Legal

This Privacy Policy explains how Swa Technology Inc. ("Swa," "we," "us") collects, uses, shares, and protects information when you use Swa — including Swa Solo, the Swa web and mobile apps, and Swa inside Slack, Microsoft Teams, and other channels (together, the "Service").

The short version

• We do not train AI models on your data — ever. Neither do the AI providers we use; we connect to them only on enterprise terms that prohibit training on your content.
• Your message goes to the AI just long enough to answer you. The providers never train on it, and we use zero-data-retention connections wherever they're offered.
• The things that make Swa work for you over time — your chats, memory, custom agents, and history — are saved in your workspace, encrypted, and you can delete them.
• You're in control. You can view and delete your data, erase what Swa remembers, and export your information.
• We sell nothing.

If you use Swa through an organization (your employer, on a Teams or Enterprise plan), that organization controls your workspace and its data — including compliance settings such as sensitive-data screening, retention, legal hold, and export — and our handling of that data is governed by our agreement with them (including our Data Processing Agreement), not this Policy.

1. How Swa handles data: two layers

Swa works at two layers, and they keep data differently. Understanding this explains everything below.

• The AI model layer. When you ask something, your message and the context needed to answer are sent to the AI model that will handle it. We use these models only through enterprise/API connections that never use your content to train their models, and we enable zero-data-retention wherever the provider offers it, so nothing is kept after the response. Any limited provider-side retention that does occur (for example, brief abuse-monitoring logs) remains barred from training and subject to deletion under our agreement with that provider.
• The Swa service layer. To be a useful product, Swa saves the things you'd expect it to remember: your account, your conversations, your memory, your custom agents, your projects and files, and your activity history. This data lives in your Swa workspace, is encrypted, is kept according to your (or your organization's) settings, and can be deleted.

2. Information we collect

Account & identity data. Name, email, organization, hashed password (we never store plaintext passwords), and — if you sign in through a single-sign-on provider (Okta, Microsoft Entra, Google, or another SAML/OIDC provider) — the identifiers that provider shares with us. For organizational accounts, your role and team membership.

Your inputs. The prompts and messages you send; files and documents you upload; the contents of your projects; and the instructions you write to create custom agents and automations.

Outputs. The responses, files, and other content the Service generates for you, and which AI model produced a given response.

Connected-source data. If you (or your administrator) connect a third-party tool — for example Google Drive, Box, Slack, or Microsoft Teams — Swa accesses the content needed to carry out your request. If your organization enables Swa's knowledge features, selected content may be indexed so Swa can answer questions from it, scoped to what each person is allowed to see.

Memory. Context that carries across your chats and files (for example, a preference you've stated). You can see what Swa remembers and erase it at any time — for example by telling Swa "Forget that I work at Acme."

Usage, billing & activity data. Records of activity for security, reliability, and your audit trail; the tokens you consume and the cost of each request (for metering and billing); access checks; and feature-engagement signals (for example, progress in Swa Quest) that help us understand how Swa is used.

Compliance screening. Where compliance features are enabled (typically by an organization), Swa scans content for sensitive data — such as personal, health, or payment-card information — before it is sent to an AI model, so it can be redacted, blocked, or routed according to policy. Records of these checks are part of the audit trail.

Device & analytics data. IP address, browser and operating-system type, and usage patterns.

Channel-specific data. For text-message channels (such as SMS or WhatsApp), the phone number used to reach you, where enabled by your organization. See "SMS data practices" below.

Cookies. We use cookies and similar technologies for sign-in, security, and basic analytics. You can control cookies through your browser; see "Cookies and analytics."

Children's data. Individual Swa accounts are for people 18 and older. Children and teens can use Swa only through a supervised education experience — see "Children and students" below.

3. How we use your information

• To provide the Service — route your request to the right AI model and helper, return the result, run your agents and scheduled automations, and answer from connected knowledge.
• To personalize — your memory, custom agents, and saved preferences.
• To keep the Service secure and accountable — prevent fraud and abuse, enforce access controls, apply compliance rules such as sensitive-data screening and model-routing restrictions, and maintain your audit trail.
• To bill — meter token usage and charge the correct fees.
• To improve the Service — we look at how Swa is used through aggregated, de-identified signals, such as which features and models are used and engagement with Swa Quest, so we can make the product better. We do not use the content of your conversations for product analytics, we do not track the specific questions you ask, and we do not build behavioral or advertising profiles of you. We never train AI models on your data.

4. AI models and the no-training commitment

To answer you, Swa sends your input and the necessary context to the AI model selected for the task. We may use models from providers including Anthropic, OpenAI, Google, xAI, Perplexity, Together.ai (which hosts certain open models such as Llama and DeepSeek in the United States), and Amazon Web Services (Bedrock). Your organization can restrict which providers, regions, or HIPAA-eligible models are used. Do not submit protected health information (PHI) unless your organization has signed a Business Associate Agreement with us and enabled PHI handling.

5. Third-party services you connect

When you connect a third-party application or take an action that reaches outside Swa, you direct us to share data with that service. Some connections give Swa ongoing access until you disable them. When Swa performs multi-step tasks or takes actions on your behalf (for example, an automation that sends a message or updates a file), those actions can have effects in third-party services. You are responsible for ensuring you have the right to connect a source and to authorize those actions. Once data reaches a third-party service, that service handles it under its own privacy policy, which we don't control.

