Data Subject Rights (GDPR)

Updated: August 2, 2026

This document sets out the rights that Regulation (EU) 2016/679 (GDPR) grants to data subjects and explains how those rights are exercised at Swaplse. It supplements the Privacy Policy, which lists the data itself, the purposes of processing and the recipients; this page covers only your rights and how to use them. Where the two differ on rights, this document applies.

If you are located outside the European Economic Area, you may still submit the same request: the procedure and the deadlines are identical.

1. Who is responsible for processing

Personal data is processed by the Swaplse service (swaplse.com). It determines the purposes and means of processing and therefore acts as the data controller under the GDPR.

The only address for data-related requests is support@swaplse.com. The service does not operate separate mailboxes for privacy matters. The support form on the site is also available.

Some operations are carried out by engaged processors: the email provider (delivery of service messages), the hosting provider, a third-party GPU compute provider (generations physically run there) and a web analytics service. Their scope and purpose are described in the Privacy Policy.

2. Right of access (Article 15)

You may obtain confirmation as to whether your data is processed and, if it is, a copy of that data together with information about the processing.

• categories of data processed: email address, login, registration date, uploaded photos and videos, generated results, prompt texts, conversations with the AI character, amounts, statuses and hashes of crypto invoices, IP address and basic request data, support enquiries;
• the purposes for which the data is processed;
• the categories of recipients to whom data is disclosed;
• the retention period or the criteria used to determine it;
• information about the rights to rectification, erasure, restriction and objection;
• information about the right to lodge a complaint with a supervisory authority;
• the source of the data where it was not collected from you;
• information about the use of automated decision-making (section 8).

The copy is sent electronically to the email address linked to the account. The password hash is not disclosed: the password is not stored in readable form and the hash carries no information about you.

3. Right to rectification (Article 16)

If data about you is inaccurate or incomplete, you may request that it be corrected or completed. In practice this concerns information you supplied yourself: the email address, the login, details given in support enquiries.

Where the field can be edited in your account settings, simply change it yourself - no separate request is needed. Otherwise write to support and state which value is wrong and what it should be.

Prompt texts, chat conversations and payment records are not subject to rectification: they are factual records of actions that took place, not statements about your identity.

4. Right to erasure (Article 17)

You may request erasure of your data, in particular where it is no longer needed for the purposes it was collected for; where consent has been withdrawn and no other legal basis applies; where you objected to the processing and the service has no overriding legitimate grounds to continue; or where the processing was unlawful.

An account is deleted by you in the settings, section "Account", or by writing to support. Deleting an account removes the account itself, the works in your collection and the remaining coin balance. Intermediate generation files are deleted automatically once the technical retention period expires.

The right to erasure is not absolute. Some records are retained where this is necessary to comply with legal obligations - payment records are kept for as long as applicable accounting and tax law requires. Records are also retained where they are needed for the establishment, exercise or defence of legal claims, including records of rule violations and of the moderation measures applied. Such data is not used for any other purpose.

5. Right to restriction of processing (Article 18)

Restriction means the data continues to be stored while other operations on it are suspended. You may request restriction in the following cases:

• you contest the accuracy of the data - for the period needed to verify it;
• the processing is unlawful but you prefer restriction to erasure;
• the service no longer needs the data, but you need it for the establishment, exercise or defence of legal claims;
• you have objected under Article 21 - pending verification of whether the legitimate grounds of the service override your interests.

You will be informed before a restriction is lifted. Restriction may make the service unusable: without processing account data, sign-in and generation do not work.

6. Right to data portability (Article 20)

You may receive the data you provided to the service in a structured, commonly used and machine-readable format and transmit it to another controller. The right applies to processing that is automated and based on your consent or on a contract.

The export covers account data, prompt texts, conversations with the AI character and the files you uploaded; files are provided in their original formats. Direct transmission to another controller is possible where it is technically feasible.

7. Right to object (Article 21)

You may object to processing carried out on the basis of the legitimate interests of the service. This includes, among other things, keeping the platform secure and preventing abuse, as well as collecting anonymised visit statistics.

On receiving an objection the service stops the processing unless it demonstrates compelling legitimate grounds that override your interests and rights, or that the processing is required for the establishment, exercise or defence of legal claims.

An objection to processing for direct marketing is honoured unconditionally and without any assessment of grounds. The service uses no advertising or retargeting trackers.

8. Automated decisions and profiling (Article 22)

Uploads and publications are checked by automated moderation systems. As a result of such a check, material may be rejected or taken down, and repeated violations may lead to restriction of account access. Automated checks are combined with manual review, and decisions to block an account involve a human.

You have the right to obtain human review of a decision, to express your point of view and to contest the decision. In practice this is the appeal against a takedown or a block: send a counter-notice to support@swaplse.com from your account email, naming the work and the reason you disagree. The material stays down until the dispute is resolved. Substantiated complaints are handled within 72 hours.

The right to review does not apply to material involving minors: such content is deleted immediately and reported to the competent authorities. The list of prohibited material is given in the Acceptable Use Policy.

9. Withdrawal of consent (Article 7)

Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before it and does not remove legal bases other than consent.

Consent to analytics cookies is withdrawn through your browser; the cookies and browser storage used are described in the Cookie Policy. Withdrawing consent to the processing of account data amounts to a request to delete the account: without that data the service cannot be provided.

10. Right to lodge a complaint with a supervisory authority (Article 77)

You may lodge a complaint with a data protection supervisory authority, as a rule in the country of your habitual residence, place of work or place of the alleged infringement. Contacting a supervisory authority does not deprive you of a judicial remedy.

We ask you to write to support first: most matters are resolved directly and faster.

11. How to submit a request

Send your request to support@swaplse.com from the email address linked to your account. Set a subject line that reflects the matter, for example "Privacy" or "Account deletion".

Identity verification. A request is accepted from the account email address: that is the primary means of confirmation. If the message comes from a different address, or there are reasonable doubts about the identity of the applicant, the service may ask for additional confirmation and withhold action until it is provided. Additional documents are requested only to the extent necessary for verification and are not kept beyond the handling of the request.

12. Response times

A reply is provided within one month of receiving the request. If the request is complex, or if you have submitted several requests, the period may be extended by a further two months.

You will be notified of the extension and of the reasons for it within the first month. If a request is not acted upon, the reply states the reason for the refusal and explains the right to lodge a complaint with a supervisory authority and the right to a judicial remedy.

13. Fees

Requests are handled free of charge.

Where a request is manifestly unfounded or repetitive, the service may either charge a reasonable fee covering the administrative costs of handling it, or refuse to act on it. In both cases the reason for that decision is stated in the reply, and the burden of demonstrating that a request is manifestly unfounded or repetitive rests with the service.