Skip to content

Privacy Policy

UK GDPR & Data Protection Act 2018 Compliant

Version 1.0 | Effective: January 2026

📋1. Data Controller

The data controller responsible for processing your personal data under the UK GDPR and Data Protection Act 2018 is:

DDreamLab Ltd.

Company No. 517275236 (Israel)

Managing Director: Denis Kros

Address: Zangwill 15, 4229715 Netanya, Israel

Phone: +972-52-748-1659

UK Domain: swingroad.co.uk

Data Protection Enquiries: privacy@swingroad.co.uk

⚖️2. Data Protection Principles

We process personal data in accordance with the following principles (Article 5 UK GDPR):

  • ✓Lawfulness, fairness and transparency
  • ✓Purpose limitation - collected for specified, explicit and legitimate purposes
  • ✓Data minimisation - adequate, relevant and limited to what is necessary
  • ✓Accuracy - accurate and kept up to date
  • ✓Storage limitation - kept no longer than necessary
  • ✓Integrity and confidentiality - appropriate security measures

📜3. Legal Basis for Processing

We process personal data only on one of the following legal bases:

Article 6(1)(a) UK GDPR - Consent

You have given consent to the processing.

Article 6(1)(b) UK GDPR - Contract

Processing is necessary for the performance of a contract.

Article 6(1)(c) UK GDPR - Legal Obligation

Processing is necessary for compliance with a legal obligation.

Article 6(1)(f) UK GDPR - Legitimate Interests

Processing is necessary for our legitimate interests.

📊4. Categories of Personal Data

4.1 Account Data (upon registration)

  • •Name or pseudonym (username)
  • •Email address
  • •Date of birth / age
  • •Gender and gender identity
  • •Location (city/region)
  • •Profile photos (optional)
  • •Profile description and interests

Legal basis: Article 6(1)(b) UK GDPR (Contract)

4.2 Special Category Data (Article 9 UK GDPR)

Due to the nature of our platform, the following sensitive data may be processed:

  • •Data concerning sex life or sexual orientation
  • •Relationship status and type
  • •Intimate preferences

⚠️ This data is processed only with your explicit consent (Article 9(2)(a) UK GDPR). Providing this information is voluntary. You may withdraw your consent at any time with effect for the future.

4.3 Usage Data (automatically collected)

  • •IP address (anonymised after 7 days)
  • •Browser type and version
  • •Operating system
  • •Date and time of access
  • •Referrer URL
  • •Pages and features accessed

Legal basis: Article 6(1)(f) UK GDPR (Legitimate interest in security and optimisation)

4.4 Communication Data

  • •Messages sent through the platform
  • •Support enquiries
  • •Reports about other users

Legal basis: Article 6(1)(b) UK GDPR (Contract)

4.5 Payment Data

  • •Transaction data (amount, date, product)
  • •Payment method (no card details stored)

Legal basis: Article 6(1)(b) UK GDPR (Contract), Article 6(1)(c) UK GDPR (Legal obligation - tax records)

4.6 Push Notifications

If you allow it, we send push notifications to your device – in your browser or in the SwingRoad app you added to your home screen from our website – when something happens in your account: a new message, a like or Super Like, a new match, a request for or access to private photos, or an invitation to a secret chat. We send them only after you have agreed in your browser or app, and you can switch them off at any time in your SwingRoad account settings or in the settings of your browser or device.

To protect your privacy, a notification shows only the type of event (for example “New message”) – the other member’s nickname only if you switch on “Show names in notifications” in your settings – and never the content of your messages or any photos.

To deliver notifications we store the push subscription of your device (a technical address and keys created by your browser or operating system) together with your account, along with the notification language, the device type (iOS, Android or computer) and the website on which you switched notifications on. We do not pass your e-mail address, name or messages to the push service. Notifications are delivered through the push service of your browser or operating system (for example Google, Apple, Mozilla or Microsoft). The subscription is deactivated when you switch notifications off. When you log out on that device, it is also deactivated, and it is reactivated when you log in to the same account on that device again. It is deleted when you delete your account.

Legal basis: your consent (Article 6(1)(a) UK GDPR). You can withdraw it at any time with effect for the future.

4.7 Where You Signed Up From

When you create an account we store on which of our websites you registered (for example swingroad.de) and, if you reached us through an advertisement or a partner link, the campaign tag contained in that link (such as the source and name of the campaign). We also store from which website you came to us (only its domain, for example google.com, not the full address), the page of our website on which you arrived and whether you registered in our app.

