close your account.
- Order IDs: erased within 30 days after a customer deletion request forwarded by Shopify.
- User accounts: deleted within 30 days after the account is closed.
- Invoices: 10 years, as required by French accounting law.
- Technical logs: 30 days.
- Backups: made every night, encrypted, kept 30 days.
3.5 Security
All traffic uses HTTPS (TLS). Access tokens to your store are encrypted with AES-256-GCM and never sent back to the browser. Production access is restricted to the Sway team.
Article 4: Data controller
The data controller is Sway, SASU with a share capital of EUR 1,000, Bourg-en-Bresse Trade and Companies Register 978 848 414, VAT number FR40978848414, 785 rue de la Goutteronne, 01480 Jassans-Riottier, France, represented by its president, Louise Pieri.
Sway is the controller for Sway One accounts and billing. For your store data (catalog, inventory, sales and order IDs), you remain the controller and Sway acts as your processor within the meaning of Article 28 of the GDPR, on your instructions only.
Article 5: Your rights
Under the GDPR, you have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to data portability and to withdraw your consent at any time when a processing relies on it. You can also give instructions on what happens to your data after your death.
To exercise these rights, write to us. We answer within one month. contact@swayagency.fr
When one of your customers exercises their rights with you, Shopify forwards the request to us (customers/data_request and customers/redact): within 30 days we send you the sales lines linked to their orders, or erase them.
Before uninstalling the app, cancel the actions in progress from Applied actions: once the app is uninstalled, Sway One no longer has access to your store and cannot restore your original prices. Store data is erased within 30 days after the shop/redact request Shopify sends 48 hours after uninstalling.
If you believe your rights are not respected, you can lodge a complaint with the French data protection authority (CNIL, 3 place de Fontenoy, 75007 Paris, cnil.fr).
Article 6: Changes to this policy
Sway may update this policy, in particular when a subprocessor or a feature changes. The date of the last update is shown at the top of this page. If a change significantly affects how your data is processed, we let you know by email or in the app at least 30 days before it applies.
For any question about this policy: Sway, 785 rue de la Goutteronne, 01480 Jassans-Riottier, France. contact@swayagency.fr