Version 3.5 · Last Updated: October 28, 2026 · Effective: takeout / pickup ordering provisions added in Versions 3.4 and 3.5 (including Supplementary Article 8) effective November 5, 2026; table-side QR ordering provisions added in Version 3.1 (including Supplementary Article 8) effective November 4, 2026; Google AdSense changes effective November 1, 2026; Version 3.3 and Version 3.2 amendments and certain changes effective October 28, 2026; all other provisions already in effect (see the notes at the end)
Important Notice and Consent: Please read this Privacy Policy (the "Policy") carefully before downloading, registering for, or using the SWAY App (iOS / Android), the official website (swayfoodapp.com), the Merchant Portal, or any service of the Company. By registering for or using the Service, you acknowledge that you have been informed of this Policy and consent, within the scope disclosed in this Policy, to the Company collecting, processing and using your personal data in accordance with this Policy; for matters that by law require your separate consent (such as use beyond the specific purpose), the Company will obtain your separate consent, which you may withdraw at any time. We are committed to protecting your personal data while delivering quality services, operating the Platform, optimizing recommendations, preventing fraud, and developing our business, in accordance with the Personal Data Protection Act of the Republic of China (Taiwan), the EU General Data Protection Regulation (GDPR), Apple App Store privacy standards, and Google Play Data Safety standards.
📌 Legal Entity: This service is operated by SWAY CO., LTD. (registered in Taiwan as 隨食有限公司; brand name "Sui Shi SWAY"; hereinafter "the Company," "we," or "SWAY") established and operated under the laws of the Republic of China (Taiwan). This Policy shall be read in conjunction with the Terms of Service, Refund and Cancellation Policy, Merchant Service Agreement, and Community Guidelines.
SWAY CO., LTD. is the data controller of this Service and bears the responsibility of a non-government agency for the collection, processing, and use of data under the Personal Data Protection Act. However, with respect to customer rosters uploaded or created by merchants under Section 5.6 of the Merchant Service Agreement, the Company stands in the position of a fiduciary processor, and the collector is that merchant; see §2.6 of this Policy for details.
This Policy also applies to customer rosters that the Company processes on merchants' instructions in its position as a fiduciary processor (see §2.6 for details); with respect to such data, the Company's obligations are not conditional on the existence of a membership relationship between the data subject and the Company.
This Policy applies to all products and services offered by the Company, including but not limited to: (a) SWAY App (iOS, Android); (b) official website (swayfoodapp.com and its subdomains); (c) Merchant Portal; (d) push notification service; (e) email communications; (f) customer service systems; (g) API services; (h) marketing campaigns; (i) physical membership cards (where available). This Policy does not apply to third-party websites, apps, or services linked or redirected from the service (such as Google Maps, Apple Maps, Uber, food delivery platforms), which are governed by their own privacy policies. This Policy also applies to the App launch notification list of non-members (Supplementary Article 6), to contact details of restaurants that have not registered (Supplementary Article 7), and to users of QR Ordering (including table-side QR ordering and takeout / pickup ordering) who have not registered (Supplementary Article 8).
The Company processes your personal data on one or more of the following legal bases:
The Company generally does not actively collect the following special category personal data: medical records, genetic data, sex life, criminal record, religious beliefs, political views, biometrics (fingerprints, iris). However, if you actively disclose such data in UGC, customer service messages, or report documents, the Company may process within the necessary scope and shall handle in accordance with Article 6 of the Personal Data Protection Act.
The minimum age for this service is 13 years old. The Company does not deliberately collect personal data of children under 13; if the Company becomes aware of inadvertent collection, it shall delete within a reasonable time. See Section 9.
Customer rosters uploaded by merchants: customer names or forms of address, telephone numbers, and merchant notes and tags collected by the merchant itself, uploaded by the merchant or created in the back office, for its use in identifying customers in reservation, waitlist, and seating on the Platform; see Supplementary Article 5 for details.
You are free to choose whether to provide personal data. Account identification data (an email address or a third-party login identifier) is necessary to register and to use member functions; if you do not provide it, you will not be able to register or use member functions. If you do not provide other optional data (such as your phone number, birthday, gender, dietary preferences, city of residence or address, or invoice carrier), this does not affect your use of the basic functions of the Service, but you will not be able to use the functions related to that data (for example, birthday-month offers, localized push notifications or personalized recommendations); if you do not choose an invoice carrier (mobile barcode) or donation code, your e-invoices are, as a rule, stored as described in §2.1 in an Amego member carrier that uses your account email address as the carrier number. If you refuse location permission, functions such as random recommendations and nearby restaurants will not be able to provide results based on your device's real-time location.
The Company collects, processes, and uses your personal data for the following specific purposes. Each item may use your data alone or in combination:
Where express consent is required by law (such as for marketing pushes, cross-border transfer of special category data, AI training of specific data), the Company shall obtain your consent through checkbox at checkout, settings panel toggle, or separate consent form. You may withdraw consent at any time, but withdrawal of consent only affects future processing and does not affect the legality of processing already performed based on your consent.
📌 Our Commitment and Limitation: The Company will not directly sell your raw personally identifiable information (PII) to third-party advertisers or data brokers. Advertising delivery, business intelligence, and media sharing are conducted in de-identified, aggregated, or group-characteristic form. This commitment does not restrict the Company from: (a) using de-identified or aggregated data for advertising delivery and commercial cooperation; (b) sharing personal data with necessary third parties listed in Section 4; (c) disclosing data based on legal obligations; (d) transferring data in case of business transfer, merger, investment, or acquisition.
The Company may share, disclose, or transmit your personal data to the following recipients in necessary circumstances. All external sharing follows the "minimization principle" and requires recipients to provide data protection standards equivalent to or higher than this Policy.
The following third-party service providers process your data as "Data Processors," only on the Company's instructions, and bound by individually signed or publicly available Data Processing Agreements (DPAs):
Payment-related processing is delegated to the following licensed payment providers: ECPay (credit card), Apple App Store IAP, Google Play Billing. The Company does not directly store full credit card numbers or CVV; only transaction codes, order numbers, and last 4 digits of cards are retained.
E-invoices: The Company has its e-invoices issued by Amego (光貿科技股份有限公司), an e-invoice value-added service centre approved by Taiwan's Ministry of Finance, which transmits them to the Ministry of Finance's E-Invoice Platform. For this purpose, the Company provides the e-invoice data listed in §2.1 and your account email address; the email address is used as the address for notices about the invoice (such as the issuance notice and any prize-winning notice) and, if you have not set a mobile barcode or donation code, as the carrier number of the Amego member carrier. Invoice data already issued (including the carrier number) is retained by that centre and the Ministry of Finance's E-Invoice Platform under the e-invoice regulations and is not deleted when you delete your account (see also §5.3).