6. How we share information

We share data only in these limited ways:

• AI model providers — your input and necessary context, solely to generate your response, under the no-training terms in Section 4. We do not send account data or anything beyond what the request requires.
• Service providers (subprocessors) — vendors that support the Service under contractual data-protection obligations, including Amazon Web Services (hosting), Stripe (payments), Twilio (text messaging), and Google Analytics (web analytics). The current list is at https://swa-ai.com/subprocessors.
• Our affiliates — including Swa Worldwide AI Private Limited (India), our wholly owned subsidiary, which helps operate, support, and manage the Service under the commitments in this Policy.
• At your direction — third-party services you connect (Section 5) and your identity provider.
• Legal — when required by law, subpoena, or valid legal process; we will notify you unless prohibited.
• Business transfers — in a merger, acquisition, or sale of assets, subject to this Policy.
• Aggregated, de-identified data — which does not identify you or your organization.

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under U.S. state privacy laws.

7. Data retention

• AI model layer: we use zero-data-retention connections wherever providers offer them; providers never train on your content, and any limited provider-side retention is governed by our agreements with them.
• Swa service layer: we keep your workspace data — conversations, memory, agents, knowledge, and activity history — for as long as your account is active, according to your (or your organization's) retention settings, until you delete it, or as required by law. You can delete conversations and erase memory at any time.
• On account closure: we delete or return your data within a reasonable period, except where we must retain it by law or for a legal hold.

For organizational accounts, retention is governed by your organization's configuration and our agreement with them.

8. Security

We protect your data with measures including encryption in transit (TLS 1.3) and at rest (AES-256), single-sign-on and role-based access controls, least-privilege access, and full audit logging. Our security program is designed to meet the SOC 2 Trust Services Criteria and recognized NIST frameworks. No system is perfectly secure, but we work hard to protect your information and will notify you and any affected organization of a security incident as required by law.

9. Data residency and international transfers

Swa is primarily hosted in the United States. We operate from the United States and India — the latter through our wholly owned subsidiary Swa Worldwide AI Private Limited, which helps operate the Service and may access and manage your data on our behalf. Our service providers and personnel may process data in other countries. Where the Service supports it, your organization can choose regional data residency. When we transfer personal data internationally, we use appropriate safeguards (such as the EU Standard Contractual Clauses and equivalent mechanisms), described in our Data Processing Agreement.

10. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, restrict, or export your personal data, and to withdraw consent or object to certain processing. You can exercise many of these directly in the Service (delete conversations, erase memory, export data) or by contacting us at privacy@swa-ai.com. We may verify your identity first. We will not discriminate against you for exercising your rights.

• California / U.S. state residents: you have the rights described above and the right to opt out of sale/sharing — note that we do not sell or share personal information for cross-context behavioral advertising. To the extent our use of analytics cookies is treated as a "share" under California law, you can opt out via your cookie settings.
• Marketing email: unsubscribe via the link in any marketing message.
• Text messages: reply STOP to opt out, HELP for help.

If you are in the EEA, UK, or Switzerland, our legal bases for processing are performance of our contract with you, our legitimate interests in operating and securing the Service, your consent (where applicable), and compliance with law. You may lodge a complaint with your local supervisory authority.

11. Cookies and analytics

We use cookies for sign-in and security (necessary) and for basic analytics (including Google Analytics) to understand and improve the Service. You can manage non-essential cookies through your browser or our cookie controls. We do not use your content for advertising.

12. SMS data practices

Where your organization enables text-message access, we collect your phone number to deliver responses. Message content is processed to answer you under the two-layer model in Section 1; we keep only the limited recent context needed for continuity, consistent with your organization's retention settings. We never sell or share your phone number or opt-in data, and we do not share it with third parties for marketing. Reply STOP to opt out at any time. Message and data rates may apply. See our SMS Program Terms in the Terms of Service.

13. Children and students

Swa's general Service is for adults 18 and older. We also believe young people should learn to use AI well and safely, and we build for that deliberately — but we offer it only through the adults responsible for them. Our education experience (such as Swa Scholar) is provided to schools and to parents and guardians — including homeschooling families — who enable, configure, and supervise it through Swa's administration and compliance tools. We market Swa to schools and parents, not to children, and students cannot sign up on their own. Where that experience is enabled:

• Consent comes first. A parent or guardian — or a school acting on parents' behalf in an educational context — must enable access and consent to the data practices described here before a minor can use the Service.
• Safety features are on by default and cannot be turned off by the student. Content is checked for harmful material, what the AI will generate for students is restricted, and these protections are designed to fail closed — if a safety check cannot run, access is blocked.
• We collect the minimum needed to provide the learning experience: account basics, the student's interactions, and learning progress.
• What we keep is the learning record, not the student's words. Stored learning records are progress — quests completed, concepts mastered, reasoning-depth scores, streaks. Safety events record only the category, severity, and who was notified — never what the student wrote. We do not analyze the content of students' questions.
• Conversations belong to the supervising adults, not to us. So that learning stays safe and honest, a student's conversations are reviewable by the supervising school — and by a parent or guardian where they opt in — retained under that school's or parent's settings, and deletable by them. Swa does not use student conversations for analytics, advertising, profiling, or model training.
• We never train AI models on students' data, never sell it, never use it for advertising, and do not build behavioral profiles of minors.
• Parents and schools stay in control. The managing school or parent/guardian can review, export, and delete a student's data and disable access at any time; retention follows their settings.
• For children under 13 in the United States, we handle personal information consistent with the Children's Online Privacy Protection Act (COPPA), including verifiable consent before collection.

Outside a supervised education experience, we do not knowingly collect personal data from anyone under 18, and if we learn we have, we will delete it. Parents or guardians can contact us anytime at privacy@swa-ai.com.

14. Changes to this Policy

We may update this Policy. If we make material changes, we will notify you (for example, in the Service or by email) and update the date above. Your continued use after an update means you accept the revised Policy.

15. Contact

Swa Technology Inc. — Vancouver Innovation Center, Suite 120, Vancouver, WA — privacy@swa-ai.com. This Policy also covers our subsidiary Swa Worldwide AI Private Limited (India).