Privacy Policy

What personal information SwapEazi processes, why, for how long, who else handles it, and your rights under POPIA and the GDPR.

1. Who we are and what this covers

SwapEazi (Pty) Ltd ("SwapEazi", "we", "us") is a private company registered in South Africa. SwapEazi measures what cross-border payments cost against an independent market reference. It does not move, hold or exchange money, and it does not verify anyone's identity.

This policy explains what personal information we process when you use swapeazi.io, our API and our MCP server, why, for how long, who else handles it, and your rights. Most of what we process is information about payments, not about people, and we have designed the service to keep as little personal information as it can.

For the personal information described here, SwapEazi is the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA) and, where they apply, the controller under the EU and UK General Data Protection Regulation (GDPR). When you give us payment files for an audit, we process any personal information in them on your behalf, as your operator (POPIA) or processor (GDPR); section 9 explains how.

Our Information Officer is Msingathi Majola, director, reachable at hello@swapeazi.io.

2. What we collect

2.1 What you give us

• Contact details when you apply to be a Founding Partner: your name, work email, company name, the corridors you use and a monthly volume band.
• Your email address when you request an API key, so we can send the key and tell you about changes that affect it.
• Order details when you order: your name, work email, company, country of registration, a volume band, the number of entities and any notes you add, used to invoice you and deliver what you ordered.
• Your email address, and optionally your company and role, when you sign up for the weekly brief and the monthly Africa Payment Cost Report, with the consent you gave and when.
• What you write when you email us.
• Your work email, company, country and how often you make a payment when you ask to be introduced to a provider, with the payment and the route you were shown. We pass it to that provider by hand, only with your consent.
• Payment outcomes a partner chooses to submit: provider, currency pair, amount, date and result. We ask for economics only, and do not want names, account numbers or payment references in them.

2.2 What an assessment reads, and what it keeps

• A quote or single payment you assess: the amounts and currencies. Used to answer you and not stored.
• Public blockchain data: we read stablecoin conversions recorded on public blockchains to measure what they cost. We keep only the chain, the hour, the currencies, a size band and the cost. We do not keep wallet addresses or transaction identifiers, and we do not try to link a conversion to a person.
• A payment you measure, or a year of payments you upload to the free assessment: read to measure your payments, then discarded. With your consent, given on the assessment itself by ticking a box, we keep only anonymised economics: the currency pair, the month, a size band and the measured cost with its margin of error. Never names, company details, references, exact amounts or exact dates. Because these cannot be linked back to you, we cannot later find or remove the rows from one assessment.
• A stablecoin payment you prepare from your own wallet: your wallet address, the recipient's address, the token, network and amount, the rules decision and the transaction hash, kept as your payment record. The recipient's address is screened against public risk lists. We never hold your keys or funds. With your consent, ticked on the payment, an anonymised row (token, network, month, size band) joins our cost research.
• Spend controls your organisation sets for its agents and team: profile names, the approver's email, limits and approved addresses, the payments waiting for approval and the audit trail of prepared and confirmed payments. Visible only with your organisation's key, and used to apply your rules and notify your approver.
• If you assess a rate, a quote or a payment's status with your own provider or off-ramp account, your API key is used for that one call and not stored. SwapEazi does not send payments or payouts.
• If your organisation chooses to connect a provider account so its payments report back on their own, SwapEazi keeps that account's read-only key, encrypted, and uses it only to read your recent payments and match them to your payment cases by their SwapEazi reference. It never creates, funds or cancels a payment with it. Your organisation can remove the key at any time. If your organisation also turns on sharing for that connection (off unless it does, and it can turn it off at any time), the anonymised outcome of each settled payout in that account joins the shared landing rates exactly as for a shared export: provider, currency, outcome, hours to land where the provider reports it, failure cause and month, with one-way fingerprints of the payout's identifier and of your organisation for the month. Never names, accounts, amounts, references or dates.
• A supplier document you assess (a bank letter, statement or invoice): sent to Anthropic (section 4) to read the bank details, compared with the details you enter, and returned to you. Neither the document nor the details are stored.
• A payout export you assess on the settlements page: read to classify each payout, then discarded; recipient names are used only to spot a possible double payment and are never returned or kept. With your consent, given by ticking a box, we keep for each settled payout only its provider, currency, outcome (landed or failed), hours to land, failure cause and month, plus two one-way fingerprints: one of the payout reference, so the same payout is never counted twice, and one of your network address for that month, so we can count how many contributors a shared figure rests on. Never names, accounts, amounts, references or exact dates. Shared landing rates are shown only when they rest on enough payouts and contributors.
• A payout batch you run through the agent: read to assess and price it, then discarded. With your consent, given by ticking a box, we keep only anonymised results: the currency pairs, the month, counts of payouts released, held and stopped, and the money the run saved or protected. Never names, account details, references or exact dates.
• Payment files or bank payment messages you send for a paid audit: processed to produce your report, as described in section 9.
• A signed verify or reconciliation record is returned to you. We do not keep a copy of it; anyone can verify its signature later without us.

