SWOP Holdings Inc. Privacy Policy

1. Introduction

SWOP Holdings Inc. ("SWOP," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use the SWOP platform and associated services (the "Platform").

By creating an account and using the Platform, you agree to the collection and use of your information in accordance with this Policy. If you do not agree, you must not use the Platform.

This Policy applies to users in all jurisdictions including the United States, the European Union, the United Kingdom, and the United Arab Emirates. Where applicable law requires specific protections — such as GDPR for EU/UK users or the UAE Personal Data Protection Law for UAE users — we comply with those requirements.

2. Information We Collect

2.1 Information You Provide Directly

2.2 Information Collected Automatically

2.3 Information from Third-Party Connections

When you connect third-party accounts to SWOP, we collect:

2.4 Network and Connection Data

As part of the Connection Value Graph (CVG), we collect and process:

• Your connections with other SWOP users (who you follow, who follows you, mutual connections)
• Trust scores derived from your interactions and completed transactions
• Network position data — your degree of separation from other nodes in the graph
• Relationship strength data — how your connections are weighted based on interaction type

Note: The CVG is a core transferable asset of SWOP Holdings Inc. In the event of a business transfer, acquisition, or investment, CVG data — including your network relationships and trust data — may transfer as part of that transaction. See Section 5.3.

2.5 Asset Image and Visual Data

When you upload images of assets to the Platform, those images may be processed by SWOP's AI systems including SWOPi for purposes including valuation, reference matching, condition assessment, and platform improvement. By uploading images you consent to this AI processing of your visual content.

3. How We Use Your Information

3.1 To Provide and Operate the Platform

• Creating and managing your account
• Processing subscription payments via Stripe
• Facilitating asset transactions and escrow via Escrow.com
• Cross-listing your inventory across connected platforms
• Operating the Connection Value Graph and trust traversal
• Delivering SWOPi AI broker services
• Logging and auditing autonomous SWOPi actions taken on your behalf
• Sending platform notifications and communications

3.2 Use of Data to Enhance the Platform and SWOPi

IMPORTANT: By creating an account and using the Platform, you expressly consent to SWOP using any and all data generated through your use of the Platform to train, develop, fine-tune, enhance, and improve SWOPi and the Platform's AI systems, features, and capabilities.

This includes but is not limited to:

• Negotiation behaviour, offer patterns, and deal outcomes
• Pricing data, accepted and rejected offers, and transaction velocity
• Asset listing data, descriptions, images, and reference information
• Network traversal paths and trust relationship patterns
• Search behaviour, feature usage, and session activity
• Communications sent through the Platform or via SWOPi on WhatsApp
• Authentication reports and dispute data submitted to the Platform
• Cross-platform listing performance and syndication data
• Valuation accuracy versus actual realised sale prices
• Dealer verification data and KYB materials in anonymised or aggregated form
• SWOPi autonomous action logs and outcomes
• Any other interaction data generated through your use of the Platform

This data may be used in identifiable, pseudonymised, or fully anonymised form. Once anonymised and incorporated into AI training datasets, this data cannot be deleted or reversed. SWOP retains AI training data indefinitely in anonymised or aggregated form.

Your continued use of the Platform constitutes ongoing consent to this use of your data. If you do not agree to your data being used for these purposes, you must not use the Platform.

3.3 To Build and Maintain the CVG

Your network data — who you connect with, your trust relationships, your transaction history — is used to build and update the Connection Value Graph. This graph is a core product feature that benefits all users by enabling network traversal and asset sourcing.

3.4 For Safety, Security, and Enforcement

• Detecting and preventing fraud, abuse, and policy violations
• Verifying user identity and business credentials
• Monitoring for suspicious activity and counterfeit listings
• Enforcing our Terms and Conditions including account bans
• Retaining records of banned users for enforcement and fraud prevention purposes

3.5 For Communications

• Sending service-related emails (receipts, notifications, account updates)
• Sending product updates and feature announcements
• Responding to support requests and dispute communications
• Sending marketing communications (where you have opted in)

3.6 For Legal Compliance

• Complying with applicable laws and regulations across all jurisdictions in which we operate
• Responding to legal requests, court orders, and regulatory inquiries
• Cooperating with law enforcement where required, including in cases involving counterfeit assets
• Protecting our legal rights