We use this only to understand which channels bring new members and to plan our advertising. We do not record which other pages you visited before registering and we do not track you on other websites.

We take this information from the address of the page on which you register. Only if you have accepted analytics cookies in our cookie banner does your browser remember where you came from, from your first visit until you register (for up to 30 days); without that consent we store nothing on your device for this purpose before you register. The information is stored with your account and deleted when you delete your account.

Legal basis: our legitimate interest in measuring the effectiveness of our advertising (Article 6(1)(f) UK GDPR); for keeping this information in your browser before you register, your consent (regulation 6 PECR). You may object at any time at privacy@swingroad.co.uk; we will then remove this information from your account.

4.8 Age Verification for 18+ Content

Members in the United Kingdom can also share content for adults in their private photos. To make sure such content comes only from adults, every new photo uploaded by these members is checked automatically for explicit adult content. For this check we use Google's Cloud Vision service (SafeSearch) as our processor, via an endpoint in the EU. Google processes the images in memory only, does not store them permanently and does not use them to train its own models. We only store the result of the check with the photo.

If a photo is classified as explicit, we hide it until you have confirmed your age once. Photos without explicit content are not affected. The classification is automatic. If you believe a photo has been classified incorrectly, write to us at support@swingroad.co.uk and we will review it personally.

The age check is carried out on our behalf by our processor Didit Identity Spain, S.L. (Spain, EU). You photograph your identity document (or read its chip) and take a live selfie; Didit compares the selfie with the photo in the document and determines your age from the document. We only store the result: whether your age was confirmed, the date, the provider and the method. We do not store photos of your identity document, selfies or the data from your document. Didit deletes the check data after one month.

Before members in the United Kingdom view other members' 18+ content, they complete a one-time age check, as required by the Online Safety Act 2023. Didit estimates your age from a live selfie (facial age estimation with a liveness check). If the estimate is below 25, you are also asked to photograph an identity document, and Didit compares its photo with your selfie. We only store the result: whether your age was confirmed, the date, the provider and the method (age estimation or document). We do not store your selfie, photos of your document or the data from it.

We carry out this check to comply with our legal obligations under the Online Safety Act 2023 (UK GDPR Article 6(1)(c)). Facial age estimation is not used to identify you. Where an identity document is compared with your selfie, biometric data is processed to confirm that the document is yours; we do this only with your explicit consent (Article 9(2)(a)), which you give before the check starts. Didit deletes the check data after one month.

Because the face comparison involves biometric data, the age check only takes place with your explicit consent (Article 9(2)(a) UK GDPR), which you give separately before the check starts. We base the automatic check of photos on our legitimate interest in protecting children and keeping our platform safe (Article 6(1)(f) UK GDPR). Where photos allow conclusions about your sex life, your consent under section 4.2 applies. The age check is voluntary; without it you can keep using SwingRoad, but you cannot publish 18+ content. You can withdraw your consent at any time; your 18+ content will then be hidden again.

After a successful check, the badge "verified" appears on your profile.

4.9 Use of the app

When you install the SwingRoad app from our website (browsers on Android and computers report this) or open it from the icon on your home screen, our website records an anonymous event: the type of event (install or opening), which of our websites it happened on, and the day. We do not attach your account, IP address or any device identifier to this event, and nothing is stored on your device for this count.

If you are logged in, we also store with your account the date you first and most recently opened the app from the icon (updated at most once a day) and the website. We use this only to know how many members use the app and what to develop next; it is deleted together with your account.

On swingroad.co.uk we do this only if you have accepted analytics cookies in our cookie banner, because the website reads from your browser whether it is running as an installed app. Legal basis: your consent (Article 6(1)(a) UK GDPR and regulation 6 PECR). You can withdraw it at any time in the cookie settings.

4.10 Automatic check of photos

Every new photo you upload to the public part of SwingRoad – your profile photo, public gallery, feed and search – is checked automatically before other members can see it, to make sure it does not show nudity or sexually explicit content. For this check we use Google's Cloud Vision service (SafeSearch) via an endpoint in the EU. Google processes the images in memory only, does not store them permanently and does not use them to train its own models. We only store the result of the check with the photo.