When you actively bind your membership to a specific merchant via QR code or member ID, that merchant may view within the Platform interface: (a) your member ID / QR code; (b) consumption / point / redemption records with that merchant, and your reservation and waitlist records with that merchant (including the number and dates of attended visits, no-shows and cancellations); (c) reviews you submitted to that merchant; (d) your display name on the Platform (your name or a nickname; if you signed in with a Google, Apple, Facebook, X or similar account, it defaults to the name provided by that account, and you may change it in the App at any time) and your partially masked email address (for identification only; it cannot be used to contact you); (e) your birth month (only if you have entered your birthday; not including the year or day); (f) your profile photo (only if your account has one, including one provided by a third-party account you signed in with): shown when you present, at that merchant, the discount code of a Plus member exclusive discount (meaning an in-store discount that a merchant offers to Plus members bound to it and that is used by showing a discount code in the App for staff to redeem; the same applies below) and staff look it up or redeem it, so that staff can check that you are the account holder; this item applies from October 28, 2026 and does not affect how your profile photo is shown with content you publish on the Platform, such as reviews. The merchant's owner or store manager may also export from the merchant back office: (1) a member points summary, limited to the member number, the binding date, your points balance with that merchant (for a chain brand, the balance shared across the brand) and the date of the last points change at that store; and (2) a points transaction log, limited to the member number and, for each transaction, the points added or deducted, the type, the reason, the balance after the change and the time; the exported files do not contain your name, email address or phone number, and are subject to the same restrictions as this Section. In addition, that merchant may set conditions for its bound members (such as birth month, usual area, price-range habits, gender, and cuisine preferences) and have offer notifications sent by the Platform on its behalf; the merchant learns only the number of members who meet the conditions and does not obtain your contact details, usual area, price-range habits, or location coordinates. Merchants are in the position of fiduciary processors of such data, bearing protection obligations under Article 5 of the Merchant Service Agreement and Articles 4 and 27 of the Personal Data Protection Act, and shall not use such data outside the Platform.
Chain brands (this paragraph applies from October 2, 2026): If the merchant to which you have bound your membership belongs to a chain brand (multiple branches under the same brand), your membership, points and coupons are shared across all branches of that brand, and other branches of the same brand may also view the data listed in (a)–(e) above, subject to the same restrictions set out in this section.
Reservations and waitlists: When you make a reservation or join a waitlist with a merchant through the Service, that merchant may view and export the name, contact telephone number, party size, and notes you provided with the reservation, and may use them only to provide that reservation, waitlist, and seating service, and, for bound members, for viewing in their visit records under (b) above. Merchants may also record in-store notes, tags, and a contact telephone number they enter themselves for their bound members or reservation customers; such records are visible only to that merchant and are subject to the same restrictions set out in this section.
Plus membership status (this paragraph applies from October 28, 2026): Some offers can be claimed or used only by SWAY Plus members, including Plus-only coupons (coupons that a merchant has set to be claimable only by Plus members) and Plus member exclusive discounts, so a merchant may learn whether you are a Plus member in the following ways: (i) when you present your member code at a merchant's counter (for example, to collect points, redeem a coupon or redeem a reward), the staff lookup screen (including a POS system connected by that merchant) lists your unused coupons at that merchant (including branches of the same brand that may redeem them under the chain-brand paragraph above), and if they include a Plus-only coupon, that merchant will know that you were a Plus member when you claimed it; (ii) when you present the discount code of a Plus member exclusive discount, that merchant will know whether you are a Plus member at that time; (iii) once such a coupon or discount is redeemed, the redemption record (including the name of the coupon or discount and your member ID) forms part of the redemption records in item (b) of the first paragraph of this section and is kept in that merchant's back-office activity log, and that merchant's statistics for Plus member exclusive discounts also list the members who have redeemed them most often (display name and partially masked email address). However, claiming or using one during a period in which the Company opens Plus-only coupons or Plus member exclusive discounts to all members (for example, before Plus goes on sale) does not mean that you were a Plus member at that time. Except as described above, the Company does not tell merchants whether any individual member is a Plus member.
The Company may disclose your personal data in the following circumstances (potentially without prior notice) under applicable law:
Application Method: You may execute self-service deletion in the App: "Profile" (bottom navigation bar) → "Settings" → scroll to "Danger zone" at the bottom → red "Delete account" button → confirmation dialog "Delete your account?" → "Confirm delete", or submit a written application by email to support@swayfoodapp.com (Members) / merchant@swayfoodapp.com (Merchants).
Processing Flow:
Email hash values: From T+0 until T+30, the Company keeps the values obtained by hashing, with a secret key, your original email address and its normalized form described in §3.5 (these values cannot be converted back into the email address). The former is used to check any restoration request (§5.4) or request to exercise your rights that you make during this period; from October 28, 2026, both are also used to determine that an account registered during this period with the same email address (in any of its different forms) belongs to the same person as you, so that the account does not receive new-member benefits or other once-per-person benefits under §3.5 again. These values are deleted after T+30.
When you sign in with Apple, we store the authorization credential provided by Apple in encrypted form and use it solely to notify Apple, when you delete your account, to revoke the authorization granted to the Service; the credential is deleted once the revocation is complete (no later than 7 days after you delete your account).
Notwithstanding your exercise of the right to deletion, the Company may continue to retain all or part of relevant data in the following circumstances to perform legal obligations or protect legitimate interests:
Data retained under the above exceptions shall be processed on the minimization principle, used only to the necessary extent, and does not affect the Company's lawful retention status of such data.
Within 30 days of account deletion, you may apply for restoration by emailing the Company's customer service; after 30 days, restoration is not possible because the data has been progressively deleted at the technical level. With respect to your restoration request, the Company shall consider it in good faith in accordance with the Personal Data Protection Act, and shall not refuse it absent a statutory or legitimate ground (such as the data being irrecoverable, the rights of third parties, or a legal retention exception); if refused, the Company shall notify you in writing or by email with specific reasons, and you may, under the Personal Data Protection Act, file a complaint with the Company's central competent authority for the industry (currently the Ministry of Digital Affairs) or the municipal or county (city) government (once the Personal Data Protection Commission begins operating in accordance with law, through the channels it announces), or seek remedies in accordance with law.
Records of you blocking other users in the App are part of your personal preferences, stored only in your account, and not publicly displayed or shared with the blocked third party. The retention period of block records is consistent with the lifecycle of your account; you may unblock at any time in the App under Profile → Advanced settings → Community safety → My block list. See Community Guidelines Article 10 for the detailed mechanism.
