This privacy policy explains how Swarmd Ltd (company number 17065586), a company registered in England and Wales with registered office at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ (“Swarmd”, “we”, “us”) collects, uses, stores and otherwise processes personal data when you use our website, our platform, and related services (the “Services”).
This Privacy Policy applies to customers, prospective customers, authorised users and visitors to our website and Services.
Hosted vs. self-hosted deployments. Swarmd is offered both as a Swarmd-hosted (cloud) service and as a self-hosted deployment that runs entirely within your own infrastructure. The data processing described in this policy applies in full to the Swarmd-hosted service, where your data is transmitted to and processed on infrastructure that Swarmd operates on your behalf.
Where you run Swarmd on your own infrastructure (self-hosted / on-premise), your customer content, audit events, human-in-the-loop records, traces, telemetry and other operational data remain entirely within your environment and are never transmitted to or processed by Swarmd. The software’s only outbound communication to Swarmd is periodic validation of your licence key; that check contains no personal data and no customer content. Account, billing and support data that you provide to us directly — for example to purchase, renew or obtain support for the product — is still processed as described in this policy regardless of deployment model.
1. Who we are
Swarmd provides an AI governance and compliance platform. For the purposes of applicable data-protection law including the UK GDPR, the Data Protection Act 2018 and, where applicable, the EU GDPR:
(a) Swarmd acts as a data controller in relation to personal data relating to account management, billing, support, marketing, website usage and operation of the Services; and
(b) Swarmd acts as a data processor in relation to personal data submitted to or processed through the Services by customers on behalf of their own users, end users or organisations.
2. What we collect
The categories below describe data processed by the Swarmd-hosted service. For self-hosted deployments, usage data and customer content remain within your own environment and are not collected by us; only licence-key validation reaches Swarmd.
- Account data — including names, work email addresses, organisations, job titles and authentication identifiers managed through our identity and access systems.
- Usage data — including product telemetry, audit logs, trace metadata, feature usage, and approximate location derived from IP address or infrastructure metadata.
- Billing data — including company name, billing address, VAT number, subscription information, payment status, Stripe customer identifiers and payment-event metadata received from payment processors. We do not store full payment card details.
- Communications — including correspondence with support, sales or operational teams and information submitted through forms or communications channels.
- Cookies and similar technologies — including information collected through cookies and similar technologies as described in Section 10.
- Customer content — including policies, prompts, routing configurations, workflow data, runtime inputs and outputs, human-in-the-loop review records and related audit-event information submitted to or processed through the Services on behalf of customers. Where the Services process customer-submitted content containing personal data, Swarmd generally acts as a processor acting on the customer’s instructions.
3. How we use your data
- To provide, operate, and maintain the Services;
- To authenticate users, manage accounts and prevent abuse, fraud or unauthorised activity;
- To deliver support, respond to enquiries, and communicate operational or service-related notifications.
- To monitor, analyse and improve the performance, reliability and functionality of the Services using aggregated and de-identified analytics and telemetry data;
- To comply with applicable legal, regulatory, security, accounting and audit obligations;
- To send marketing communications where permitted by law or where consent has been obtained, subject to applicable opt-out rights.
4. Legal bases for processing
Under the UK GDPR and, where applicable, the EU GDPR, we rely on one or more of the following legal bases for processing personal data:
- Contract — where processing is necessary to provide the Services or perform contractual obligations;
- Legitimate interests — where processing is necessary for security, fraud prevention, operational management, product improvement, analytics, marketing or business administration, provided such interests are not overridden by individual rights and freedoms;
- Legal obligation — where processing is necessary to comply with applicable legal or regulatory obligations; and
- Consent — where consent is required by law, including for certain cookies or marketing communications.
5. Sharing and subprocessors
Swarmd may share personal data with trusted service providers, subprocessors and infrastructure providers engaged in connection with operation of the Services.
This may include providers of:
- Cloud infrastructure and hosting;
- Identity and authentication services;
- Payment processing;
- Email delivery;
- Logging, monitoring and observability;
- Customer support and communications; and
- Analytics and operational tooling.