2.3 What is collected automatically

• Your IP address and browser details, in our hosting provider's request logs, used to keep the service running and secure.
• A daily count of free measurements, so each person gets 10 a day. It is keyed on a salted one-way hash of your IP address, never the address itself, and deleted after two days.
• For API calls: the endpoint, time, status and IP address, written to our server logs. API keys are stored only as a fingerprint; we cannot see or recover a key after issuing it.
• We do not use analytics, advertising or tracking cookies, and we do not build profiles of visitors.

3. Why we use it, and on what legal basis

• To provide what you asked for (measuring a payment, issuing a key, running an audit, answering you): necessary to carry out our agreement with you, or to take steps you asked for before one. POPIA section 11(1)(b); GDPR Article 6(1)(b).
• To keep the service secure and fair (rate limits, the free daily allowance, abuse prevention, logs): our legitimate interest in running a reliable service, which does not override yours because the data is minimal and short-lived. POPIA section 11(1)(f); GDPR Article 6(1)(f).
• To send the weekly brief and monthly report you signed up for: your consent, which you withdraw with the unsubscribe link in every issue. POPIA section 11(1)(a); GDPR Article 6(1)(a).
• To build cost benchmarks from anonymised economics you chose to contribute: your consent, which you can withdraw for future uploads at any time. POPIA section 11(1)(a); GDPR Article 6(1)(a).
• To keep invoices and accounting records: a legal obligation under South African tax law. POPIA section 11(1)(c); GDPR Article 6(1)(c).
• To tell you about SwapEazi: only if you are a customer and have not opted out, or you asked us to. Every such email lets you opt out, in line with section 69 of POPIA.

We do not process special personal information, we do not knowingly process information about children, and we do not make automated decisions about people. Our figures are measurements of payments; what you do with them is your decision.

We do not sell personal information, and we do not use your data or uploaded files to train AI models.

4. Who else handles it

A small number of service providers process personal information for us, only on our instructions and under their data processing terms:

• Netlify: hosts the website, API and our data store, and keeps request logs.
• Supabase: database for the anonymised benchmark contributions and records from our earlier service (section 8).
• Resend: sends the emails we send you, such as your API key, the weekly brief and the monthly report.
• Anthropic: its AI model reads the statements, payout files and supplier documents you upload, for that one read, under its commercial terms, which do not allow it to train on them.
• Our email provider, for messages you send to hello@swapeazi.io, and our bank, for invoices you pay.

We may also disclose information where the law requires it, to protect our rights in a dispute, or to a buyer of the business, who would be bound by this policy. We do not share personal information with the payment providers we measure, except a provider you ask us to introduce you to, with your consent, and then only that request.

5. Transfers outside South Africa

Our providers run on servers outside South Africa, including in the United States. Under section 72 of POPIA, we transfer personal information only to providers bound by agreements that give it protection substantially similar to POPIA's, which for these providers means their data processing agreements, including the EU standard contractual clauses.

