Privacy Policy

Effective Date: July 1, 2025

Last Updated: June 2025

Applies to: www.theswayedapp.com — www.getswayed.site — iOS App

Controller: SWAYED Inc., Canada — customercare@getswayed.site

Jurisdiction note: This policy is written to satisfy Canadian law (PIPEDA and applicable provincial legislation) as the primary jurisdiction. It also includes provisions that anticipate compliance with U.S. law (CCPA/CPRA, applicable state laws) and the EU General Data Protection Regulation (GDPR) in preparation for SWAYED's planned expansion into the United States and Europe within 18–24 months of the effective date. Where requirements differ by jurisdiction, the applicable provision is noted.

1. About This Policy

SWAYED (referred to as "SWAYED," "we," "our," or "us") is a digital marketplace that connects clients with Afro and textured hair stylists. We are committed to protecting the privacy of everyone who uses our platform — clients, stylists, and visitors — and to being transparent about how we collect, use, and share personal information.

This Privacy Policy explains:

  • What personal information we collect and why
  • How we use hair profile data to build our proprietary Afro hair dataset and power our AI matching algorithm
  • How we anonymize and may share data for research and product development purposes
  • Your rights over your personal information
  • How to contact us with questions or requests
Important: Hair data, including hair type, texture, porosity, scalp condition, and related physical characteristics, is considered sensitive personal information. We apply the highest level of protection to this data and will always obtain your explicit, informed consent before using it for any purpose beyond delivering SWAYED's core services.

2. Who We Are

SWAYED Inc. is incorporated in Canada and is the data controller for all personal information collected through our platform. We are responsible for ensuring that personal information is handled in accordance with applicable privacy law.

If you have any questions about this policy or wish to exercise your privacy rights, you may contact us at:

Privacy Officer, SWAYED Inc.

Email: customercare@getswayed.site

Website: www.theswayedapp.com

EU/EEA users: When SWAYED becomes available in Europe, we will appoint an EU Representative and a Data Protection Officer (DPO) as required under the GDPR. Contact details for these roles will be added to this policy at that time.

3. Information We Collect

We collect personal information that you provide directly, information generated by your use of the platform, and (where applicable) information from third parties such as payment processors.

3.1 Account and Identity Information

When you register on SWAYED, we collect:

  • Full name
  • Email address
  • Phone number (optional)
  • Password (stored in encrypted form — we never store passwords in plain text)
  • Profile photo (optional)
  • Language preference
  • General location (city/region, used to show nearby stylists)

3.2 Hair Profile Data — Sensitive Information

To match you with the right stylist, we ask you to build a Hair Profile. This information is considered sensitive personal information and is treated with the highest level of protection. Hair profile data includes:

  • Hair type (Andre Walker classification: 3A, 3B, 3C, 4A, 4B, 4C — multi-select supported, as many people have more than one texture)
  • Hair density (low, medium, high)
  • Hair porosity (low, medium, high)
  • Hair length and whether measured stretched or unstretched
  • Preferred hairstyles (e.g. braids, locs, natural, protective styles, relaxed, curly)
  • Wash day frequency and approximate duration
  • Chemical treatment history (type, frequency, and recency)
  • Heat tool usage (frequency and type of tools used)
  • Scalp condition (e.g. dry, oily, normal, sensitive, dandruff-prone)
  • Primary hair concern (e.g. breakage, dryness, growth, thinning, frizz)
  • Hair elasticity / breakage level (self-reported)
  • Scalp sensitivity or known ingredient allergies
  • Hair journey stage (e.g. transitioning, fully natural, post-big-chop)
  • Lifestyle factors affecting hair (e.g. frequent swimming, active lifestyle)
  • Product ingredient preferences or restrictions (e.g. sulfate-free, fragrance-free)
Why we ask for this: This information is used primarily to match you with stylists who specialize in your specific hair profile. It is also used — in anonymized form only, and with your explicit consent — to build SWAYED's proprietary Afro Hair Dataset, which powers our AI matching algorithm and may support future research and product development partnerships. See Section 5 for full details.