Customer rosters uploaded by merchants: deleted immediately when the merchant deletes them itself; where a merchant account is suspended, rejected, or terminated, deleted after notice and an export period of not less than 30 days; where a merchant account is deleted, purged after the 30-day restoration window has expired. Where the head office of a chain brand temporarily closes one of its branches, this is not a suspension, rejection or termination: that branch's roster is kept during the closure and cannot be viewed or used by the merchant (see Supplementary Article 5). Audit records of import operations (not containing the content of the roster) are retained for 5 years.
Under Article 3 of the Personal Data Protection Act and (where applicable) the GDPR, you may exercise the following rights regarding your personal data:
Your above rights may be limited or refused in the following circumstances; where the Company limits or refuses them, it shall notify you of the reasons in writing (including by email):
You may exercise your rights through any of the following methods:
[Personal Data Rights] Request Type - Account ID, and provide: identity verification information, specific request scope, and desired processing outcome.The Company handles your requests in accordance with Article 13 of the Personal Data Protection Act and, where applicable, Article 12(3) of the GDPR, and the periods in items (1) and (2) below are counted in calendar days: (1) for requests under Article 10 of that Act to inquire about or review your personal data or to be provided with copies of it, the Company shall decide whether to grant or deny the request within 15 days of accepting it; where necessary, this period may be extended once by no more than 15 days, and the Company shall notify you of the reason for the extension in writing; (2) for requests under Article 11 of that Act to supplement or correct your personal data, to stop its collection, processing or use, or to delete it, the Company shall decide whether to grant or deny the request within 30 days of accepting it; where necessary, this period may be extended once by no more than 30 days, and the Company shall notify you of the reason for the extension in writing; (3) for requests under the GDPR for data portability, objection to processing, or withdrawal of consent in writing, the Company shall handle the request within one month of receiving it; where necessary, this period may be extended once by no more than one month, and the Company shall notify you in writing of the reason for the extension within one month of receiving the request. If you withdraw consent or refuse personalised advertising yourself in the App under "Settings" or by the methods in §8.3, this takes effect immediately. The Company's response may be in the form of providing data, refusal with stated reason, or request for additional verification.
If you are not a SWAY member but find that a merchant has uploaded your data to the Platform, please write to support@swayfoodapp.com with the subject line: [Roster Inquiry / Deletion] Restaurant Name - Last Four Digits of Your Telephone Number. Because the collector of such data is that merchant, the Company will forward the matter to that merchant for handling within 3 business days and cooperate in carrying it out. To protect your data, we will ask you to provide material sufficient to show that you hold that telephone number (for example, a telephone bill with other information masked), or we will contact you at that number to confirm, before accepting the request; before confirmation is complete, we will neither confirm nor deny to any person whether a given number exists in any merchant's list.
The Company adopts reasonable technical and organizational security measures appropriate to data risks to protect your personal data:
Despite the Company's best efforts to protect your data, network transmission and electronic storage cannot guarantee 100% security. You shall safeguard your account password, third-party OAuth credentials, and QR codes, and not share with others. Losses caused by your account management failures shall be borne by you (see Terms of Service §3.3).
The Company's official website and App WebView components use the following Cookies and similar technologies:
Within the SWAY App, the Company also uses the following identification technologies:
The Company's website currently does not respond to the browser Do Not Track (DNT) signal, as the industry has no unified standard. You may exercise your preferences through the methods in §8.3.
The minimum age for use of the Service is 13 years old. The Company does not deliberately collect personal data of children under 13. Upon discovery of inadvertent collection, the Company shall delete and terminate the account within a reasonable time. Parents / guardians who discover that a child under 13 is using the Service should immediately contact support@swayfoodapp.com to report.
Minors aged 13 (inclusive) to 18 (exclusive) using the Service (especially for posting UGC, binding merchants, paid purchases, push subscriptions, social interaction) shall obtain prior consent from the legal representative. The Service displays a notice of this requirement at registration. The legal representative may exercise the rights set out in §9.3. The legal representative's liability for damages is governed by Article 187 of the Civil Code and §3.1 of the Terms of Service.
Deletion requests by minors or their legal representatives shall be prioritized within 7 working days, but still subject to the legal and legitimate interest retention exceptions in §5.3 (such as payment disputes, litigation, report cases).
Due to the global distribution of data centers of the technical service providers the Company relies on, your personal data may be stored, processed, and transmitted in the following regions (including but not limited to):
The Company adopts the following safeguards for cross-border transfer:
By using the Service, you consent to the Company's cross-border transfer for the above purposes. You may withdraw such consent at any time in accordance with the Personal Data Protection Act; however, transfers lawfully conducted prior to withdrawal shall not be affected. If you do not consent to cross-border transfer, you may cease use of the Service and exercise your right of deletion under Section 6.
11.1 The Company reserves the right to amend this Policy at any time. Amended versions shall be published on this page with updated "Last Updated date."
11.2 Material Changes (including substantial expansion of data collection scope, addition of sharing recipient categories, change of cross-border transfer regions) shall be announced 7 days before effective date by the methods of notice in §8 of the Terms of Service. Non-Material Changes (including text refinement, section number adjustments, typo corrections, supplements consistent with the spirit of this Policy) may take effect immediately upon publication, without prior notice obligation.
11.3 After an amended version has been published or notified and has taken effect under 11.2, your continued use shall be deemed consent to its content within the scope disclosed in the amended Policy; however, where an amendment involves use beyond the specific purpose or any other matter that by law requires your separate consent, the Company will obtain your separate consent, and continued use will not be deemed consent. If you do not agree, you may stop using the Service and exercise the right of deletion under §6.3; stopping use is not your only remedy, and your rights under the Personal Data Protection Act and other laws (including the rights listed in §6) are not affected.
11.4 Version Application: for the handling of specific disputes or complaints, the version of the policy at the time of the event or application date shall apply; not the version at the time of registration or earliest use.
For any privacy-related inquiries, complaints, or data rights exercise requests, please contact:
The Company will, in principle, send an initial reply within 5 working days; requests to exercise your rights will still be handled within the periods set out in §6.4.
If you have concerns about the Company's privacy processing, you may raise them with the Company at any time, and you may also file complaints with the Company's central competent authority for the industry (currently the Ministry of Digital Affairs), the municipal or county (city) government, or the Consumer Protection Authority (once the Personal Data Protection Commission begins operating in accordance with law, through the channels it announces), or (for GDPR-applicable data subjects) the Data Protection Authority of your jurisdiction.
