PricingSign inStart free trial
HomeFeaturesPricingSecurityContactSign inStart free trial

Privacy centrePrivacy policy

Privacy policy

Last updated 16 October 2026

1. Introduction

This Privacy Policy explains how Swyft Software Limited ("Swyft Software", "we", "us", "our") collects, uses, shares and protects personal data when you visit oofly.app, use the Oofly service, or contact us. Oofly is a product of Swyft Software Limited.

Swyft Software Limited, a company registered in Ireland whose registered office is at 77 Lower Camden Street, Dublin 2, D02 XE80, Ireland, is the data controller for the personal data described in this policy, except where section 2 says we act as a processor for your organisation.

This policy is governed by the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Data Protection Acts 1988 to 2018 (Ireland), the ePrivacy Regulations (S.I. No. 336 of 2011) and any applicable successor legislation.

2. Data We Collect

We collect and process the following categories of personal data:

  • Contact information: Your name, email address, organisation and message, when you use our contact form.
  • Account information: Microsoft Entra ID account details (name, email address, user ID and tenant ID) provided when you sign in to the Oofly portal with your Microsoft work or school account.
  • Billing information: Your organisation's name, billing address, VAT number and subscription details. Card details are collected and held by Stripe, never by us.
  • Audit and usage data: What is done in Oofly and by whom, for example who set, changed or switched off an automatic reply, and when.
  • Technical data: IP address, browser type, device type and operating system, for security and fraud prevention.
  • Website analytics: If you accept analytics cookies, how you use this website, measured by Google Analytics (see section 6 and our Cookies Policy).
  • Directory and mailbox settings data (customers only): When your organisation connects its Microsoft 365 tenant, we process the names, email addresses, job titles, departments and group memberships of the people in its directory, and their automatic reply settings (whether a reply is on, its messages, who it goes to and its start and end dates). We do this as a data processor on behalf of your organisation, which is the data controller.

Oofly does not read, store or have access to the content of anyone's email. The Microsoft permissions it uses cover mailbox settings and the directory only.

3. Lawful Basis for Processing

We process your personal data on the following lawful bases:

  • Contract (Article 6(1)(b) GDPR): Processing needed to provide the Oofly service to you or your organisation.
  • Consent (Article 6(1)(a) GDPR): Analytics and advertising cookies on this website, which are only set if you accept them. You can withdraw consent at any time using "Cookie settings" at the bottom of every page.
  • Legitimate interest (Article 6(1)(f) GDPR): Answering enquiries, security, fraud prevention, improving the service and running it, where our interests are not overridden by your data protection rights.
  • Legal obligation (Article 6(1)(c) GDPR): Where processing is required by law, for example keeping billing records for tax purposes.

4. How We Use Your Data

We use your personal data to:

  • Provide, operate and improve Oofly and this website.
  • Show who is out, and set, change or switch off automatic replies when someone with the right role asks Oofly to.
  • Respond to contact form messages and support requests.
  • Process and manage your subscription and billing.
  • Send transactional emails, such as account notifications and billing receipts.
  • Monitor security, prevent fraud and detect abuse.
  • Understand how this website is used, where you have agreed to analytics cookies.
  • Comply with legal and regulatory obligations.
  • Enforce our Terms of Business.

We do not sell your personal data. Data from the Oofly service, including your organisation's directory and mailbox settings, is never used for advertising.

5. Where Your Data Is Kept

Oofly runs on Microsoft Azure in the European Union. The application runs in the West Europe region (the Netherlands) and the database in the Germany West Central region (Frankfurt), where it can only be reached over a private network. Microsoft Azure is independently audited against ISO/IEC 27001 and SOC 2; see our Security page for details.

6. Data Sharing and Third-Party Processors

We share personal data with trusted third parties only where needed to deliver the service. Our processors are bound by data processing agreements and provide appropriate safeguards.

  • Microsoft (Azure, Entra ID and Graph): Hosting, storage, database, sign-in, reading your directory and reading and setting automatic replies.
  • Google: If you accept analytics cookies, Google Analytics and Google Tag Manager measure how this website is used. If advertising is switched on for this website and you accept advertising cookies, Google AdSense may show and measure ads; for this, Google acts as an independent controller under Google's Privacy Policy.
  • Stripe: Payment processing and subscription management.
  • Resend: Sending our emails, including contact form messages and replies.
  • Cloudflare: The Turnstile spam check on our contact form, and DNS.

Some of these providers are based in, or may access data from, the United States. Where personal data leaves the European Economic Area (EEA), we rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses, in line with Chapter V of the GDPR.

7. Data Retention

We keep personal data only for as long as we need it for the purposes in this policy:

  • Contact form messages: Up to 2 years from the date you contact us.
  • Account, organisation, directory and mailbox settings data: For the length of the subscription, plus 90 days after it ends so you can ask for an export.
  • Audit log: For the length of the subscription, deleted with the rest of your organisation's data.
  • Billing records: 7 years, to meet Irish tax and accounting obligations.
  • Website analytics: Google Analytics data is kept for 14 months.

8. Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, change, disclosure or destruction. These include encryption in transit and at rest, Azure Key Vault for secrets, private networking for the database, a web application firewall, access controls, strict separation between customer organisations and audit logging.

No method of transmission over the internet or electronic storage is completely secure. While we work hard to protect your personal data, we cannot guarantee absolute security.

9. Your Rights

You have rights under the GDPR including access, rectification, erasure, restriction of processing, objection and portability, and the right to withdraw consent at any time. See Your data rights for how to use them.

10. Cookies

This website uses cookies that are strictly necessary, and analytics or advertising cookies only if you accept them. For full details, see our Cookies Policy.

11. Children's Data

Oofly is a business-to-business service and is not directed at children under the age of 18. We do not knowingly collect personal data from children.

12. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be notified to registered users by email. The date of the latest revision is shown at the top of this page.

13. Contact

To use your data protection rights or raise a privacy concern, please use our contact form and tell us which right you want to use. You also have the right to complain to the Data Protection Commission, the supervisory authority in Ireland (dataprotection.ie).