Personal data processing notice
Pursuant to Articles 13-14 of Regulation (EU) 2016/679 (GDPR) · version 1.0 · 3 September 2026
1. Data controller
The data controller is the entity operating the SWR7 service (swr7.dev). Contact for privacy matters and to exercise your rights: [email protected]. The controller's full identity, legal form and address are provided on request by writing to that address, and are in any case stated in full in the engagement documents signed before any activity. No Data Protection Officer has been appointed: the conditions requiring one do not apply.
This notice covers the data we process as a controller: when you contact us, when you buy from our Whop store, and when you visit swr7.dev. Section 6 explains the different case where the data belongs to your users and we act as your processor.
2. What data we collect and why
| Data | Source | Why | Legal basis |
|---|---|---|---|
| Name, work email, company, message | From the "Book a call" form on this site | To get back to you and scope the work | Your consent (Art. 6.1.a), given by ticking the box in the form |
| Target domain, vertical, confirmation that you own or are authorised | From the mandatory questions in the Whop store | To prepare the Rules of Engagement: without this confirmation nothing is tested | Performance of a contract and pre-contractual steps at your request (Art. 6.1.b) |
| Order and payment data (amount, date, reference, country) | From Whop | To know what you bought and to handle refunds and disputes | Contract (Art. 6.1.b) and legal record-keeping obligation (Art. 6.1.c) |
| Engagement material: scan output, findings, screenshots, logs, test credentials | Generated during the work or provided by you | To run the test and produce the report | Contract (Art. 6.1.b). For your users' data see Section 6 |
| IP address of form requests | Automatically, for a short time | Only to limit form abuse (anti-spam) | Legitimate interest in protecting the service (Art. 6.1.f) |
| Whop Pixel: page views, a first-party cookie and a browser identifier (screen, language, time zone, fonts) | Public pages of swr7.dev, only after you accept the banner | To measure visits and the effectiveness of advertising campaigns | Your consent (Art. 6.1.a; Art. 122 Italian Privacy Code; Garante guidance 10/06/2021). Without consent the pixel is not loaded |
Providing the data is voluntary: if you don't fill in the form we won't contact you, but you can write to us directly at the addresses above.
3. Cookies and measurement tools: Whop Pixel
The public pages of this site (home, this notice, "not found" page) may load the Whop Pixel, a script by Whop, Inc. (USA) that measures visits and the effectiveness of campaigns run through the Whop platform. It is not present in the restricted areas — the operator console and the Client Area.
What it does, concretely: it records the page view and any conversions,
sending them to the domain t.whop.tw; it sets a first-party technical cookie;
it computes a browser identifier ("fingerprint") to attribute conversions even
without third-party cookies.
The pixel runs only with your consent. On your first visit a banner asks whether to accept:
until you accept, the pixel is not loaded and no data reaches Whop. "Decline" carries the
same weight as "Accept" and the site works identically. Your choice is stored in your browser
(localStorage, key swr7.consent) and applies to all pages.
You can change your mind at any time: change your cookie
choice (reopens the banner). You can also block t.whop.tw from your browser
settings or with an anti-tracking extension.
4. We don't sell data and we don't profile you
We don't sell or transfer personal data. We don't carry out automated decision-making that produces legal effects concerning you. The Whop Pixel measures advertising in aggregate form: it decides nothing about you.
5. Who we share it with
| Recipient | What it processes | Where |
|---|---|---|
| Cloudflare, Inc. | Site hosting, Client Area database, routing of @swr7.dev mail | EU / USA |
| Whop, Inc. | Store, checkout and payment as merchant of record, advertising pixel | USA |
| Resend | Delivery of our mail, including report notifications | EU |
| Telegram | Internal operator alerts and, if you enable it, alerts to your team | Non-EU |
Transfers outside the European Economic Area rely on the safeguards in Chapter V of the GDPR — in practice the standard contractual clauses and, where applicable, the EU-US Data Privacy Framework. Your findings and your report do not end up in any third-party tool other than those listed above: reports are delivered from our own infrastructure.
6. When the data belongs to your users, not you
During an authenticated test we may come across personal data of your users. For that data you are the controller and we act as your processor under Article 28 of the GDPR. In that role we undertake to:
- process it only on your documented instructions, as recorded in the Rules of Engagement;
- not extract, copy or retain more than the minimum needed to prove a finding — a redacted screenshot, not a database dump;
- keep it confidential, encrypted at rest, accessible only to the analysts assigned to your engagement;
- notify you without undue delay if we become aware of a breach on our side;
- delete or return it at the deadline stated in Section 7, or earlier on your written request;
- not involve a sub-processor on your engagement's data without telling you first.
If your compliance file needs a full Article 28 agreement, ask for it: we sign it before the work begins.
7. How long we keep it
- Engagement material and reports: 24 months from delivery, to be able to handle retests, questions and disputes. Then deleted.
- Test credentials you gave us: destroyed within 7 days of the report, unless the engagement continues.
- Contact data and requests: 24 months from the last contact.
- Order and accounting records: for the period required by tax and commercial law.
- Anti-abuse IP: the strictly necessary technical time, then discarded.
8. Your rights
You can at any time request access, rectification, erasure ("right to be forgotten"), restriction, portability of your data and object to processing based on legitimate interest; where processing is based on consent you can withdraw it at any time, without affecting what was lawful beforehand. Write to [email protected]: we reply without undue delay and in any case within one month.
You also have the right to lodge a complaint with a supervisory authority — in Spain the Agencia Española de Protección de Datos (aepd.es), in Italy the Garante per la protezione dei dati personali, or the authority of your country of habitual residence.
9. Security of what you entrust to us
Reports and engagement data are encrypted at rest and in transit. Access is limited to the analysts assigned to your work. Our infrastructure is watched by the same system we sell, including a dead-man switch that alerts if the monitoring itself stops. This site enforces HSTS and a Content Security Policy that allows no inline scripts.
10. No automated decision-making
We do not carry out profiling or automated decision-making on the data collected from the form. The Whop Pixel (Section 3) performs aggregate advertising measurement per campaign: it takes no decisions with legal effects on you.
11. Changes
If we change this notice materially we'll say so on swr7.dev and, for active clients, by email. The version that applies to your engagement is the one in force when it started, unless the change is required by law.
Version 1.0 · 3 September 2026 · [email protected]. This notice is to be read together with the Terms of Service and the Refund Policy published on the Whop store, and the Rules of Engagement signed for the individual engagement, which prevail in case of conflict over the scope of the work.