This Privacy Policy explains how TipTap LTD (“we”, “HouseSwapp”) processes your personal data when you use our home-exchange platform.
1. Who we are
Data controller: TipTap LTD, Cyprus. Contact: privacy@houseswapp.com · Contact form.
2. Data we collect
Account: name, email, phone, city, profile fields, login method (email PIN, Google where enabled). Listings & swaps: photos, descriptions, availability, swap requests, messages. Insurance checkout: quote inputs, plan selection, checkout references (payment card data is handled by payment processors, not stored by us). Technical: IP address, device/browser, cookies, logs. Support: enquiries you send us.
3. Identity verification data
At industry-standard timing (before you accept a swap or buy insurance for one — not at signup), we may collect government ID images and a selfie that you upload in the dashboard, plus your declared document type. This data is used to confirm your identity, match your ID to your profile name, and reduce fraud.
How we process uploads: Files are stored in private, access-controlled storage only for the review window. We run automated checks, which may include AI-assisted document analysis (e.g. via OpenAI’s API when configured) to extract visible name fields and assess whether the document appears valid. OpenAI acts as a processor for that analysis; we do not authorise it to use your data for model training. Administrators may manually review submissions that need a second look.
What we keep: After review, image files are deleted (typically once approved, rejected, or after a short retention for dispute handling). We retain verification status, submission timestamp, AI or admin decision summary, confidence score, flags and an internal reference — not long-term copies of your passport or ID scans.
Legal basis: Legitimate interests (trust and safety, fraud prevention) and, where applicable, contract (enabling confirmed swaps and insurance). You may contact privacy@houseswapp.com about verification data.
4. Why we use your data
To provide matching, maps, messaging and swap workflows; verify identity at booking (industry-standard timing); process optional insurance; prevent abuse and fraud; comply with law; improve the product with aggregated analytics.
5. Legal bases (GDPR)
Contract — operating your account and swaps you request. Legitimate interests — security, fraud prevention, service improvement (balanced against your rights). Consent — where required (e.g. non-essential cookies, marketing if offered). Legal obligation — tax, insurance, law-enforcement requests, retention duties.
6. Sharing and processors
Other members see profile and listing fields needed for swaps. We share data with third-party processors only to the extent necessary to operate the service. We do not sell your personal data.
Current processors:
- Cloudflare (Cloudflare Inc., USA) — cloud storage (R2) for listing photos, profile images and identity verification documents. Data encrypted at rest.
- Brevo (Sendinblue SAS, France) — transactional email delivery: login codes, swap confirmations, chat notifications.
- Mapbox (Mapbox Inc., USA) — interactive maps, geocoding and location search.
- OpenAI (OpenAI LLC, USA) — automated identity and address document review. OpenAI acts as a data processor; we do not authorise it to use your data for model training.
- Google (Google LLC, USA) — sign-in via OAuth (when you choose "Continue with Google") and web-font delivery (Google Fonts). Google may receive your IP address when fonts load.
- YouTube (Google LLC, USA) — embedded listing videos via privacy-enhanced mode (youtube-nocookie.com). YouTube may set cookies when you play a video.
- jsDelivr (Prospect One, Poland) — content-delivery network for open-source JavaScript libraries used on the site.
Payment and insurance processors will be named here when activated. Transfers outside the EU/EEA use appropriate safeguards (Standard Contractual Clauses or adequacy decisions).
7. Retention
Active account data while you use the service. Identity document images are deleted after verification review (see section 3). After account deletion we remove profile, listings and messages; verification status and decision metadata may be kept in minimal form for fraud prevention; insurance and financial records as required by law (often 5–7 years). Server logs rotate on a short schedule unless needed for incident investigation.
8. Your rights
Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent where processing is consent-based. EU/EEA users may complain to their supervisory authority. Contact privacy@houseswapp.com — we respond within one month where GDPR applies.
9. Delete your account (App Store / Google Play)
In-app or on the web: Dashboard → Delete my data, or Delete your account with email verification — no login required.
10. Children
Not directed at under-18s. Contact us to remove data about a minor.
11. Security
We use HTTPS, access controls and vendor security for sensitive checks. No method is 100% secure — report suspected breaches to privacy@houseswapp.com.
12. Changes
We may update this policy; the current version is always on this page. Last updated July 2026.