Privacy Policy

This Privacy Policy describes:

• Which data we collect
• Why we collect it
• How we protect it
• Your rights as a user
• How to contact our Data Protection Officer

SwimSuite AB is the data controller for:

• Swim Suite app services
• swim-suite.com public website
• Email and support communications

We process personal data under:

• Contract — to provide requested services, analyses, reports
• Consent — for uploads, app analytics, notifications, and embedded social media posts
• Legitimate interest — platform security, improvement, fraud prevention, and anonymous website statistics
• Legal obligation — accounting and regulatory compliance

When you choose to connect Health Connect (Android) or Apple Health (iOS), we read the following health and fitness data:

• Heart rate and resting heart rate
• Heart rate variability
• Sleep
• Active and basal energy expenditure
• Steps and distance
• Workouts

We use data to:

• Provide and operate Swim Suite services
• Perform AI-enhanced race analysis
• Deliver reports and insights
• Process secure payments
• Improve platform performance
• Provide technical support
• Fulfill legal obligations (accounting, invoicing)

The only things the website keeps in your browser:

• A temporary marker that reloads the page once if it was updated while you had it open (cleared when you close the tab)
• Your choice, if you switch off statistics below

How the approximate country is worked out:

• When a page view reaches our server, the server looks up the country that the network (IP) address of the request is registered to, using a table that is part of our own software. No other service is contacted, and your address is not sent anywhere for this
• Only the country code is counted, per day and per page. Your IP address, and anything finer than a country such as a city or coordinates, is not saved with the statistics, and the country is not combined with what you clicked, read, how long you stayed, or which pages you went on to
• It is approximate: the registered country can differ from where you are, for example with a VPN or on some mobile networks. Where it cannot be determined, the page view is counted as "unknown"
• The statistics count page views, not people: we have no way of telling whether two page views came from the same person

We also measure how a page is used, in the same aggregated way:

• Time on a page: how long the page is visible in your browser tab, and, separately, how long you are actively using it (scrolling, clicking, typing, or touching). Time with the tab hidden is not counted, and active time stops after 15 seconds without input. A visit ends when you leave the tab or the page, and returning to the tab starts a new measurement
• Sections: for a fixed list of marked sections of our pages (for example the hero, the plans, or the club map), how long each was in view and whether it was reached at all
• Scroll stops: where on a page, in steps of 5% of its height, scrolling came to rest for at least a second, and for how long that part of the page stayed in view. This is time on screen, not a record of what you read
• Buttons: for a fixed list of marked buttons (for example "Get started" or "See our prices"), whether each was on screen during a page view, so we can tell a button nobody clicks from one nobody sees
• Clicks that land on text or images rather than a link or button, and quick repeated clicks on the same spot, counted per day like other clicks, so we can find things that look clickable but are not
• The height of your browser window, rounded to 20 pixels, so we can see how much of a page fits on the first screen, and which version of the website sent the measurement
• Pointer position (desktop browsers with a mouse only): roughly twice a second, which 32-pixel square of the page the pointer is in, added to a count per square. We store neither the path of your pointer nor the order of positions, and we skip form fields. It is only a rough sign of where attention goes; it is not eye tracking
• Moving between pages: when you go from one page to another, the page you came from and whether this is the second, third, and so on page of your visit (up to the tenth). Each step is added to a daily count of its own, such as "the home page led to the prices page 12 times", so a route through the website can never be put back together
• Where a visit came from, together with what was done: the name of the source (for example a search engine, a social network, or a campaign) is added to the daily counts of page views, clicks, time, scrolling, and buttons, so we can see, for example, whether visitors from a search engine read for longer. Only the name of the source is kept for this, not the address of the website
• The language your browser is set to, on the first page of a visit, and only the language itself (for example "sv"), so we can see whether visitors get the website in their language
• Page speed: how long the main content took to appear, how quickly the page responded to clicks, taps, and key presses, and how much the content moved about while loading, in rough steps. Nothing about what you clicked is part of this
• Links that lead off the website: what kind of link it was (to our app, to a file, to an email address or phone number, or to another website) and where it led: the name of the website or the file. For email links we only note the mailbox of our own addresses (for example "support"), never any other address
• Pages that could not be found: the address that was asked for, with anything that looks like a code or a number replaced before it is sent, and where the link to it was (one of our pages, or the name of another website)
• The hour of the day a page view arrived (Swedish time), so we can see when the website is used

How we limit what these statistics can reveal:

• No cookies, no visitor or session ID, and no fingerprinting — visits are not linked to each other or to you, and nothing is stored on your device for this
• Each measurement is added to daily totals as it arrives; individual visits, sessions, mouse paths, and recordings are never stored. Measurements are sent in small parts, each only once, with nothing that could tie the parts together
• We only note the website you came from (for example google.com), never the full address
• We never record anything you type into a form
• Your IP address is used only to deliver the request, to work out the country as described above, and to block abuse, and is never stored with the statistics. Like any web server, our hosting provider (Google Cloud) processes it when it delivers the request and keeps technical request logs, including IP address, for up to 30 days for security
• The daily totals are kept for up to 14 months and then deleted automatically
• The statistics are processed by Swim Suite on Google Cloud in the EU (Belgium) and are not shared with advertisers or analytics companies

Trusted partners include:

• Firebase — authentication, database, app analytics
• Stripe — secure payments
• RevenueCat — subscription management
• Google Cloud — encrypted storage
• SendGrid — email delivery
• OpenAI — optional AI insights

We ensure legal protection using:

• Standard Contractual Clauses (SCCs)
• Data Processing Agreements (DPAs)

We retain data only as long as needed:

• User account — until deleted
• Race videos — deleted after analysis unless user selects retention
• Reports — stored for user access
• Payment records — 7 years (required by Swedish law)

We use industry-grade protection measures:

• TLS encryption for communications
• AES-256 encryption at rest
• Role-based access controls
• Secure Google Cloud infrastructure
• Monitoring and intrusion detection

You may request:

• Access to your personal data
• Correction of inaccuracies
• Deletion ("right to be forgotten")
• Data export (portability)
• Objection to processing
• Withdrawal of consent

Upon verified user request we:

• Delete account data
• Remove stored videos and files
• Remove analysis data linked to the user
• Retain only accounting-required documents (7 years)