Privacy Policy for SwiftReply AI
Last updated: October 21, 2026
1. Who we are
This Privacy Policy explains how Alisa Solomina, a sole trader (empresária em nome individual) based in Figueira da Foz, Portugal ("we", "us", "our") handles data when you use the SwiftReply AI Chrome extension and related web services (the "Service").
- For account and payment data, we act as the data controller under the EU General Data Protection Regulation (GDPR).
- For the text of buyer messages you process with the Service, we act as a data processor: we process that text on your behalf, at your request, solely to generate suggested replies. You, the seller, remain the controller of your buyers' data.
Questions about this policy: support@swift-reply.com.
2. Information we collect
We collect only the data needed to run the Service.
| Category | What exactly | Source |
|---|---|---|
| Account data | Email address, user ID, email-verification status | You, at sign-up (via Supabase) |
| Session data | Authentication tokens that keep you signed in | Created when you sign in |
| Plan and usage data | Plan, remaining credits, number of generations used; for each generation: time, marketplace, languages, message length, whether notes were added, AI model, token counts, response time, errors, and whether you copied or restored the reply. Never the message text | Updated by the Service as you use it |
| Payment data | Stripe customer ID, subscription ID and status. We never see or store your full card number — Stripe processes it | Stripe, when you pay |
| Message content | Buyer message text you select, your optional notes or instructions, and the generated replies | The extension, only when you click to generate |
| Feedback | Your rating (1–5), optional comment, email | You, when you leave feedback |
| Launch notification list | Email address | You, when you ask on our website to be notified about the launch |
| Service logs | IP address, request timestamps, error codes | Automatically, by our hosting provider (Cloudflare) |
The extension does not read your browsing history, does not monitor your activity, and uses no analytics or advertising trackers. It reads only the text you select on the current page, and only when you start a generation. By default it can do so only on Amazon, Etsy and eBay; on other websites it works only after you grant access in Chrome, which you can revoke at any time in Chrome's extension settings.
Stored on your device only. The extension keeps these items in your browser's local extension storage, not on our servers: your sign-in session, your settings (signature, languages), and your last 10 generated replies with their translation and strategy notes, so you can recover a reply you overwrote. You can clear them by signing out or by removing the extension.
3. Why we process data and our legal basis
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Creating your account and signing in | Email, session tokens | Performance of a contract, Art. 6(1)(b) |
| Generating replies | Message content | Performance of a contract, Art. 6(1)(b) |
| Payments and subscriptions | Stripe customer ID, email | Performance of a contract, Art. 6(1)(b); tax and accounting obligations, Art. 6(1)(c) |
| Security, abuse prevention, and improving the Service (usage statistics, reply quality, costs) | Service logs, usage data | Legitimate interests, Art. 6(1)(f) |
| Sending you one email when the extension launches | Email address | Consent, Art. 6(1)(a) |
| Service emails (receipts, security alerts, policy changes) | Performance of a contract, Art. 6(1)(b) |
We send marketing emails only with your opt-in consent, Art. 6(1)(a). You can withdraw consent at any time using the unsubscribe link in any email.
4. Use of artificial intelligence (OpenAI)
Message text you send through the extension is processed by the OpenAI API solely to generate suggested replies.
- No background collection. Text is sent only when you click to generate a reply: the buyer message you selected, plus any notes or instructions you add.
- No model training. Your messages and generated replies are not used to train OpenAI's models or any other AI models.
- No storage on our servers. We do not store message text or generated replies on our servers after the reply is returned to your browser. Your last 10 replies are kept locally in your browser (see section 2); the buyer's original message is not kept.
- OpenAI retention. OpenAI may retain API data for up to 30 days solely to monitor for abuse, then deletes it.
- No sale. We never sell message content or share it for advertising or analytics.
AI-generated replies can contain errors; please review them before sending. Do not submit sensitive data — health information, ID or passport numbers, payment card details, passwords — to the Service.
