Privacy Policy

Effective date: 9 October 2026

Who is responsible for your data

Sweebo AI is operated by Codebrains Jakub Stompor, based at Gadka 231D, 27-220 Mirzec, Poland, tax ID (NIP) 6642085366. The operator is the controller of personal data processed to provide Sweebo AI. Contact us at social@sweebo.ai. Our website is https://www.sweebo.ai.

This notice covers Sweebo AI's website, Android application, backend and support communications. Third-party platforms also have their own privacy notices.

The same rules apply when you use Sweebo AI for yourself, a business or an agency. When acting for a brand or client, use only accounts and material you are authorized to manage. This notice does not replace your own obligations toward people whose data you provide.

Information we process

Information	How it is obtained and used
Account and workspace information	Your email address, optional profile name, account/workspace identifiers, membership and account status support registration, login and access control.
Authentication and security information	Password hashes, session-token digests and expiry/revocation records protect account access. The Android app stores session credentials using Android Keystore-backed encryption. Authentication throttling uses hashed identifiers and network-address information available to the service.
Usage and credits	Analysis operation identifiers, the selected TikTok profile identifier and captured-post fingerprint, input digests, status, cost, credit reservations/charges, grants and subscription assignment support reliable results, usage limits and accounting. The profile identifier and fingerprint are included in the operation key sent to and retained by the backend when you request AI analysis.
Local device information	Selected TikTok profile, settings, language preferences, automation history, quotas and publication-attempt records are stored on the device. Signing in does not upload that history into your workspace.
Content used for AI analysis	When you request an AI-enabled operation and authorize the required Android capture, selected screen text, image frames and sampled audio are sent to the backend. User-provided style instructions are also processed. Audio may be transcribed and combined with text and frames to generate a result.
Analysis results	Generated results, including comment text, eligibility decisions and reasons, may be stored with the operation record to return the same result without duplicate charges. Outputs can contain personal information from their input.
Support and operational information	Information you send to support and technical information needed to deliver, secure and diagnose the service may be processed. Network providers receive connection information when serving requests.

Sweebo AI does not require your TikTok password. Account passwords are handled for authentication and stored as hashes, not readable passwords. The application's diagnostics are designed to exclude credentials, raw request bodies, captured media and transcripts. This does not mean that hosting providers never process network information or that database results are anonymous.

Captured content can include other people's information. Use capture only for material you are entitled to process and avoid submitting unnecessary sensitive information.

Account details come from you; captured third-party information comes from the content you select on your device, including public posts. An email address and password are required to create an account; a profile name is optional. Without the required account details, permissions or analysis input, we cannot provide the corresponding function. You can still browse the public website.

Purposes and legal bases

Where the GDPR applies, we process information as follows:

• Account access, requested functionality and usage accounting: performance of our agreement with you, under Article 6(1)(b).
• Security, abuse prevention, answering enquiries and proportionate operational diagnostics: our legitimate interests, under Article 6(1)(f).
• Limited analysis of information about other people in content you submit: legitimate interests in delivering the requested creator tool, under Article 6(1)(f), subject to those people's rights. Use only material you are entitled to process; do not submit sensitive personal data or use the service to profile people or make consequential decisions about them.
• Optional processing that specifically relies on your consent: Article 6(1)(a). The relevant choice must identify the data and purpose; you may withdraw it.
• Processing required by applicable law: Article 6(1)(c).

Android permissions and platform authorization control access to a feature; they do not themselves establish a legal basis for every subsequent use of the data. We do not use credit eligibility or AI-generated suggestions to make decisions about you producing legal or similarly significant effects.

Service providers and international processing

Amazon Web Services (AWS) provides website/backend hosting, database, networking and operational infrastructure. The current backend/database deployment uses Frankfurt, Germany. CloudFront is a global delivery service, so this deployment region is not a promise that every part of processing occurs only in Germany.

OpenAI Ireland Ltd., the contracting provider for our Polish API account, processes selected audio, text, instructions, transcripts and image frames to provide requested transcription and generation. Its API retention varies by endpoint and account configuration. In particular, default abuse-monitoring retention for applicable generation requests can be up to 30 days, with exceptions described in OpenAI's data controls. We do not promise zero retention or European-only AI processing.

OVHcloud provides our domain/DNS and support mailbox. Email providers involved in delivering a message also process its contents and routing information.