The following supplementary clauses have legal effect equivalent to all other clauses of this Policy; in case of conflict between this section and any preceding section, this section shall prevail (Supplementary Articles 1 to 4 were added at SWAY V1's official launch in May 2026).
Some partner merchants upload the customer rosters they have collected themselves to the Platform, or add them record by record in the merchant back office, so that they can identify their own customers within SWAY's reservation, waitlist, and seating functions. These customers do not need to have, and will not thereby obtain, a SWAY account.
・Data categories: the customer's name or form of address, contact telephone number, the notes and tags entered by that merchant itself (for example: regular, vegetarian, no peanuts), and the creation and update times.
・Data source: uploaded by that merchant from its existing customer records (such as a previous reservation system or in-store paper records), or entered by that merchant itself in the back office.
・Status of the parties: with respect to this category of data, the collector is that merchant, and the Company merely stores it as entrusted by that merchant and makes it available to that merchant for inquiry in its own back office. The Company will not provide this data to other merchants, will not merge it into SWAY's member database, will not match it against or identity-link it to SWAY member data, will not use it for any marketing or push notifications, and will not use it for model training or statistical analysis. The sole exception to the foregoing no-matching commitment is: when a SWAY member deletes their account under §5.2, the Company uses the telephone number that member registered on the Platform to delete data with the same telephone number from each merchant's roster, and notifies the merchants concerned only that "one record in the roster has been deleted at the data subject's request", without telling the merchant that the data subject is a SWAY member.
・Representations of the uploading merchant: the uploading merchant must represent to the Company that such data was lawfully collected by it directly from customers in the course of its business, that it has performed its statutory notification duty toward the data subjects and obtained their consent or has other statutory grounds, and that the data does not contain special categories of personal data such as medical records, medical treatment, or health examinations.
・Storage and outsourcing: such data is stored in the facilities of the Company's cloud service providers, which may be located outside the Republic of China, currently including Japan, the United States, and the service providers' global redundancy nodes. The categories of sub-processors used by the Company are: cloud database and authentication services, application server hosting services, network and information security services, database backup storage services, and code version control and automation services.
・Retention period: the same as the period during which that merchant's account subsists. The data is purged as soon as the merchant deletes it itself; where a merchant account is suspended, rejected, or terminated, the Company deletes it after giving notice and providing an export period of not less than 30 days, with one further reminder 7 days before deletion; where a merchant account is deleted in its entirety, the data is purged after the 30-day restoration window has expired. Where the head office of a chain brand temporarily closes one of its branches, this is not a suspension, rejection or termination: that branch's roster is kept during the closure and cannot be viewed or used by the merchant; it becomes available again when the branch is reopened, or, if that branch's account is deleted, it is purged after the 30-day restoration window has expired; if you exercise the rights below during the closure, the Company will treat the head office of that brand as the party to be informed and notified.
・Operation records: the Company additionally records the operation record of each import, addition, and deletion (the merchant employee account performing the operation, the time, the number of records, the version of the statement consented to, and the source IP address), for audit and evidentiary purposes, with a retention period of 5 years. Such records do not contain the content of the roster.
・Your rights: if you find that a restaurant has uploaded your data to SWAY, you may contact that restaurant directly, or write to support@swayfoodapp.com. Because the collector of such data is that merchant, we will forward the matter to that merchant within 3 business days and cooperate in handling it, and will at the same time tell you which merchant uploaded it; where that merchant takes no action within 7 days after we forward the matter, we may cease processing or delete that record directly. However, where you request deletion and confirmation has been completed as described below, we may delete that record directly without waiting for that merchant to act, and will notify that merchant. If you do not know which merchant uploaded your data, we may, after confirmation is complete, search each merchant's list using your telephone number, and will tell the result only to you. To protect your data, we will ask you to provide material sufficient to show that you hold that telephone number (for example, a telephone bill with other information masked), or we will contact you at that number to confirm, before accepting the request; before confirmation is complete, we will neither confirm nor deny to any person whether a given number exists in any merchant's list.
・Please note: reservation and waitlist records you previously completed through SWAY or that restaurant are data separately collected by the Company under this Policy, and their deletion is handled per Sections 5 and 6. When we respond to you, we will explain what has been deleted, what is retained as required by law, and the reasons therefor.
This restaurant, in order to provide reservation and seating services, uses the customer management system provided by "SWAY CO., LTD. (SWAY)" to hold your name, telephone number, and the service notes and tags recorded by this restaurant. That data is collected by this restaurant and this restaurant is responsible for it; SWAY merely holds it as entrusted by this restaurant, will not use it for marketing, and will not provide it to other stores. The data may be stored in the facilities of this restaurant's outsourced service providers located outside the country (Japan, the United States). You may at any time inquire of, correct, or request deletion from this restaurant; contact: [restaurant telephone number].
(This Article applies from September 25, 2026. It concerns only people who are not SWAY members.)
(This Article applies from September 25, 2026. It concerns only restaurants that have not registered on the Platform.)
(This Article applies from November 4, 2026, except that the parts concerning takeout / pickup ordering apply from November 5, 2026; it applies to both Members and non-members. "QR Ordering" in this Article includes table-side QR ordering and takeout / pickup ordering; see Section Y.7 of the Terms of Service for details.)
If you upgrade to Plus through the official website with an ECPay credit card, billing is processed through ECPay's recurring billing service; purchases made through the Apple App Store / Google Play are instead charged through that store's auto-renewal mechanism, not through ECPay. The system charges automatically as agreed every month (Monthly plan), every six months (Semi-Annual plan) or every year (Annual plan). If you subscribed through the official website, you may cancel renewal at any time on the "Membership" page in the App or on the official website; if you subscribed through the Apple App Store / Google Play, please cancel in that store's subscription settings. After cancellation, entitlements continue until the end of the current period and no charge is made for the next period.
Refund Policy: Refunds for the Service are governed entirely by the Refund and Cancellation Policy. Please read the full Policy before purchase. In conflicts between this Policy and that Policy, that Policy shall prevail.
This Policy Version 3.5 was published on October 28, 2026; the content amended in Versions 3.4 and 3.5 takes effect on November 5, 2026; the content added in Version 3.1 still takes effect on November 4, 2026, and the parts that earlier versions set to take effect on November 1, 2026 (Google AdSense) keep that effective date. Changes in Version 3.5: Supplementary Article 8 adds, for takeout / pickup ordering, the pickup name and phone number (the full number or the last three digits). They are collected only where the store chooses to collect them (including where the store enters them for you when you order by phone); whether to collect them is decided by the store, which is responsible for them, and the Company keeps and transmits them on the store's behalf; they are used only to let the store verify the person picking up and contact you about that order; they are deleted within 30 days after the order is picked up, voided, or cancelled (or within 30 days after submission if the order is never completed); and if the store makes them required, you cannot submit a takeout / pickup order without them. The descriptions of recipients (including a chain brand headquarters that manages the store as its owner) and rights are amended accordingly. This amendment substantially expands the scope of data collection and is a material change under §11.2; under §11.2, notice is given 7 days before it takes effect by the notification methods in §8 of the Terms of Service, and it takes effect on November 5, 2026.