3.3 Stylist Profile Data

Stylists who register on SWAYED provide:

  • Business or trading name, professional biography, and service menu
  • Verified hair type specializations (the hair types and styles the stylist is trained and experienced in)
  • Portfolio photos and service pricing
  • Geographic service area and salon or home studio location
  • Professional certifications or training credentials (where applicable)
  • Availability and booking schedule

3.4 Booking and Transaction Information

When a booking is made, we collect:

  • Service type, date, time, and location
  • Communication between client and stylist within the platform
  • Payment information — processed by our third-party payment provider (credit card data is never stored directly on SWAYED's servers)
  • Post-booking reviews and ratings (publicly displayed)

3.5 Technical and Usage Data

Automatically collected when you use the platform:

  • IP address and general geographic location derived from it
  • Device type, operating system, browser type and version
  • Pages viewed, features used, time spent, and navigation patterns
  • Referring URLs and search terms
  • Session identifiers and authentication tokens
  • Error and crash reports

3.6 Communications

If you contact us, we collect the content of your message and any information you include (e.g. email address, name). This includes customer support requests, survey responses, and contest entries.

4. Legal Basis for Processing

Canada (PIPEDA): We collect, use, and disclose personal information only with your knowledge and consent, or where permitted by law without consent (e.g. for safety or legal compliance). Sensitive information, including hair profile data, requires explicit consent.
United States (CCPA/CPRA): We process personal information based on the purposes disclosed in this policy. Hair profile data constitutes "sensitive personal information" under CPRA. You have the right to limit its use. We do not sell personal information.
European Union (GDPR — future): When operating in the EU/EEA, we will rely on: (a) explicit consent (Article 6(1)(a) and Article 9(2)(a)) for sensitive data including hair profile data; (b) performance of a contract (Article 6(1)(b)) for booking and account services; (c) legitimate interests (Article 6(1)(f)) for platform security, fraud prevention, and service improvement; and (d) the research exemption (Article 89(1)) for anonymized data used in scientific research, with appropriate safeguards in place.

5. The SWAYED Afro Hair Dataset and AI Use

SWAYED is building the first-ever proprietary dataset of Afro and textured hair profiles. This dataset is central to our mission: ensuring that every client on our platform is matched with a stylist who genuinely understands their hair.

5.1 What the dataset is

The Afro Hair Dataset is a collection of aggregated, anonymized hair profile data derived from SWAYED users. It maps the distribution of hair types, textures, densities, porosities, styling preferences, concerns, and behavioral patterns across the Afro and textured hair community.

This dataset:

  • Contains no personally identifiable information — it cannot be linked back to any individual user
  • Is used to train and improve SWAYED's AI matching algorithm (our "Hair-Type Matching" engine)
  • May be used to generate insights for hair care research and product development
  • Will not be sold as a dataset to any commercial third party

5.2 How your data is anonymized

Before any hair profile data enters the dataset, we apply the following anonymization process:

  • All direct identifiers (name, email, phone, device ID) are removed
  • Location data is generalized to the city or regional level
  • Individual records are aggregated so that no entry in the dataset represents a single person
  • Re-identification safeguards are applied, including data minimization and access controls

We follow best practices for anonymization under PIPEDA, and will meet the irreversibility standard required by the GDPR when operating in the EU.

Important distinction: Anonymized data in our dataset is no longer "personal information" under Canadian and EU law. GDPR does not apply to data that has been properly anonymized; PIPEDA similarly does not apply to information from which personal identifiers have been irreversibly removed. We maintain this distinction carefully and document our anonymization process.

5.3 Your consent for dataset use

Contributing your hair profile data to the anonymized dataset is always:

  • Opt-in: You will be clearly asked whether you consent to this use at the time of profile creation
  • Separate from service consent: Refusing to contribute to the dataset will not affect your ability to use SWAYED and receive stylist matches
  • Revocable: You may withdraw consent at any time through your account settings or by contacting us

5.4 AI and automated matching

SWAYED uses an AI-powered matching algorithm to connect clients with stylists based on hair type, specialization, skill level, geographic proximity, community trust score, and booking history. The algorithm does not make legally significant decisions about users (it suggests stylists; it does not deny access to services).

EU users: Under GDPR Article 22, you have the right not to be subject to solely automated decisions that produce legal effects or significantly affect you. Our algorithm makes recommendations only — you retain full control over which stylist you choose to book.

5.5 Research and product development partnerships

In the future, SWAYED may enter into partnerships with academic research institutions, public health organizations, or hair care product companies to share insights derived from the anonymized Afro Hair Dataset. Any such partnerships will:

  • Use only anonymized, aggregated data (never individual profiles)
  • Be governed by formal data-sharing agreements that restrict use to the agreed purpose
  • Be disclosed to users through an update to this policy in advance
  • Never result in the sale of personal data or individually identifiable information
  • Require that research partners maintain equivalent anonymization and security standards

When SWAYED enters into any research partnership, we will notify registered users by email and update this policy with the name or category of the partner and the purpose of the data sharing.

