Privacy Policy

The controller of your personal data is the operator of SWIFTarius (“we”, “us”). You can reach us through the SWIFTarius Telegram bot, @swiftarius_bot, command /paysupport, or by e-mail at our support address (enable JavaScript to see it). Start the message with the word “privacy” so it reaches the right person.

The operator’s legal name and registered address will be published here before paid plans open.

We have not appointed a data protection officer.

• This website sets no cookies of its own, runs no analytics or advertising tags and loads nothing from third parties.
• The UETR you type into the form on this website is not sent to us. It only becomes part of a link that opens our Telegram bot when you press the button.
• In the bot and the API we keep the payment references you give us and what banks report about them, so that we can show and watch the status for you.
• We never ask for bank logins or passwords and we never move money.
• We do not sell personal data and do not use it for advertising or profiling.

What is processed. To deliver the pages and protect them from attacks, our network provider Cloudflare processes technical connection data: IP address, browser and device type, the page requested and the time. We see only aggregated statistics such as the number of requests per country, not individual visitors.

Cookies and similar technologies. We do not set cookies and do not use local storage or tracking pixels. Cloudflare may set a short-lived security cookie (__cf_bm or cf_clearance) when it needs to check that a visitor is not an automated attack. These cookies are strictly necessary for security and therefore do not require consent. Fonts, images and scripts are served from our own domain.

Legal basis. Our legitimate interest in running a secure, working website (Art. 6(1)(f) GDPR).

• Account: your Telegram user ID, the language of your Telegram app and the language you choose, your plan, its period and your balance of service credits, and a history of changes to them (plan, credits, blocks) with dates.
• Payments you add: the UETR and, if you provide them, the amount, currency and value date. When you send an MT103 or a spreadsheet, the bot extracts only these fields. Spreadsheets are read in memory and are not stored; the rest of an MT103 text is not kept.
• What banks report: statuses, status and reason codes, the reporting banks and the times they reported, and the answers of the trackers.
• Your working notes: cases (owner, reference, next step and notes you write), watch settings and digests.
• Counterparty cards: when you create a link we store a hash of its token, the payment it shows and its expiry. Anyone with the link sees the status, a shortened UETR and the reporting channels; never the amount, your name or your account.
• Support requests: when you write to support with /paysupport, the bot passes your message to our support staff inside Telegram and sends their answer back to you. We keep the request number, its status and times; the messages themselves stay in Telegram. E-mails to our support address are kept in our support mailbox.

Telegram processes the messages you exchange with the bot as an independent controller under its own privacy policy. Chat history stays in Telegram under your control.

Legal basis. Performance of our contract with you (Art. 6(1)(b) GDPR). Without a UETR we cannot check a payment; everything else is optional.

Your account number; your API keys, which we store only as a hash and a short prefix; for each request, the idempotency key, a fingerprint of the request body and the response we return for safe retries; daily usage counters and the history of your service credits. Payment data is the same as in the bot.

Legal basis. Performance of our contract with you (Art. 6(1)(b) GDPR).

Telegram Stars. Telegram processes the payment. We receive the payment identifier, the amount, the period paid for and, if it happens, the refund.

USDT top-ups for the API. Our crypto payment provider handles the invoice. We receive the invoice number, the amount paid, the transaction hash, the network and the address the payment came from.

Screening. Before adding credits we check the sending address against public sanctions lists and the freeze lists published by stablecoin issuers, and may use a blockchain analytics provider. If the address is on a sanctions list, we cannot accept the payment. Other payments that need a look are held, and a person reviews every held payment before credits are added or refused. You can ask for a human review of any such decision and explain your position through the SWIFTarius Telegram bot, @swiftarius_bot, command /paysupport, or by e-mail at our support address (enable JavaScript to see it).

Legal basis. Performance of the contract (Art. 6(1)(b)), our legal obligations under accounting, tax and sanctions law (Art. 6(1)(c)), and our legitimate interest in preventing fraud and money laundering (Art. 6(1)(f)).

• Public payment trackers operated by banks. To look up a status our servers send them the UETR and, if you provided them, the amount, currency and value date. They do not receive your name, Telegram ID or IP address.
• Cloudflare (content delivery, DNS and protection), and our hosting and network providers, as processors acting on our instructions.
• Telegram, for the bot and for Stars payments.
• Our crypto payment provider and blockchain data services, for USDT top-ups and screening.
• People you send a counterparty card to, who see what that card shows.
• Public authorities, only where the law requires us to disclose data.

Our servers are located outside the European Economic Area, in a country for which the European Commission has not adopted an adequacy decision. Cloudflare and some of our providers also process data in the United States and other countries.

Where a provider outside the EEA processes personal data for us, we use the European Commission’s standard contractual clauses or, where available, a recognised framework such as the EU-U.S. Data Privacy Framework. You can ask us for a copy of the relevant safeguards.

• Website connection data: we do not keep logs of individual visits; Cloudflare keeps security data briefly.
• Error logs on our servers: up to 14 days. We do not keep access logs with IP addresses.
• Account, payments, cases and counterparty cards: until you delete them or ask us to close your account. A card link stops working when it expires or when you revoke it.
• Records of payments to us, credits and screening results: for as long as accounting, tax and anti-money-laundering law requires, usually five to ten years.

Under the GDPR and the UK GDPR you have the right to:

• get a copy of your personal data and information about how we use it;
• have inaccurate data corrected;
• have your data deleted, except records we must keep by law (see How long we keep data);
• restrict how we use it;
• receive your payment data in a machine-readable format: /export in the bot or GET /v1/export in the API gives you an Excel file at any time;
• object to processing based on our legitimate interests;
• not be subject to a decision based solely on automated processing that significantly affects you;
• complain to the data protection authority in your country, or in the UK to the ICO.

To use these rights, contact us through the SWIFTarius Telegram bot, @swiftarius_bot, command /paysupport, or by e-mail at our support address (enable JavaScript to see it). We reply within one month. We may ask you to confirm the request from the Telegram account it concerns.

Connections are encrypted with TLS 1.2 or later. API keys and card link tokens are stored only as hashes. Each customer’s payment register is kept separately, and access to production systems is limited to the operator.

SWIFTarius is a service for adults handling international payments. It is not intended for anyone under 18.

We announce material changes to this policy in the bot before they take effect.