Previous Version 3.4 was published on October 28, 2026; the content amended in Version 3.4 takes effect on November 5, 2026.
Changes in Version 3.4: (1) the title of Supplementary Article 8 is changed to "Table-Side QR Ordering and Takeout / Pickup Ordering", and the Article now covers takeout / pickup ordering (which may be used outside the store), adding the pickup number, whether the order is for dine-in or takeout, the pickup time you choose and the actual pickup time collected for it, together with their purposes, recipients (including Cloudflare bot verification), retention period and the consequence of blocking Cookies, and states that the Company still does not collect your name, phone number, email address or location; (2) the scope of bot verification in §3.5 is extended to takeout / pickup ordering; (3) §1.3, §5.1 and §8.1 are amended accordingly. Because these amendments substantively expand the scope of data collection, they are a Material Change under §11.2; in accordance with §11.2, notice is given 7 days before they take effect by the methods of notice in §8 of the Terms of Service, and they take effect on November 5, 2026.
Previous Version 3.3 was published on October 28, 2026 and takes effect on the same day.
Changes in Version 3.3: §4.3 adds that a bound merchant may view your reservation and waitlist records with that merchant (including the number and dates of attended visits, no-shows and cancellations), and the "Reservations and waitlists" paragraph states the purpose of that use. This item clarifies the scope of bound-member data within the existing Service, does not add categories of data collected or categories of sharing recipients, and is a Non-Material Change under §11.2 that takes effect on the date of publication.
Previous Version 3.2 was published on October 28, 2026 and takes effect on the same day.
Changes in Version 3.2: (1) the opening "Important Notice and Consent" deletes the wording "unconditional agreement" and now asks you to read this Policy before use; by registering for or using the Service, you acknowledge that you have been informed of this Policy and consent, within the scope disclosed in this Policy, to the Company collecting, processing and using your personal data in accordance with this Policy; for matters that by law require your separate consent (such as use beyond the specific purpose), the Company will obtain your separate consent, which you may withdraw at any time; (2) §5.2 T+0 now states that deleting your account does not affect your right under the Refund and Cancellation Policy to a full refund of an official-website subscription within 7 days, or any other refund you are entitled to under that Policy (which you may still request after deletion by emailing support@swayfoodapp.com with your order number); for subscriptions purchased through the official website (ECPay credit card), the Company stops all subsequent automatic renewal charges on the day of deletion and refunds in full any charge made afterwards; subscriptions purchased through the Apple App Store or Google Play must be cancelled by you in the subscription settings of the respective store; (3) "Personal Data Protection Commission" in the lists of authorities in §3.6 and §4.5 is changed to "authorities competent for personal data protection"; in §5.4, §6.1 and §12, the authority with which complaints may be filed is corrected from the Personal Data Protection Commission, which has not yet begun operating, to the Company's central competent authority for the industry (currently the Ministry of Digital Affairs) or the municipal or county (city) government (once the Personal Data Protection Commission begins operating in accordance with law, through the channels it announces); §12 also deletes the condition that a complaint may be filed only after first contacting the Company without satisfactory response; (4) §11.3 now provides that, after an amended version has been published or notified and has taken effect under §11.2, your continued use is deemed consent to its content within the scope disclosed in the amended Policy, and that where an amendment involves use beyond the specific purpose or any other matter that by law requires your separate consent, the Company will obtain your separate consent and continued use will not be deemed consent. All of these amendments add to your rights, narrow the Company's claims or correct errors, and do not expand the scope of data collection, add categories of sharing recipients or change cross-border transfer regions; they are therefore Non-Material Changes under §11.2 and take effect on the date of publication under §11.2.
Previous Version 3.1 was published on October 28, 2026; the content added in Version 3.1 takes effect on November 4, 2026, and the effective dates of all other provisions and those set by earlier versions remain unchanged.
Changes in Version 3.1: (1) new Supplementary Article 8, "Table-Side QR Ordering", is added (data collected, purposes, recipients, retention, regions and method, consequence of not providing data, and rights); (2) §1.3 adds users of QR Ordering who have not registered; (3) §4.1 adds recognition of merchant menu photos to the purposes for which AI service providers are used; (4) §5.1 adds the retention period for table-side QR Ordering data; (5) §8.1 adds sway_dine to the Necessary Cookies. Because these amendments substantively expand the scope of data collection, they are a Material Change under §11.2; in accordance with §11.2, notice is given 7 days before they take effect by the methods of notice in §8 of the Terms of Service, and they take effect on November 4, 2026.
Previous Version 3.0 was published on October 25, 2026 and takes effect on the same day.
Changes in Version 3.0: (1) §6.2 now provides that where the Company limits or refuses the exercise of your rights, it shall notify you of the reasons in writing (including by email); (2) §6.2 deletes the provision allowing administrative fees to be charged for clearly unmeritorious, excessively frequent, harassing or malicious requests, and instead provides that, under Article 14 of the Personal Data Protection Act, the Company may charge a fee limited to the necessary costs only for inquiries, requests to access and requests for copies, and that requests to supplement or correct data, to cease collection, processing or use, or to delete data are always free of charge; all of these amendments are in favor of users and therefore take effect on the date of publication.
Previous Version 2.9 was published on October 24, 2026 and takes effect on the same day. Changes in Version 2.9: the names of the paid merchant plans listed in Supplementary Article 4 are updated, in line with Version 3.2 of the Merchant Service Agreement, to Plus Merchant, chain plans and Enterprise (the names of the former Chain Lite and Chain Pro plans are deleted); this amendment only updates plan names, and the collection, processing, use and sharing of personal data are all unchanged.