5. Service providers and international transfers
We share data only with these providers, and only as much as each needs to do its job.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| OpenAI | AI text processing and reply generation | Message content, your notes | USA |
| Supabase | Authentication and account storage | Email, user ID, session tokens, plan and usage data, Stripe IDs, feedback | USA (us-east-1) |
| Stripe | Payments and subscriptions | Email, payment details (entered directly into Stripe) | USA / EU |
| Cloudflare | Hosting of our website and backend, DNS, bot protection (Turnstile) on sign-up, sign-in and password reset | All requests pass through it; service logs; IP address, browser and device signals for bot protection | Global network (USA-based company) |
| Resend | Sending account emails (email confirmation) | Email address | USA |
| GitHub Pages | Hosts the captcha page shown inside the extension | IP address (server logs) | USA |
International transfers. Your data may be transferred to and processed in the United States. We rely on the EU–US Data Privacy Framework (for certified providers) and on the European Commission's Standard Contractual Clauses included in our Data Processing Agreements with each provider.
We may also disclose data when required by law, or to a buyer of our business, in which case we will notify you first.
6. Data retention and security
| Data | How long we keep it |
|---|---|
| Account, plan and usage data (including per-generation usage records) | While your account is active; deleted within 30 days of a deletion request |
| Session tokens | Until you sign out or they expire |
| Message content | Not stored on our servers |
| Last 10 replies (on your device) | Until replaced by newer replies, or until you sign out or remove the extension |
| Feedback | Until your account is deleted |
| Launch notification list | Until we have sent the launch email or you ask us to remove you, and no longer than 12 months |
| Service logs | Up to 30 days |
| Billing records | As long as Portuguese tax and accounting law requires (currently 10 years) |
All data in transit is encrypted with TLS (HTTPS). Access to account data in Supabase is restricted by Row Level Security. API keys for our providers are kept on our backend and never shipped inside the extension. If a personal data breach affects you, we will notify you and the competent supervisory authority as the law requires (under GDPR, within 72 hours).
7. Your rights and account deletion
You can ask us at any time to delete your account and all associated data; we complete deletion within 30 days.
How to delete your account:
- Email support@swift-reply.com from the address registered to your account, with the subject "Account Deletion Request".
- We confirm the request and cancel any active Stripe subscription.
- We delete your profile and sessions from Supabase. Billing records are kept only as long as tax law requires.
- We email you a confirmation once deletion is complete.
GDPR (EEA, UK): you have the right to access, correct, delete, restrict and port your data, to object to processing based on legitimate interests, to withdraw consent, and to lodge a complaint with your local data protection authority or with our lead authority, Portugal's Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt).
CCPA/CPRA (California): you have the right to know what personal information we collect and how we use it, to delete and correct it, and not to be discriminated against for exercising these rights. We do not sell or share personal information as defined under California law.
Send requests under any of these rights to support@swift-reply.com; we respond within 30 days. If you are a buyer who contacted a seller using SwiftReply AI, please contact that seller first — they control your conversation data, and we will help them fulfil your request.
8. Chrome Web Store Limited Use
The use of data collected by the SwiftReply AI extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements:
- Data is used only to provide and improve the extension's reply-generation feature.
- Data is never sold, transferred for advertising, used to determine creditworthiness, or passed to data brokers.
- People on our team do not read your messages, except with your explicit consent (for example, for a support request), for security investigations, or where required by law.
9. Other
Children. The Service is not intended for anyone under 16, and we do not knowingly collect their data.
Terms. Your use of the Service is also governed by our Terms of Service, which include our Refund Policy.
Changes to this policy. We will email you about material changes at least 14 days before they take effect. The "Last updated" date at the top shows the current version.
10. Contact
Alisa Solomina, sole trader (empresária em nome individual)Rua Cónego Tomás Póvoa 1, 2 Dto
3080-603 Figueira da Foz, Portugal
NIF (tax ID): 314836187
Email: support@swift-reply.com
Website: https://swift-reply.com