Providers and their subprocessors may process information outside the European Economic Area. AWS's service terms incorporate its data-processing addendum and the European Commission's Standard Contractual Clauses for applicable transfers to countries without an adequacy decision. OpenAI's data-processing addendum provides for applicable adequacy decisions or Standard Contractual Clauses for onward transfers from the EEA. These safeguards do not mean that processing is confined to Europe. Contact social@sweebo.ai for information about applicable safeguards or a copy, subject to necessary redactions. The published arrangements are available in AWS's GDPR information, OpenAI's data-processing addendum and OVHcloud's privacy information.

Information may also be disclosed when required by law or necessary for a specific legal claim. Requests must be assessed rather than treated as unrestricted access.

Storage and deletion

Account information is kept while the account is active. Access credentials have a 15-minute validity period; a session's refresh lifetime is capped at 30 days. Expiry ends authorization and does not guarantee immediate physical removal of every related database record.

Using account deletion disables the account, removes the identifying email/profile fields and password hash, revokes sessions, disables workspace access and clears saved analysis content from the affected workspaces. An analysis already admitted can still incur a charge, but its result is not saved again after account closure.

Minimal operation identifiers (including the selected TikTok profile identifier and captured-post fingerprint), input digests, states and credit/budget amounts remain to preserve accounting, prevent duplicate charges or unsafe retries and handle legal obligations or claims. Retained account/workspace and operation/ accounting records have no automatic deletion schedule in the current backend and are not described as anonymous. Expired authentication throttling and session records are cleared through bounded cleanup triggered by authentication requests; expiry does not guarantee immediate physical deletion. We assess erasure requests individually and restrict retained records to purposes that still require them; the 90-day content rule does not delete accounting rows.

Deletion of a Sweebo AI account does not erase the local TikTok history or preferences on your device. Those are separate device data. Removing the application or clearing its storage removes the application's private local data; it does not remove content already sent to a platform or provider.

Sweebo AI's backend currently handles raw media samples and transcripts during a request rather than saving them as a media archive. Stored generated outputs are separate from those transient inputs. Saved analysis content is available for up to 90 days from the operation's creation, after which the backend refuses cached-result reuse. Hourly maintenance clears expired content in bounded batches; physical clearing can take longer during an outage, a lock or a cleanup backlog. Account closure clears affected workspace content immediately in the closure transaction. Older unscoped operation records follow the 90-day cleanup rule.

Closed support correspondence is kept for 2 years after resolution, then removed through mailbox maintenance, unless a particular legal obligation or claim requires longer retention. Application and maintenance logs have a 3-day retention setting. Automatic database backups have a 1-day retention setting, so deleted data can remain in backups until their normal expiry. Deletion and content-retention rules must be reapplied before a restored database returns to service. Provider retention also follows the arrangements above.

Website delivery

The website serves statically exported React/Next.js pages. Its scripts render the interface; we do not add analytics, advertising cookies, forms or browser storage. The EN/PL language choice is stored in the page URL (?lang=pl for Polish), not in cookies or browser storage. Following an email link opens your mail client; it does not submit information through this website. AWS receives connection information such as IP addresses and HTTP headers to deliver pages and protect the service. Our website's CloudFront and S3 access logging are disabled. AWS WAF inspects requests for security and keeps sampled requests available for up to 3 hours; samples can include addresses and headers. This is separate from application logs and provider infrastructure/security records.

Your choices and rights

You can stop an active session and revoke Android accessibility or capture permissions in device settings. Stopping prevents further admitted operations; it cannot recall work already accepted by an external service.

Where applicable, you may request access, correction, erasure, restriction or portability of personal data, and object to processing based on legitimate interests. You may withdraw consent without affecting earlier lawful processing. Contact social@sweebo.ai. We may request proportionate identity verification. We will explain applicable limits rather than promise that every record can be erased regardless of legal obligations or other people's rights.

We respond to rights requests without undue delay, normally within one month. If complexity or the number of requests requires up to two additional months, we explain the extension and its reasons within the first month.

You may complain to the data protection authority for your habitual residence, place of work or an alleged infringement. The Polish supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych): UODO.

Eligibility and changes

The minimum age for Sweebo AI is 18 years, subject to applicable law and the connected platform's requirements. Contact us if you believe a child has provided information contrary to these requirements.

We will publish material changes to this notice with a new effective date and provide appropriate notice before materially different processing begins.