Previous Version 2.8 was published on October 24, 2026 and takes effect on the same day, except that item (1) of the Version 2.8 changes below (Google AdSense) takes effect on November 1, 2026 (as a material change adding a category of recipients under §11.2, notice is given 7 days before it takes effect in accordance with that Section); the revisions in Version 2.7 and earlier versions continue to apply from the effective dates stated for them below. Changes in Version 2.8: (1) §1.4, §3.4, §4.4, §8.1 and §8.3 add that the web version of the SWAY App (app.swayfoodapp.com) shows third-party Google AdSense ads to free members: third party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites; Google and its advertising partners receive your IP address, browser and device information, the URL of the page you are viewing and ad interaction data; before ads are first shown in the web version you are asked whether you accept personalized ads, only non-personalized ads are shown until you choose, and you may change your choice at any time under "Settings → Privacy settings → Ad privacy options"; for users in the European Economic Area (EEA), the United Kingdom or Switzerland, ads are loaded only after a choice is obtained through a Google-certified consent management platform; SWAY Plus members (including members who received Plus as a registration gift) are not shown Google AdSense ads; such ads are not shown on the official website or in the merchant back office; this item takes effect on November 1, 2026; (2) §4.1 adds Cloudflare Web Analytics (traffic statistics for some pages of the official website, which does not use Cookies or store data on your device and produces only aggregated statistics), and the Analytics Cookies item in §8.1 is supplemented accordingly; (3) §4.3 states that the merchant's owner or store manager may export from the merchant back office a member points summary and a points transaction log (limited to the member number, binding date, points balance and points changes), and that the exported files do not contain your name, email address or phone number; (4) T+0 in §5.2 now provides that accumulated store points can no longer be used from the day of application, that if you restore your account within 30 days under §5.4 your accumulated store points are restored together with the account (you will need to bind to each merchant again), and that they are lost only if the account is not restored within that period; (5) §9.2 deletes "The act of registration shall be deemed consent obtained", replacing it with a notice of this requirement displayed at registration, and provides that the legal representative's liability for damages is governed by Article 187 of the Civil Code and §3.1 of the Terms of Service; §9.3 deletes the 90-day no re-registration undertaking, provides that a payment made by a minor without the legal representative's permission may be refunded on request under §2.8 of the Refund and Cancellation Policy, allows parts of the documents required to delete an account that are unrelated to the proof to be redacted, and provides that documents submitted are deleted within 30 days after processing is complete. Items (2) to (5) describe existing processing or add to your rights, do not expand the scope of data collection or add a category of recipients, and take effect on the publication date under §11.2.
Previous Version 2.7 was published on October 14, 2026 and takes effect on the same day, except that the amendment to §12 and items (5) to (9), (11) and (15) of the Version 2.7 changes below take effect on October 28, 2026. Changes in Version 2.7: (1) in §12, "the Company's privacy team shall provide initial reply within 5 working days" is changed to "the Company will, in principle, send an initial reply within 5 working days", and it is made clear that requests to exercise your rights are still handled within the periods set out in §6.4; the periods in §6.4 under Article 13 of the Personal Data Protection Act are unchanged; (2) §2.1 ("E-invoice data"), §2.7 and §4.2 now state that the Company has its e-invoices issued by Amego (光貿科技股份有限公司), an e-invoice value-added service centre, that when an e-invoice is issued your account email address is sent to that centre as the address for notices about the invoice (such as the issuance notice and any prize-winning notice), that, if you have not set a mobile barcode or donation code, that email address is used as the carrier number of an Amego member carrier in which the invoice is stored (you may switch to a mobile barcode or donation at any time in the web version of the Service), and that invoice data already issued is retained by that centre and the Ministry of Finance's E-Invoice Platform as required by law and is not deleted when you delete your account; the heading of §4.2 is changed to "Payment, Financial and E-Invoice Service Providers"; this item does not add any data collected, is a use within the invoice-issuance purpose stated in §3.1, the recipient is the e-invoice value-added service centre already stated in §2.1, and it is published before the Company begins such processing, so it applies from the date of publication under §11.2; (3) §2.2, §5.1 and §8.2 correct and clarify the device and anti-fraud data to reflect actual practice: the random device code generated by the App itself is replaced when the App is reinstalled, is sent by the SWAY App when your account is synced as you sign in or open the App, and is not sent by the web version; its purposes include determining whether the same person is obtaining a once-per-person benefit again; and after account deletion, the device records are retained under §5.3, may be used only for investigating the disputes, fraud or violations listed in §5.3 and for legal claims, and are no longer used to determine whether other accounts belong to the same person as you; this item does not add any data collected, is a use within the purposes of detecting account abuse and multiple accounts stated in §3.5, and applies from the date of publication under §11.2; (4) §3.1 adds "Review invitations after a visit"; §3.5 adds explanations of "Once-per-person benefits" (comparison of different ways of writing an email address and of the same device, and a manual review if you believe you have been wrongly determined) and "Authenticity of in-store scans and reviews" (the times of the scan and of the review, when the account was registered, IP address, in-store records, and the use of email addresses and back-office sign-in status to identify merchant insiders); §5.1 adds the retention period of review invitation records; §5.2 adds that hash values of email addresses are kept from T+0 to T+30 and then deleted, and are used to check restoration requests or requests to exercise your rights; §5.5 and Supplementary Article 5 add how rosters are kept when the head office of a chain brand temporarily closes a branch; this item does not add any data collected or any recipient, and describes existing practice or is a use within the purposes stated in §3.1, §3.5 and Supplementary Article 1, so it applies from the date of publication under §11.2; (5) §2.2, §3.5, §5.1, §8.2 and Supplementary Article 1: the SWAY App sends a device identifier that stays the same after reinstallation (on iOS, a random code generated by the App itself and kept in the device's Keychain; on Android, the value obtained by hashing on the device the device identifier provided by the system [ANDROID_ID], with only the hash value sent), and sends the device identifier or device code when you scan a code in store or write a review, to determine whether the same person is obtaining a once-per-person benefit again and to confirm the authenticity of in-store scans and reviews; the device identifier or device code contained in in-store scan records is anonymized after 90 days; (6) §3.5 and §5.2: for 30 days after account deletion, hash values of your original email address and of its normalized form are used to determine that an account registered during this period with the same email address (in any of its different forms) belongs to the same person as you, so that the account does not receive new-member benefits or other once-per-person benefits again; (7) §3.5, §4.1 and Supplementary Article 6: some forms of the Service that can be submitted without signing in may use Cloudflare Turnstile bot verification, and Cloudflare also uses the information processed during verification in its own name to improve its bot detection; (8) §4.3 adds item (f): when you present the discount code of a Plus member exclusive discount, that merchant's staff may see your profile photo to check that you are the account holder; (9) §4.3 adds "Plus membership status": a merchant may learn whether you are a Plus member from Plus-only coupons listed on the counter lookup screen, from Plus member exclusive discounts you present, and from their redemption records; (10) §5.2 adds: when you sign in with Apple, the Company stores the authorization credential provided by Apple in encrypted form and uses it solely to notify Apple, when you delete your account, to revoke the authorization granted to the Service, and deletes the credential once the revocation is complete (no later than 7 days after you delete your account); (11) §3.1, §3.4, §4.4, §8.3 and Supplementary Article 3: SWAY Plus members (including members who received Plus as a registration gift) are not shown Google AdMob or other third-party advertising; from October 28, 2026, ad slots purchased by merchants within the platform (full-screen launch ad, top banner, scrolling carousel, labeled "#Sponsored") are also shown to Plus members, and