For people in the EEA or the UK, transfers rely on the same standard contractual clauses (and the UK addendum) or on an adequacy decision where one exists.

6. How long we keep it

• Free assessment daily counter: two days.
• Report sign-ups: unconfirmed ones are deleted after 30 days; confirmed ones are kept until you unsubscribe, when the record is removed.
• Server and API request logs: as long as our hosting provider keeps them, typically no more than 30 days.
• Uploaded payment files for the free assessment: not kept. Anonymised economics you contributed: kept, since they identify no one.
• Payout exports assessed on the settlements page: not kept. Anonymised payout outcomes you chose to share: kept for the shared landing rates, since they identify no one.
• Audit files: see section 9.
• Founding Partner applications and API key records: while the partnership or key is active, and 12 months after it ends, then deleted.
• Introduction requests: no longer collected since 19 October 2026. Requests made before then are deleted 24 months after the request, or sooner if you ask.
• Emails and contact details: while we are in touch, and up to 24 months after our last exchange.
• Orders: those that become invoices are kept with the invoice; orders that do not are deleted after 24 months.
• Invoices and accounting records: five years, as South African tax law requires.

7. Your rights

7.1 Everyone

You can ask what personal information we hold about you and who has had it, ask us to correct or delete it, object to our using it on the basis of legitimate interest or for direct marketing, and withdraw any consent you gave. Under the GDPR you also have the rights to restriction and portability. Email hello@swapeazi.io; we will confirm who you are before acting, reply within 30 days, and not charge you for a reasonable request.

In South Africa, a formal request for access to records may also be made under the Promotion of Access to Information Act, using the prescribed form, to our Information Officer at the same address.

7.2 Complaints

We would rather you came to us first, but you do not have to. You may complain to the Information Regulator of South Africa (inforegulator.org.za), or, in the EEA or UK, to your local data protection authority.

8. Records from our earlier payment service

Before September 2026 SwapEazi built a payment service, now closed. People who joined its waitlist, claimed a username, linked an account or began identity verification may have records in our database. We no longer collect any of this: those parts of the service are switched off.

We are deleting these records, keeping only what a law requires us to keep, for as long as it requires. If you want yours deleted now, or want to know whether we hold any, email hello@swapeazi.io.

9. Payment files you give us for an audit

Payment files and bank payment messages can contain personal information about your staff, suppliers or their account holders. For that information you are the responsible party (controller) and we act as your operator (processor). We:

• process it only to produce the audit you asked for, and never for any other purpose;
• keep it confidential, restrict access to the people doing the audit, and protect it with the measures in section 10;
• use no sub-processors beyond those in section 4, and tell you before adding one;
• tell you without undue delay if we believe it has been compromised;
• delete the files within 30 days of delivering your report, unless you ask us in writing to keep them longer, and keep in the report only the economics of each payment, not names or account numbers;
• help you answer requests from the people the data is about.

You confirm that you are entitled to give us these files for this purpose. Section 5 of our Terms sets out the same commitments as part of our agreement with you.

10. Security

We protect personal information with measures suited to what little we hold: encryption in transit, access limited to the people who need it, secrets kept out of code, API keys stored only as fingerprints, and the minimum of data kept for the minimum time. Our security page describes where data is hosted and how to report a vulnerability. No system is perfectly secure, and we do not claim otherwise.

If we have reasonable grounds to believe personal information has been accessed or acquired by someone unauthorised, we will notify the Information Regulator and the people affected as soon as reasonably possible, as section 22 of POPIA requires, aiming for 72 hours, and, where the GDPR applies, the competent authority within 72 hours. The notice will say what happened, what was involved, what we have done and what you can do.

11. Cookies and browser storage

We set no analytics, advertising or tracking cookies. Your browser may store your light or dark theme preference locally; it never leaves your device. If we ever add a non-essential cookie, we will ask first and update this section.

12. Changes to this policy

When we change this policy we will update the date and version at the top, and for a material change tell customers and partners by email before it takes effect.

Contact

Questions or requests under this policy: hello@swapeazi.io