Last updated: 11 October 2026
This explains what we collect, why, and what you can do about it. We have tried to write it plainly. If anything is unclear, email hello@swapaboo.com and we will explain.
Swapaboo Ltd is the data controller for the information described here.
Company number 17463009. Registered office: 82a James Carter Road, Mildenhall, Bury St Edmunds, IP28 7DE.
Registered with the Information Commissioner's Office, reference ZC254565.
Contact: hello@swapaboo.com
| What | Why | Our legal basis |
|---|---|---|
| Email address | To tell you when it is your turn, and to reply to you | Contract |
| First name, if you give it | So we can write to you properly | Legitimate interests |
| Postcode area, if you give it | To understand where families are, and plan where to open | Legitimate interests |
| The sizes you are looking for, if you give them | To know what stock is needed before we open to you | Legitimate interests |
| How you found us | To understand what works | Legitimate interests |
All of these except the email address are optional.
| What | Why | Our legal basis |
|---|---|---|
| Email address and login details | To run your account | Contract |
| The sizes your children are in | To show you relevant items | Contract |
| Photographs of items you list | To assess them and show them to other families | Contract |
| Your credit balance and history | To run the exchange | Contract |
| Delivery address | To get bundles to you | Contract |
| Payment details | Taken and held by Stripe, not by us | Contract |
| Your mobile number | Given when you claim a bundle, so the delivery carrier can text you the locker collection code | Contract |
| Messages you send other families through Swapaboo | To arrange a handover or sort out a problem. We may read them to resolve a disagreement between families | Contract |
| Our record of reports, disputes, any credits recovered, and notes where an account repeatedly has problems | To run the exchange fairly, resolve problems, and keep families safe | Legitimate interests |
| What | Why | Our legal basis |
|---|---|---|
| Basic usage information | To keep the service working and spot problems | Legitimate interests |
| Aggregate analytics | To understand how people use the site | Legitimate interests |
We use Cloudflare Web Analytics, which does not use cookies and does not track individuals across sites.
We do not collect information about your children beyond a size band. No names, no dates of birth, no photographs.
A size band tells us what will fit, which is what the service is for. We hold it because you have asked us to find clothes that fit, and we keep it only while your account is open.
Photographs should show clothes, not children. If you upload a photograph with a child in it, tell us and we will delete it.
When you list an item you give us a licence to use the photographs and details you provide. We show them to families browsing, and they stay visible if the bundle is passed on and relisted by another family. We also use them to run and improve our item assessment. This licence continues even after you close your account, so that items already passed on are not left without a description. The full terms of this licence are in our Terms.
We use automated software to assess the condition of the items you list and to set the number of credits they are worth. This decision is made by software, not a person. If you think it has got something wrong, tell us and a person will review it. The software is run with help from Anthropic, which processes the photographs on our instructions only (see "Who we share it with").
We use other companies to run Swapaboo. They process information on our instructions and cannot use it for their own purposes.
| Who | What they do | Where |
|---|---|---|
| Supabase | Database and accounts | EU |
| Vercel | Runs the app | EU/US |
| Vercel | Runs the website | US |
| DigitalOcean | Runs our item assessment service | United Kingdom |
| Anthropic | Assesses item photographs | US |
| Stripe | Takes payments | EU/US |
| Resend | Sends our emails | US |
| Cloudflare | Website delivery and analytics | Global |
Other families. When you list an item, the photograph, its condition and its size are shown to families browsing. Your name and contact details are not. When a bundle is sent, the delivery service needs an address.
Photographs we could not accept. If our automated check declines an item when you try to list it, we keep a private copy of that photograph, together with the reason it was declined. We use it to check the decision was right, to answer you if you think it was wrong, and to improve the check. It is never shown to other families. It is deleted when you delete your account, or after the period below.
Nobody else. We do not sell your information, and we do not share it for anyone else's marketing.
Transfers outside the UK. Some of the companies above are based outside the UK. Where that happens, the transfer is covered by the UK's approved safeguards, including the International Data Transfer Agreement or adequacy regulations.
| What | How long |
|---|---|
| Waiting list entry | Until you ask us to remove it, or two years without contact |
| Account information | While your account is open, then 30 days |
| Your credit history after you close your account | Kept against an anonymous identifier, with your name and details removed, so the exchange's records stay balanced. We cannot delete these entries, but they are no longer linked to you |
| Item photographs | While listed, then 12 months |
| Photographs declined at grading | 12 months, to check the decision and resolve any dispute |
| Transaction records | Six years, because tax law requires it |
| Emails you send us | Two years |
| A record of the emails we send you | Two years |
You can ask us to:
Email hello@swapaboo.com and we will respond within one month.
Marketing. Every email we send has an unsubscribe link. Using it stops marketing emails but not the ones about your account and your bundles.
If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first.
Your information is held in access-controlled systems. Payment details never reach us: Stripe handles them. Our team can see only what they need to run the service and help you.
No system is perfect. If something happens that puts your information at risk, we will tell you and the Information Commissioner's Office as the law requires.
We use the minimum. Essential cookies keep you logged in and keep the site secure. Our analytics does not use cookies at all and does not follow you around the internet.
If we change this policy we will update the date at the top, and tell you by email if the change matters to you.