their impression and click records are handled under §3.4; before October 28, 2026, such ad slots are not shown to SWAY Plus paying members, and for Plus subscriptions paid before October 28, 2026 the same applies until the end of the paid period, after which §6.2 of the Refund and Cancellation Policy applies; (12) in the official (Traditional Chinese) version, the wording for children in §2.5 and §9.1 is corrected from "13 years old and under" to "under 13", consistent with the minimum age of 13 (this translation already read "under 13"); (13) the "Push notifications" item in §3.1 is corrected: promotional push notifications such as store offers, new-store news and personalized recommendations are sent only after you turn on "Store offers & restaurant picks (push)" in the App, and you may withdraw this at any time in App "Settings"; for other push notifications and in-app messages, you may turn them off or choose not to receive marketing messages (opt-out); this is consistent with §1.4 and actual practice, is a correction more favorable to you, and takes effect on the date of publication; (14) the "Service Hours" item in §12 is deleted and replaced with a statement that inquiries are accepted by email. Items (5) to (9) and item (11) are material changes under Section 11.2, and notice of them is given under Section 11.2 7 days before they take effect.Further change in Version 2.7: (15) the retention of "UGC" in §5.1 is corrected from "retained in the Company's backup system for 90 days for restoration and legal evidence" to the following, consistent with the Company's actual practice: no longer publicly displayed once you delete it; records marked as removed in the database are kept as necessary to handle reports, complaints, disputes and legal evidence; backups are kept for 29 days under Section 7. This item is a material change under Section 11.2; notice of it is given under Section 11.2 7 days before it takes effect, and it takes effect on October 28, 2026.
Prior Version 2.6 was published on September 29, 2026. Among the changes in Version 2.6, all items other than items (5), (6) and (7) are corrections and clarifications and apply from September 29, 2026; items (5), (6) and (7) take effect on October 6, 2026; the revisions in Version 2.5 and earlier versions continue to apply from the effective dates stated for them below. Changes in Version 2.6: (1) §2.1: the phone number is corrected to optional (the Service does not verify phone numbers by SMS), and §4.1: Twilio and OpenAI, which the Service does not use, are removed, and OpenAI is likewise removed from §3.9 and §10.1; (2) §2.2, §3.5, §5.1, §8.2 and Supplementary Article 1: the device and anti-fraud data are corrected to what is actually collected — a random device code generated by the App itself, the browser type, interface language and screen size when you scan a code in store, and IP address and login records — and Canvas fingerprinting, font lists, emulator and VPN / proxy detection, and behavioral biometrics, which the Service does not collect, are removed; (3) a new §2.7 "Consequences of Not Providing Personal Data" is added; (4) §4.1 adds that Cloudflare stores the daily database backups (R2) and that GitHub runs the automated daily database backup job, and Supplementary Article 5 correspondingly adds database backup storage services and code version control and automation services to the categories of sub-processors (consistent with Article 5.6.12(a) of the Merchant Service Agreement); (5) §4.3(d) corrects what merchants may view to your display name (your name or a nickname; for accounts signed in through a third-party account, it defaults to the name provided by that account), and corrects the legal basis of merchants' protection obligations to Articles 4 and 27 of the Personal Data Protection Act; (6) §4.3 adds "Reservations and waitlists": when you make a reservation or join a waitlist, that merchant may view and export the name, contact telephone number, party size and notes you provided, and may record in-store notes, tags and a contact telephone number it enters itself for its bound members or reservation customers; (7) §5.1 corrects the description of the retention of location data: location coordinates recorded in server-side records (search records, restaurant browsing and interaction event records, and the location when a "Group pick" vote is created) are stored together with your member ID and are cleared after no more than 90 days; (8) §6.1 adds the right to request copies and changes the "right of rectification" to the "right to supplement or correct"; (9) §6.4 and Supplementary Article 5: the way a non-member's identity is confirmed when asking about or requesting deletion of merchant roster data is corrected from an SMS verification code to providing material sufficient to show that you hold the telephone number, or the Company contacting you at that number to confirm; (10) §7 corrects the data security measures to reflect actual practice (member passwords are stored by the Supabase authentication service; weekly automated checks of software dependencies for known vulnerabilities; daily backups automatically deleted after 29 days) and removes the statements on penetration testing, SIEM monitoring, geographically distributed storage, automatic failover, employee non-disclosure agreements and employee duty separation; (11) §10.2 corrects the authority that may restrict international transfers under Article 21 of the Personal Data Protection Act to the central competent authority for the industry (the Ministry of Digital Affairs); (12) the English, Japanese, Korean and Simplified Chinese translations are corrected to match the Traditional Chinese original (the content of the original is not changed by these corrections); (13) §2.2 corrects the device and network information to what is actually collected: the app installation source and ISP, which the Service does not collect, are removed, the processor information is corrected to the number of processor cores and the approximate memory capacity, it is explained that these and the connection type are obtained only when the error and performance monitoring service (Sentry) takes samples, and browser type and version are no longer limited to the website; (14) §3.5 corrects the statements on account security and anomaly detection to reflect actual practice: two-factor authentication, which is not offered for ordinary accounts, and cross-region login, device anomaly, location forgery and bot detection, which are not carried out, are removed, and the detection actually carried out is listed instead; (15) §5.1 corrects the description of the retention of device and anti-fraud data: it is retained for as long as necessary for prevention, no automatic deletion period is currently set, and after account deletion the record linking the random device code is no longer used to restrict that device from registering other accounts; it also clarifies that records of operations performed by merchant accounts in the back office are not subject to the de-identification of behavioral logs; (16) §5.5 corrects the in-App path for unblocking; (17) §8.2 corrects the description of SDKs: the App uses error and performance monitoring, push and advertising SDKs, and does not use third-party analytics SDKs, anti-fraud SDKs or Pixels; (18) Supplementary Article 5, in line with Articles 5.6.4(e) and 5.6.6 of the Merchant Service Agreement, adds the sole exception under which, when a SWAY member deletes their account, data with the same telephone number is deleted from each merchant's roster using that member's telephone number (merchants are told only that "one record in the roster has been deleted at the data subject's request", without disclosing that the person is a SWAY member), and adds that, where you request deletion and confirmation is complete, the Company may delete the record directly without waiting for the merchant to act, and that, where you do not know which merchant uploaded your data, the Company may, after confirmation, search each merchant's list using your telephone number and tell the result only to you; (19) the "Recurring Auto-Renewal Notice" corrects how subscriptions made through the official website (ECPay credit card) and through the Apple App Store / Google Play are charged and how their renewal is cancelled, consistent with the Terms of Service; (20) §9.3 states that §2.8 of the Refund and Cancellation Policy does not apply to a full refund requested within 7 days under §2.2.1 of that Policy, and that the 90-day no re-registration undertaking may be required only in the cases under §2.8, consistent with that Policy; (21) the OAuth login methods for account identification data in §2.1 now include X (Twitter), consistent with §2.3; (22) §11.3 deletes the statement that stopping use is your "sole remedy", and states that stopping use is not your only remedy and that your rights under the Personal Data Protection Act and other laws are not affected, consistent with Section 21.3 of the Terms of Service; (23) §2.3 adds "LINE account linking", and §4.1 and §8.1 are corrected accordingly: the Service does not offer registration or login with a LINE account; only if you choose to link a LINE account in the APP does the Company obtain your LINE user identifier through LINE Login, used to link your account; the display name, profile photo and other profile information that LINE may also provide within the authorized scope are not stored by the Service; and you may unlink at any time. Items (5), (6) and (7) are material changes under Section 11.2, and notice of them is given under Section 11.2 7 days before they take effect.