4. Legal Basis for Processing

4.1 EU and UK Users (GDPR / UK GDPR)

4.2 UAE Users (UAE PDPL)

For users in the United Arab Emirates, SWOP processes your personal data in accordance with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and its implementing regulations. Our processing of your data is based on:

• Your consent, obtained at the point of account registration
• The necessity of processing to perform the contract between you and SWOP
• Our legitimate interests in operating and improving the Platform
• Legal obligations applicable to SWOP under UAE law

UAE users have the right to access, correct, and request deletion of their personal data. To exercise these rights, contact contact@swop.com. We will respond within the timeframes required by applicable UAE law.

5. Sharing Your Information

5.1 With Other Users

Certain information is visible to other SWOP users by design:

• Your public profile (name, location, specialisation)
• Your active listings and inventory (as you choose to display)
• Your position in the Connection Value Graph (degree of connection to other nodes)
• Your trust score (aggregated, not raw data)

5.2 With Service Providers

All service providers are contractually bound to handle your data securely and only for specified purposes.

5.3 Business Transfers and the CVG as a Transferable Asset

If SWOP is involved in a merger, acquisition, fundraising, investment, or sale of assets, your personal data — including Connection Value Graph data, trust relationships, transaction history, and network data — may be reviewed by or transferred to the acquiring or investing party as part of that transaction. The CVG is a core business asset of SWOP Holdings Inc. and will be treated as such in any corporate transaction.

We will notify you via email or prominent notice on the Platform before your data is transferred and becomes subject to a different privacy policy.

5.4 Legal Requirements and Law Enforcement

We may disclose your information if required by law, regulation, legal process, or governmental request, or where necessary to protect the rights, property, or safety of SWOP, our users, or the public. In cases involving suspected counterfeit asset transactions, we may proactively share relevant data with law enforcement authorities.

5.5 What We Do Not Do

• Sell your personal data to third parties for their own marketing purposes
• Share your WhatsApp number with other users without your consent
• Share individual transaction details with third parties except as required for the transaction or by law

6. Data Retention

When data is no longer required, we delete or anonymise it securely. Note that data already incorporated into AI training models in anonymised or aggregated form cannot be individually deleted.

7. Data Security

We implement industry-standard security measures to protect your data including:

• Encryption of data in transit (TLS/SSL) and at rest
• Secure access controls and authentication
• Regular security assessments and penetration testing
• Limited employee access to personal data on a need-to-know basis
• Incident response procedures

No method of electronic transmission or storage is 100% secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security.

7.1 Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, SWOP will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach, where required by applicable law (including GDPR)
• Notify affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms
• Provide details of the nature of the breach, the data affected, and the steps we are taking to address it

8. Cookies

We use cookies and similar tracking technologies to operate and improve the Platform.

You can manage cookie preferences through your browser settings. Disabling essential cookies may affect Platform functionality.

8.1 SWOP Connector Browser Extension

The SWOP Connector is an optional browser extension (Chrome Web Store, with planned releases for Firefox and Safari) that streamlines connecting Facebook Marketplace and Chrono24 to your SWOP account.

What the Connector reads. When you install the Connector and pair it with your SWOP account, the extension reads session cookies set by your browser on the following domains:

The Connector reads only cookies on these specific domains. It does not read browsing history, page content, form input, or cookies on any other site.

Where cookies go. Captured cookies are sent encrypted in transit (HTTPS / TLS) to SWOP's backend at api-demo.swop.trade, encrypted again at rest using AES-256 (Fernet) before being stored in your marketplace_accounts row in the SWOP database. They are accessible only to the SWOP services that act on your behalf — primarily the listing-creation and message-sync workers.

When cookies are sent. The Connector sends cookies on the following occasions:

1. Immediately after you successfully pair the extension with SWOP (initial capture).
2. When the browser reports a cookie change on one of the watched domains — for example, when you sign in, sign out, or your session cookie is refreshed. Automatic syncs are throttled to at most one per platform per hour.
3. When you click "Sync now" inside the extension's popup.

