Operator of the App Plutus Ventures UG Hohenzollernstr. 35 80801 Munich Email: contact@swayaapp.com 1. Controller The controller within the meaning of the GDPR is the above-mentioned company. 2. Data collected and processed a) Spotify Login To use the app, login via Spotify is required (OAuth login). Data provided by Spotify (such as username, email address, public playlists, listening habits, profile picture) is retrieved. This data is used solely to provide the app’s core functionality (e.g., swipe interaction with playlists and songs). b) No further data No additional user account is created within the app. No location data is collected. No push notifications are sent. 3. Purpose and legal basis Processing is based on Art. 6 (1) lit. b GDPR (contractual necessity, app functionality) and Art. 6 (1) lit. f GDPR (legitimate interest in analysis and improvement). Data will not be used for any other purposes. 4. Deletion and logout Users can log out at any time via the “Logout” function in the app. The “Delete account & local data” function removes all locally stored data. Data obtained from Spotify remains stored by Spotify and can be managed according to Spotify’s Privacy Policy. 5. User rights Users have the following rights under the GDPR: Access to stored data Rectification of incorrect data Erasure of data Restriction of processing Data portability Objection to processing To exercise these rights, contact: contact@swayaapp.com

8. Retention of data We do not dstore personal data for app purposes.

9. Changes to this Privacy Policy We may update this Privacy Policy to reflect changes in the app or legal requirements.