Prior Version 2.5 (last updated September 25, 2026), effective October 2, 2026 (Version 2.4 applies on October 1, 2026; Version 2.3 continues to apply through September 30, 2026; however, each item of the correction within the same version on September 25, 2026 described below applies from the date of publication, regardless of the periods during which the versions above apply). The Version 2.5 revision is a material change under Section 11.2 (a new category of recipients), and notice of it has been given through the in-app message center 7 days before it takes effect: §4.3: if the merchant to which you have bound your membership belongs to a chain brand, your membership, points and coupons are shared across that brand's branches, and other branches of the same brand may also view your membership data with that brand. Version 2.4 is effective October 1, 2026; its revision is also a material change under Section 11.2, and notice of it has been given through the in-app message center 7 days before it takes effect: (1) §2.1 and §4.3: merchants to which you have bound your membership may view your birth month (not including the year or day), as well as your nickname and partially masked email address (for identification only); merchants may set conditions for their bound members and have offer notifications sent by the Platform on their behalf, and merchants learn only the number of members; (2) §2.2 adds "Inferred usage habits": your usual area (down to the township / district level) and price-range habits are inferred from the restaurants you click on, save to favorites, navigate to, or whose menus you browse; (3) §3.2 adds the corresponding purposes of use.
Correction within the same version on September 25, 2026: (1) Supplementary Article 6 "App Launch Notification List" and Supplementary Article 7 "Contact Details of Prospective Partner Restaurants" are added; both concern only data of people who are not members and apply from the date of publication; (2) pointers to these two Articles are added to §1.3 and §5.1, and the introduction to the supplementary clauses is corrected; (3) the paragraph at the end of §2.5 on customer rosters uploaded by merchants now stands as §2.6 (its content is unchanged except that its cross-reference now points to Supplementary Article 5), so that the existing references to "§2.6" in this Policy have a matching section; (4) "business tax payment notice" is added to the merchant data in §2.1; (5) the example of the aggregate figure visible to merchants in Supplementary Article 1 is corrected to "14 customers scanned in-store"; (6) the effect of paid plans on recommendation ranking in Supplementary Article 4 is corrected to priority only among restaurants with the same rating (rounded to one decimal place), consistent with the actual ranking mechanism. The processing of members' data is unchanged, and the version number (2.5) and the effective date (October 2, 2026) remain unchanged.
Prior Version 2.3 effective September 20, 2026; earlier Version 2.2 effective September 1, 2026. The Version 2.3 revision added disclosures on "the collection and use of data for Google AdMob third-party advertising" and "the display conditions of SWAY in-platform merchant advertising and its impression / click records", and supplemented the ways to turn off personalized advertising.
Correction within the same version on September 13, 2026: now that the App’s "Ad privacy options" entry point is live, the wording in §1.4, §3.4 and §8.3 has been restored, covering the collection of consent from users in the European Economic Area (EEA) / United Kingdom / Switzerland through Google’s consent management tool (User Messaging Platform, UMP) and the ability to change that choice at any time in the App under "Settings → Privacy settings → Ad privacy options". The version number (2.3) and the effective date (September 20, 2026) remain unchanged.
Correction within the same version on September 15, 2026: in §6.4, the processing period for personal data rights requests has been corrected from "30 working days, extendable to 60 working days" to the calendar-day periods under Article 13 of the Personal Data Protection Act (requests to inquire, review or be provided with copies: decision to grant or deny within 15 days of accepting the request; requests to supplement or correct, to stop collection / processing / use, or to delete: decision within 30 days of accepting the request; where necessary, each period may be extended once by no more than 15 days and 30 days respectively, with written notice of the reason); §6.2 has been corrected accordingly, removing the wording that allowed requests to be postponed because of force majeure, third-party service provider limitations or technical difficulties, so that any extension of the processing period may be made only under §6.4. The version number (2.3) and the effective date (September 20, 2026) remain unchanged.
Correction within the same version on September 16, 2026: (1) in §3.8, the wording for the parties with whom data may be integrated has been corrected to "partner content creators or marketing partners", and such integration remains limited to de-identified or aggregated form; (2) §4.1 now explains that, when an error occurs in the SWAY App, Sentry error monitoring keeps a sample of screen replays of that session with on-screen text and images masked, used only for debugging; (3) §5.2 corrects the in-App path for deleting your account yourself; (4) a new item (3) in §6.4 sets the processing period for GDPR requests for data portability, objection to processing, or withdrawal of consent; (5) the reference to a "shopping cart", which this website does not use, has been removed from §8.1; (6) §9.3 corrects the cross-reference to the Refund and Cancellation Policy (§2.7 corrected to §2.8). The version number (2.3) and the effective date (September 20, 2026) remain unchanged.
Operating Entity: SWAY CO., LTD. (registered in Taiwan as 隨食有限公司; brand name "Sui Shi SWAY")
Same-version correction on October 26, 2026: §6.2 was clarified so that historical records incorporated into backups, logs, training datasets, or audit trails that cannot be processed immediately will be processed by the Company within a reasonable time. This does not reduce any user rights; the version number and effective date remain unchanged.
This Policy is officially in Traditional Chinese; in case of discrepancy with any translated version, the Traditional Chinese version shall prevail.