6. How We Use Your Information

We use personal information for the following purposes:

6.1 Providing the SWAYED platform

  • Creating and managing your account
  • Matching you with suitable stylists based on your hair profile
  • Processing bookings, payments, and confirmations
  • Facilitating communication between clients and stylists
  • Displaying reviews and ratings

6.2 Improving our services

  • Analyzing platform usage to identify and fix issues
  • Developing new features and improving existing ones
  • Training and refining our AI matching algorithm using anonymized hair data (with your consent)
  • Conducting internal research and analysis

6.3 Communications

  • Sending booking confirmations, reminders, and post-service follow-ups
  • Notifying you of new features, promotions, or updates (you may opt out at any time)
  • Responding to your customer support requests
  • Sending you this policy and any material updates to it

6.4 Safety, security, and legal compliance

  • Preventing fraud, abuse, and unauthorized access
  • Monitoring for and investigating violations of our Terms of Service
  • Complying with applicable legal obligations, court orders, or regulatory requests
  • Protecting the rights, property, or safety of SWAYED, our users, or others

7. How We Share Your Information

We do not sell, rent, or trade your personal information. We share your information only in the following limited circumstances:

7.1 Between clients and stylists

When a booking is confirmed, relevant booking details (name, service requested, hair profile summary) are shared with the stylist. Stylists do not receive your email address, phone number, or payment information unless you choose to share it directly.

7.2 Service providers

We work with trusted third-party vendors who process personal information on our behalf under strict contractual terms. These include:

  • Payment processing (e.g. Stripe or equivalent — subject to their own PCI-DSS compliance)
  • Cloud hosting and infrastructure providers
  • Email and communication delivery services
  • Analytics and platform monitoring tools

All service providers are contractually bound to process data only for the specific purpose for which it was shared, and to maintain appropriate security measures.

7.3 Legal requirements

We may disclose personal information if required to do so by law, court order, or government authority, or if we believe in good faith that such disclosure is necessary to protect the safety of any person or to prevent fraud or illegal activity.

7.4 Business transfers

In the event of a merger, acquisition, or sale of all or substantially all of SWAYED's assets, personal information may be transferred to the successor entity. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.

7.5 Research partners (anonymized data only)

As described in Section 5.5, anonymized and aggregated hair data may be shared with research and product development partners. This does not constitute a disclosure of personal information.

8. How Long We Keep Your Information

We retain personal information only for as long as necessary to fulfil the purpose for which it was collected, or as required by law.

  • Account data: Retained for the duration of your active account, plus 2 years after account deletion to satisfy legal and audit obligations
  • Booking records: Retained for 7 years to satisfy financial and tax record-keeping requirements
  • Hair profile data: Retained for the life of your account. Upon account deletion, your identifiable hair profile is deleted within 30 days; anonymized contributions to the dataset are not individually reversible
  • Communication records (support): Retained for 3 years from the date of last contact
  • Technical/usage data: Retained for 13 months on a rolling basis

When you delete your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law or where anonymized data has already been incorporated into the dataset.

9. Your Privacy Rights

Depending on where you are located, you have the following rights over your personal information. To exercise any of these rights, contact us at customercare@getswayed.site.

9.1 Rights under Canadian law (PIPEDA)

  • Right to access: Request a copy of the personal information we hold about you
  • Right to correction: Request that we correct inaccurate or incomplete information
  • Right to withdraw consent: Withdraw consent to any non-essential use of your information, including contribution to the Afro Hair Dataset, at any time
  • Right to complain: File a complaint with the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) if you believe your rights have been violated

9.2 Additional rights for California residents (CCPA/CPRA)

If you are a California resident, you also have the right to:

  • Know what personal information is collected, used, shared, or sold about you
  • Delete personal information we hold about you (subject to certain exceptions)
  • Correct inaccurate personal information
  • Limit the use and disclosure of your sensitive personal information (including hair profile data) to purposes necessary to provide the service
  • Opt out of the sale or sharing of your personal information (we do not sell personal information)
  • Non-discrimination: We will not discriminate against you for exercising any of these rights

To submit a California privacy request, contact us at customercare@getswayed.site with the subject line "California Privacy Request." We will respond within 45 days.

