Privacy Policy

Version of 11 November 2026.

1. Who is responsible

1.1. The controller of your personal data in the MySwag service (the website myswag.com.ua and the web app, the "Service") is Mariia Vafina (Вафіна Марія Маратівна), a private individual (the "Controller", "we").

1.2. We process data in accordance with the Law of Ukraine "On Personal Data Protection" and, for users in the European Union and the European Economic Area, the EU General Data Protection Regulation 2016/679 (GDPR).

1.3. For any question about your data, email mashadozaa@gmail.com.

2. Data we process

2.1. We do not collect location, phone contacts, payment data or identity documents, and we do not ask for data about health, religious or political beliefs. Please do not add such data about yourself or others to reviews and notes, especially on an open map.

2.2. We do not carry out automated decision-making or profiling that has legal or similarly significant effects on you.

3. Purposes and legal bases

3.1. We do not use data for advertising, sell it or share it with third parties for marketing. If we ever want to send news or newsletters, we will ask for separate consent, which you can withdraw.

4. Who can see your data

• Your name, username and avatar are visible to other users in people search and to anyone who opens the link to your profile. Don't use an avatar you are not comfortable sharing publicly.
• Your profile description and finds (titles, ratings, notes, reviews, covers) are visible to anyone with the link if your map is open. If your map is private (the default), only users whose follow request you accepted can see them.
• Your wishlist is visible only to you.
• Your email, password, sessions and original photos before cropping are not visible to any user.
• Follows: the person you send a request to sees the request and your profile.

4.1. What others have already seen they may remember or screenshot, and we cannot prevent that. Choose your map's visibility deliberately.

4.2. When you add a link to your wishlist, our server contacts that website to get the title and image. The website sees a request from our server, not from you.

5. Who we share data with

5.1. We use only providers the Service cannot run without, under contracts that require them to process data only on our instructions and to protect it:

5.2. We may disclose data to law enforcement or courts only on the grounds and in the manner provided by law, and only to the extent necessary.

5.3. If the Service is reorganised or transferred to another entity, data may pass to the successor, who will be bound by this Policy. We will tell you in advance.

6. Where data is stored

6.1. Data is stored on AWS servers in the European Union. Under Article 29 of the Law of Ukraine "On Personal Data Protection", states that are parties to Council of Europe Convention No. 108, which include all EU member states, are deemed to provide an adequate level of personal data protection.

6.2. AWS belongs to a US group of companies. AWS's access to data is limited by a data processing agreement, and any transfers outside the EU are protected by Standard Contractual Clauses approved by the European Commission.

7. How long we keep data

• Account, profile and content are kept while your account exists. A find, wish or photo you delete is removed from the database and storage straight away.
• Account deletion: after your request we delete the account and all related data (profile, finds, wishlist, follows, sessions, photos) within 30 days.
• Sign-in sessions last 7 days or until you sign out, after which they become invalid. Their records are deleted together with the account.
• Technical logs are kept for up to 30 days unless needed to investigate a specific security incident.
• Database backups are overwritten within 30 days, so deleted data disappears from them within that period.
• Correspondence is kept for up to 3 years after the last message so we can show how a request was handled, unless the law requires longer.

8. Cookies and browser storage

8.1. We do not use cookies, advertising or analytics trackers, social media pixels, or third-party fonts and scripts. Fonts are served from our own server.

8.2. The app keeps only your sign-in token and chosen language in your browser's local storage (localStorage). This is strictly necessary to keep you signed in and show the interface in your language, so no consent is required. This data is removed when you sign out or clear the site's data in your browser.

9. How we protect data

• All connections to the Service are encrypted (HTTPS/TLS).
• Passwords are stored only as bcrypt hashes.
• Signing out revokes your session on the server.
• Photos are kept in private storage with no public access and are opened only through temporary signed links.
• Only authorised people have access to servers and the database, limited to what they need.

9.1. No protection is absolute. If a breach creates a risk to your rights, we will notify you without undue delay, as well as the Ukrainian Parliament Commissioner for Human Rights and, where the GDPR requires, the EU supervisory authority (within 72 hours).

10. Your rights

Under Article 8 of the Law of Ukraine "On Personal Data Protection" and Articles 15–22 of the GDPR, you have the right to:

• know what data we process about you, why and who we share it with, and get a copy;
• have inaccurate or incomplete data corrected (you can change most of it yourself in your profile);
• have your data and account deleted;
• restrict processing;
• receive your data in a structured, machine-readable format (JSON) and transfer it to another service;
• object to processing based on legitimate interest;
• withdraw consent where processing relies on it, without affecting the lawfulness of earlier processing;
• lodge a complaint with a supervisory authority or a court.

10.1. How to exercise them. Email mashadozaa@gmail.com from the address your account is registered with. If you write from a different address, we may ask you to confirm the account is yours. We will respond free of charge within 30 calendar days. You can delete individual finds, wishes and photos in the app yourself at any time.

11. Children

The Service is intended for people aged 16 and over. We do not knowingly collect data from children under that age. If you are a parent or legal guardian and believe a child has created an account, contact us and we will delete it.

12. Changes to this Policy

We update this Policy when the Service or the law changes. The new version is published on this page with its date. We will tell you in advance, in the Service or by email, about material changes such as new purposes or new recipients of data, and ask for consent where it is required.

13. Contact and complaints

Mariia Vafina (Вафіна Марія Маратівна), private individual
Email: mashadozaa@gmail.com

If you believe we have violated your rights, please write to us first and we will try to fix it quickly. You can also contact the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua) or, if you live in the EU or EEA, the data protection authority in your country.

This Policy is made in Ukrainian and English. If the versions differ, the Ukrainian version prevails.