What we don't do. The Connector does not read or transmit cookies for any domain not listed above. It does not inject scripts into pages you visit. It does not modify the pages you browse. It does not collect or store passwords. The captured session cookies are used exclusively to maintain your SWOP integrations — they are never sold, shared with advertisers, or shared with other SWOP users.

Your controls.

• Disconnect at any time from the Connector's popup. This forgets the SWOP session token stored locally in the extension. Captured cookies already stored on SWOP's servers can be cleared at the same time by opening Settings → Integrations → Disconnect on app.swop.trade.
• Revoke individual platforms without uninstalling the extension by using the platform's Disconnect button on app.swop.trade.
• Uninstall the extension through your browser's extension manager to immediately stop any further cookie reads.

Retention. Cookie payloads are retained for as long as your connection to the corresponding platform is active. When you disconnect a platform or delete your SWOP account, stored cookies for that platform are deleted within 30 days (subject to the retention windows in Section 6).

Why this needs an extension. Cookies set by Facebook, Messenger, and Chrono24 are scoped to those origins by design — the SWOP web app at app.swop.trade cannot read them directly. A browser extension is the only way to capture an authenticated session without requiring you to enter your platform passwords on a SWOP-controlled page. We chose this pattern specifically so that your platform passwords never touch SWOP.

9. Your Rights

9.1 All Users

Regardless of location, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data (subject to legal retention requirements)
• Opt out of marketing communications at any time
• Request information about how your data is used

9.2 AI Training Data — Important Limitation

You may object to the use of your data for AI training purposes by closing your account. However, data that has already been incorporated into AI training models in anonymised or aggregated form cannot be individually identified, extracted, or deleted. SWOP is not able to remove anonymised contributions to AI models once training has occurred. This limitation applies to all users regardless of jurisdiction.

9.3 EU and UK Users (GDPR / UK GDPR)

In addition to Section 9.1, you have the right to:

• Data portability — receive your data in a structured, machine-readable format
• Restriction of processing — request we limit how we use your data
• Object to processing — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent, withdraw it at any time (note the AI training limitation in Section 9.2)
• Lodge a complaint — with your local data protection authority (EU: your national DPA; UK: the ICO)

9.4 UAE Users (UAE PDPL)

UAE users have the right to access, correct, delete, and restrict the processing of their personal data under the UAE PDPL. To exercise these rights contact contact@swop.com. We will respond within the timeframes required by UAE law.

9.5 California Users (CCPA)

California residents have the right to:

• Know what personal information we collect and how it is used
• Request deletion of personal information
• Opt out of the sale of personal information (we do not sell personal information)
• Non-discrimination for exercising your privacy rights

To exercise any of these rights, contact us at: contact@swop.com. We will respond to verified requests within 30 days (or 45 days for complex requests).

10. International Data Transfers

SWOP is a US-incorporated company headquartered in Delaware. Your data may be processed in the United States and other countries where our service providers operate, including the UAE and EU member states.

• For EU and UK users: where we transfer personal data outside the UK or EEA, we ensure appropriate safeguards are in place including Standard Contractual Clauses (SCCs) or equivalent mechanisms as required by applicable law.
• For UAE users: where we transfer personal data outside the UAE, we ensure appropriate contractual protections are in place as required by the UAE PDPL.

11. Children's Privacy

The Platform is not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, contact us immediately at contact@swop.com and we will delete it promptly.

12. Third-Party Links and Services

The Platform may contain links to or integrations with third-party websites and services including authentication partners such as SWOP authentication. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you connect to SWOP. SWOP is not responsible for the privacy practices of any third-party service.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Sending an email to your registered email address
• Displaying a prominent notice on the Platform
• Updating the "Last Updated" date at the top of this Policy

Continued use of the Platform after changes take effect constitutes your acceptance of the updated Policy.

14. Contact and Data Controller

Data Controller:

SWOP Holdings Inc.
A Delaware C-Corp company, United States
166 Geary St, Ste 1500, MailBox #108
San Francisco, CA 94108

Privacy enquiries: contact@swop.com
General support: contact@swop.com
Legal notices: contact@swop.com

For EU/UK & UAE users who wish to contact our representative for GDPR purposes: contact@swop.trade