9.3 Additional rights for EU/EEA residents (GDPR — future)

When SWAYED operates in the EU/EEA, you will also have the right to:

  • Access: Obtain a copy of your personal data in a portable format
  • Rectification: Correct inaccurate data
  • Erasure (right to be forgotten): Request deletion of your personal data, subject to legal retention requirements and research exemptions
  • Restriction of processing: Ask us to restrict how we process your data in certain circumstances
  • Object: Object to processing based on legitimate interests or for direct marketing purposes
  • Data portability: Receive your personal data in a structured, commonly used, machine-readable format
  • Withdraw consent: Withdraw consent at any time without affecting the lawfulness of processing before withdrawal
  • Complain: Lodge a complaint with your national data protection authority

We will respond to EU data subject requests within 30 days (extendable by 60 days for complex requests, with notice).

10. Children's Privacy

SWAYED is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you are between 13 and 18, you should have parental or guardian consent before using our platform.

Under GDPR, the age of digital consent for personal data processing varies by EU member state (typically 13–16 years). When SWAYED expands to Europe, we will implement age verification and parental consent mechanisms appropriate to each jurisdiction.

If we become aware that we have collected personal information from a child without appropriate consent, we will delete it promptly. Contact us at customercare@getswayed.site if you believe a child has registered on SWAYED.

11. Security

We take the security of your personal information seriously and implement technical and organizational measures appropriate to the sensitivity of the data we hold. Our security practices include:

  • Encryption of data in transit (TLS/HTTPS) and at rest for sensitive personal information including hair profiles
  • Access controls: Employee access to personal data is limited to those who need it to perform their role
  • Payment security: Credit card data is processed by PCI-DSS compliant payment providers; we never store card numbers
  • Regular security assessments of our platform infrastructure
  • Incident response procedures for detecting and responding to security breaches

In the event of a data breach that poses a real risk of significant harm to individuals, we will notify the Office of the Privacy Commissioner of Canada within 72 hours and notify affected individuals as required by law. When operating in the EU, we will comply with GDPR's 72-hour supervisory authority notification requirement.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security.

12. Cross-Border Data Transfers

SWAYED is based in Canada. Your personal information may be processed or stored on servers located in Canada or, in some cases, in the United States (e.g. cloud infrastructure or service providers based in the U.S.).

Where personal information is transferred outside Canada, we take steps to ensure it receives equivalent protection, including through contractual safeguards with service providers.

EU/EEA users (future): When SWAYED operates in Europe, transfers of personal data from the EU/EEA to Canada will be made in reliance on the European Commission's adequacy decision for Canada (applicable to PIPEDA-covered organizations). Transfers to other third countries, including the United States, will be subject to appropriate safeguards such as Standard Contractual Clauses (SCCs) or the EU-U.S. Data Privacy Framework as applicable.

13. Cookies and Tracking Technologies

We use cookies and similar technologies (such as web beacons and local storage) on our website and app to:

  • Maintain your login session and authentication state
  • Remember your preferences
  • Analyze how the platform is used and identify areas for improvement
  • Detect fraud and ensure security

We do not use third-party advertising cookies or sell data derived from cookies to advertisers.

You may control cookies through your browser settings. Disabling cookies may affect your ability to log in or use certain features of the platform.

EU/EEA users (future): When SWAYED operates in Europe, we will implement a cookie consent management platform that meets the requirements of the ePrivacy Directive and applicable national laws, including obtaining prior consent for non-essential cookies before any tracking occurs.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the expansion of SWAYED to new jurisdictions. When we make material changes, we will:

  • Post the updated policy on this page with a new effective date
  • Notify registered users by email at least 30 days before the changes take effect
  • Where required by law (e.g. under GDPR), seek fresh consent for any new purpose or materially different processing activity

Your continued use of SWAYED after the effective date of a revised policy constitutes your acceptance of the changes. If you do not agree with the updated policy, you may delete your account.

15. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or our handling of your personal information, please contact us:

Privacy Officer

SWAYED Inc.

Email: customercare@getswayed.site

Website: www.theswayedapp.com

Customer Care: www.getswayed.site

If you are not satisfied with our response, you have the right to escalate your complaint to:

  • Canada: Office of the Privacy Commissioner of Canada — www.priv.gc.ca — 1-800-282-1376
  • United States (California): California Privacy Protection Agency — cppa.ca.gov
  • EU/EEA (future): Your national Data Protection Authority

SWAYED — No Texture Left Behind.