Privacy Policy

Last updated: 2026-05-21

This Privacy Policy explains how the Hush marketing website (usehush.io and related preview domains, the "Site") collects, uses, and protects personal data. It applies only to this Site, not to the Hush product itself (which is governed by a separate Data Processing Agreement provided to customers on contract).

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG). We process data only within the EU.

1. Data Controller

The controller responsible for personal data processed via this Site is Swat.io GmbH, an Austrian company. Full contact details are listed in our Imprint.

For data protection inquiries — including requests to access, correct, or delete your data — write to lab@swat.io.

2. What data we collect

2.1 Anonymous analytics

When you visit the Site, our analytics tool records page visits, clicks, scroll behaviour, mouse movements (used for aggregate heatmaps), and performance metrics (Core Web Vitals).

This data is fully anonymous. Specifically:

  • We do not use cookies or any other persistent browser storage. Tracking identifiers exist only in memory and are discarded when you close the tab.
  • We do not store your IP address. The analytics client is configured with ip: false, and IP anonymisation is additionally enforced at the processor level.
  • You appear as a new anonymous session on every visit. We have no way to link multiple visits to the same person.

Legal basis: Legitimate interest in measuring how the Site is used (Art. 6(1)(f) GDPR). Because no personally identifiable data is collected and no cross-session identifier persists on your device, no consent banner is required under Art. 5(3) of the ePrivacy Directive.

2.2 Waitlist signups

If you submit your email address through the early-access form, we store it for the purpose of notifying you when Hush launches.

What we collect: Your email address and the timestamp of submission.

What we do with it: We send you a single notification email when Hush launches. We do not send newsletters, marketing emails, or any communication beyond the launch notification you signed up for.

Legal basis: Your explicit consent (Art. 6(1)(a) GDPR), given by completing and submitting the early-access form. You can withdraw this consent at any time by emailing lab@swat.io; we will then delete your email from our waitlist.

3. Where your data is processed

We use the following processors. All processing takes place within the European Union.

PostHog (EU Cloud)
Analytics and waitlist storage. Servers located in Frankfurt, Germany. Operated by PostHog, Inc. under EU Cloud terms with EU data residency and a Data Processing Addendum in place. PostHog privacy policy.
Amazon Web Services EMEA SARL (AWS)
Static hosting and CDN delivery of the Site (Amplify Hosting), plus CloudFront edge delivery for analytics requests via i.swatio-labs.com. Region: eu-central-1 (Frankfurt). Operated by Amazon Web Services EMEA SARL under EU contractual terms. AWS privacy notice.

We do not transfer personal data outside the European Union.

4. How long we keep your data

  • Anonymous analytics: retained for up to 12 months in aggregate form. Individual events cannot be linked back to a person.
  • Waitlist email addresses: retained until either (a) you request deletion, or (b) 3 months after Hush's public launch, whichever comes first. After launch, retained emails are migrated to the Hush product database under the customer relationship; if you do not become a customer, your email is deleted at the 3-month mark.

5. Your rights

You have the following rights under the GDPR:

  • Right of access (Art. 15) — confirmation of whether we process data about you, and a copy of that data.
  • Right to rectification (Art. 16) — correction of inaccurate data.
  • Right to erasure (Art. 17) — deletion of your data, subject to legal retention requirements.
  • Right to restriction (Art. 18) — limitation of processing under specific conditions.
  • Right to data portability (Art. 20) — receipt of your data in a machine-readable format.
  • Right to object (Art. 21) — to processing based on legitimate interest. We will stop unless we can demonstrate compelling legitimate grounds.
  • Right to withdraw consent (Art. 7(3)) — for processing based on consent, such as the waitlist.
  • Right to lodge a complaint (Art. 77) with a supervisory authority. The competent authority for Swat.io is the Austrian Data Protection Authority (Datenschutzbehörde, dsb.gv.at).

To exercise any of these rights, email lab@swat.io. We respond within 30 days as required by Art. 12(3) GDPR.

6. Cookies

This Site does not use cookies. We do not place any cookies for analytics, advertising, functionality, or any other purpose. Analytics identifiers are kept only in memory and discarded when you close the browser tab.

Because we use no cookies and no equivalent persistent storage, no cookie banner or consent prompt is required under Art. 5(3) of the ePrivacy Directive.

7. Security

All communication with the Site is encrypted in transit using TLS 1.2 or higher. Data processed by our processors is encrypted at rest and in transit within their infrastructure. Access to personal data within Swat.io is restricted to personnel with a legitimate need.

8. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be announced on the Site and, where required by law, communicated to affected individuals directly.

9. Contact

Questions, requests, and complaints regarding personal data: lab@swat.io.

General contact and company details: swat.io/en/imprint.