Current infrastructure providers may include Amazon Web Services (AWS), Stripe and Keycloak.
Where third-party providers process personal data on our behalf, we implement appropriate contractual, technical and organisational safeguards designed to protect personal data in accordance with applicable law.
We may also disclose personal data where required by law, regulation, legal process or government request, or where reasonably necessary to protect the rights, security or integrity of Swarmd, our customers or others.
A current list of subprocessors may be made available upon request or through our documentation portal. Swarmd may update subprocessors from time to time in the ordinary operation of the Services.
6. International transfers
Swarmd is headquartered in the United Kingdom and may process personal data in the United Kingdom, the European Economic Area and other jurisdictions in which Swarmd or its service providers operate.
Where personal data is transferred outside the United Kingdom or European Economic Area, Swarmd relies on recognised transfer safeguards where required by applicable law, including:
- Adequacy regulations;
- The UK International Data Transfer Agreement (IDTA);
- The UK Addendum to the EU Standard Contractual Clauses; or
- The European Commission Standard Contractual Clauses.
Certain service providers, including cloud infrastructure and payment providers, may process or access personal data from jurisdictions outside the United Kingdom or EEA.
7. Retention
We retain personal data for as long as reasonably necessary to provide and secure the Services, comply with legal, regulatory, tax accounting and reporting obligations, maintain audit integrity and operational reliability, resolve disputes and enforce contractual rights.
Retention periods vary depending on the nature of the data, customer configuration, legal requirements and operational necessity.
Because the Services are designed to support tamper-evident auditability and governance workflows, certain audit records, policy histories and human-in-the-loop review records may be retained in append-only or immutable form for evidential, security and compliance purposes.
Where appropriate, personal data may be deleted, anonymised or aggregated following expiry of applicable retention periods.
8. Your rights
Subject to applicable law, individuals may have rights in relation to their personal data, including rights to access personal data, request correction of inaccurate data, request deletion of personal data, restrict or object to certain processing activities, request portability of personal data, and withdraw consent where processing is based on consent.
Where Swarmd processes personal data as a processor on behalf of a customer, requests relating to such data may need to be directed to the relevant customer acting as a controller.
Requests may be submitted to [email protected]. We aim to acknowledge requests within 5 business days and respond within the timeframes required by applicable law.
Certain rights may be limited where retention or processing is required for legal, security, evidential or operational purposes.
You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO).
9. Security
Swarmd implements administrative, technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure.
Security measures may include:
- Encryption in transit using TLS;
- Infrastructure-level encryption at rest;
- Role-based access controls and authentication systems;
- Tenant isolation controls;
- Logging, monitoring and audit mechanisms; and
- Append-only or tamper-evident audit structures designed to support evidential integrity.
No method of transmission, storage or processing is completely secure, and Swarmd cannot guarantee absolute security. Where required by applicable law, Swarmd will notify relevant parties and authorities of personal-data breaches within applicable legal timeframes.
10. Cookies
The Services and website use cookies and similar technologies to support functionality, security, authentication, analytics and user preferences.
Certain cookies are strictly necessary for operation of the Services and do not require consent. Other cookies and analytics technologies are used only where consent is required under applicable law.
You may manage cookies preferences through our cookie banner or through browser settings. Disabling certain cookies may affect functionality of the Services or website.
11. Children
The Services are intended for business and professional users and are not directed to individuals under the age of 18. Swarmd does not knowingly collect personal data directly from children. If we become aware that personal data has been provided directly by a child in breach of this Policy, we will take reasonable steps to delete such information in accordance with applicable law.
12. Changes to this policy
Swarmd may update this Privacy Policy from time to time to reflect changes to the Services, applicable law, operational practices or regulatory requirements. Where changes materially affect how personal data is processed, we will provide reasonable notice through the Services, by email or through other appropriate communication channels.
The “Effective Date” at the top of this Policy indicates when the current version came into effect.
13. Contact
Questions, requests or concerns relating to this Privacy Policy may be directed to [email protected].