1. Operator and contact
This website is operated by a sole proprietor registered in Korea, trading as 스원 SWONE (service brand: SWAGENCY). Personal data is processed for website enquiries, campaign enquiries, creator applications and collaboration communications. Send privacy enquiries and rights requests to swagency@swagency.net. SWAGENCY is a service brand, not a separate legal entity. The proprietor’s name, business registration number, address and additional privacy contact details remain to be supplied and confirmed.
2. Data collected and purposes
Enquiries: company, contact name, email, message and consent records are used to respond and discuss collaboration. Telephone, industry, objectives, audience, location, platforms, content types, budget, timing and selected creators are processed when supplied. Creator applications: display name, email, location, category, languages, biography, social links, representative photo and consent records are used for application review and profile administration. Optional contact details, content tags, follower figures and collaboration availability are also processed when supplied.
3. Public information and outreach
Public social profiles and supplied business records may be reviewed to maintain collaboration candidates, including display names, channel links, categories, locations, follower figures, publicly listed emails and sources. A public email or a reply is not prior marketing consent or consent to publish a profile or photo. Outreach must comply with applicable law and platform policies. Request no further contact through the team email or the instructions in the message. Repeat outreach to the same recipient is restricted within six months; declined and opted-out recipients are excluded. Automatic discovery and review do not requeue recipients cancelled or blocked by an administrator.
4. Publication and automated processing
Display names, biographies, locations, categories, social links, follower figures and photos are published only within verified profile-publication and photo-use consent. Private emails, contact details, original replies and internal review records are not public. Automation may classify replies in the company mailbox as interested, needs information, declined or do not contact, and record them in a private database and Google Sheets. Even with automatic approval enabled, required information, account linkage and profile/photo consent must be verified before publication. Request human review, correction, unpublishing or deletion by email if a classification or approval is incorrect. Data-processing, profile-publication and photo-use choices are separate; none constitutes a general advertising or marketing email subscription. Registration does not guarantee work or a collaboration contract.
5. Retention and deletion
The standard retention period for enquiries and applications is 180 days from receipt. Currently expired enquiries are cleaned up when a new enquiry is submitted; expired applications are cleaned up on a new application or an administrator’s cleanup action. Original replies are cleaned up against a 180-day cutoff when new replies are processed. These are not guarantees of automatic deletion at the exact expiry time. Approved public profiles and authorised photos are maintained separately from applications; withdrawal or closure requests are reviewed for unpublishing or deletion. Outreach, archive, sheet and mailbox records do not have one implemented automatic deletion period. Six months is a duplicate-contact restriction, not an automatic deletion deadline. The team must review records for cleanup according to completed purposes, withdrawal requests and applicable law. Minimal suppression identifiers may be retained separately to honour no-contact requests. Legally required or dispute-related records are handled separately with their grounds and periods. Deletion requests require checking relevant copies in the operational database, image storage, connected sheets and mail. Provider and backup deletion availability and retention cycles require contract/configuration confirmation. Simultaneous automatic deletion across all connected services is not promised.
6. Access and external services
Authorised administrators and assigned staff handle enquiries and applications. Notifications go to company, active administrator and assigned staff emails and include operational details such as request type, reference number, receipt time and a sign-in-protected admin link, not enquiry text or photos. Services used include OpenAI Sites and Cloudflare for hosting, databases and image storage; Google Workspace/Gmail, Sheets and Apps Script for mail, operational records and scheduled processing; Resend for notifications; Apify for public-information discovery; and n8n for automation. Connected social publishing also uses Meta platforms. Only information necessary for each task should be transferred. Provider processing is distinct from consented public profile publication. Private contacts and replies are not sold or supplied to advertisers without a separate lawful basis. Exact contracting processor entities and processing details are still being confirmed.
7. International processing
Cloud, mail and automation services may store or process information outside your country. Recipient entities, countries, data, timing, methods, periods and legal grounds depend on actual contracts and service configuration; detailed information is still being confirmed. Any required international-transfer notice, consent or other lawful conditions must be satisfied first; publishing this policy is not consent. This general explanation does not replace a legally required specific international-transfer notice. Contact the team email for processing details and rights requests.
8. Browser storage and security
Browser storage may support saved creators and language preferences. Administrator sign-in may use authentication sessions; request identifiers and hashed identifiers support spam and duplicate-request prevention. Browser settings can restrict or delete cookies and storage, with possible functional limits. Measures include administrator access controls, server-side secret storage and separation of public and private data. Do not enter identity document numbers, payment information or sensitive data in ordinary enquiries.
9. Choices and rights
Optional information is voluntary. Refusing processing necessary for an enquiry or application may prevent that online submission. Email the team to request access, correction, deletion, restriction, withdrawal, no further contact or human review of automated processing. Only the minimum necessary identity information is checked, and applicable legal limits are explained. The online application currently has no automated age or guardian-consent verification. For children requiring guardian verification, contact the team before applying online.
10. Changes and languages
Changes to purposes, data or disclosure scope are announced here with an effective date. Changes requiring new consent must follow a separate process. Korean, English, Japanese, Vietnamese and Chinese versions are available. Translation differences do not reduce legal rights or duties. This document alone does not establish full legal compliance while additional operator, processor and transfer details and required notices/consents remain incomplete.