Until the check is finished (usually a few seconds), only you can see the photo. A photo classified as explicit is not shown in the public part: we offer to keep it in your private photos – visible only to members you give access to, and in the United Kingdom only after you have completed the age check described in 4.8 – or to publish a strongly blurred copy on the website, which is checked again. We may apply the same check to photos that are already public. The classification is automatic; if you believe a photo has been classified incorrectly, write to us at support@swingroad.co.uk and we will review it personally.

We base this check on our legitimate interest in protecting children, keeping the public part of our platform free of explicit content and meeting our duties under the Online Safety Act 2023 (Article 6(1)(f) UK GDPR). Where photos allow conclusions about your sex life, your consent under section 4.2 applies.

🤝5. Data Recipients

🔒 We do not sell your personal data to third parties.

Data may be shared with the following recipients:

5.1 Other Users

Profile information according to your privacy settings.

5.2 Data Processors

  • • Google Firebase/Cloud (USA): Hosting, database, authentication
  • • Payment processors: Payment processing
  • • Email service providers: Sending emails
  • • Google Cloud Vision (SafeSearch), EU endpoint: automatic check of new photos for explicit content (see 4.8 and 4.10)
  • • Didit Identity Spain, S.L. (Spain, EU): age verification for 18+ content (see 4.8)

All processors have signed data processing agreements in compliance with UK GDPR.

5.3 Authorities

When required by law (e.g., court orders, law enforcement).

5.4 Browser Push Services

If you have switched on push notifications, they are delivered by the push service of your browser or operating system (for example Google, Apple, Mozilla or Microsoft). The service receives the technical address of your subscription and the notification encrypted for your device – not your e-mail address, name or messages (see 4.6).

🌍6. International Data Transfers

Some of our service providers are located outside the UK. Data transfers are protected by:

USA (Google Firebase)

  • • UK-US Data Bridge (adequacy regulations)
  • • International Data Transfer Agreement (IDTA)
  • • Additional technical and organisational measures

Israel (Company headquarters)

UK adequacy regulations - Israel provides an adequate level of data protection.

⏰7. Data Retention

We retain personal data only as long as necessary for the relevant purposes:

  • •Account data: While your account is active
  • •After account deletion: Deleted within 30 days (except legal retention requirements)
  • •Billing data: 6 years (UK tax requirements)
  • •Server logs: Maximum 90 days
  • •Backups: Maximum 30 days after deletion

⚖️8. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

📖 Right of Access (Article 15)

You can request information about your stored data, including a copy.

✏️ Right to Rectification (Article 16)

You can request correction of inaccurate or completion of incomplete data.

🗑️ Right to Erasure / "Right to be Forgotten" (Article 17)

You can request deletion of your data when there is no reason for continued storage.

⏸️ Right to Restriction (Article 18)

You can request restriction of processing in certain circumstances.

📦 Right to Data Portability (Article 20)

You can receive your data in a structured, commonly used format.

🚫 Right to Object (Article 21)

You can object to processing, particularly for direct marketing.

↩️ Right to Withdraw Consent (Article 7(3))

You can withdraw consent at any time with effect for the future.

📧 Exercising Your Rights

To exercise your rights, contact us at: privacy@swingroad.co.uk
We will respond to your request without undue delay and within one month (Article 12(3) UK GDPR).

🏛️9. Right to Complain

You have the right to lodge a complaint with a supervisory authority if you believe your data has been processed unlawfully (Article 77 UK GDPR).

UK Supervisory Authority:

Information Commissioner's Office (ICO)

Wycliffe House, Water Lane

Wilmslow, Cheshire SK9 5AF

Phone: 0303 123 1113

Website: ico.org.uk

🍪10. Cookies

We use cookies and similar technologies. For detailed information, please see our Cookie Policy.

You can manage your cookie preferences through our cookie consent banner or your browser settings.

🔐11. Data Security

We implement appropriate technical and organisational measures to protect your data:

  • ✓TLS encryption for all traffic between you and the site
  • ✓Data is stored with Google Cloud (Firebase), which encrypts it at rest on its own servers
  • ✓We never store your password: sign-in is handled by Firebase Authentication, which keeps only a hash of it
  • ✓Who may read and write what is set by database access rules, covered by automated tests that run before every change
  • ✓Private photos are opened by you, one person at a time, and can be closed again at any moment
  • ✓Administrative access only from verified administrator accounts

📝12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a notice on our website. The date of the last update is shown at the top of this policy.

📄Related Documents

Last Updated: October 2026

© 2025-2026 DDreamLab Ltd. All rights reserved.

🚀 Beta Version
✨ Everything Free!