Privacy Policy

This Privacy Policy explains how Swarmfile (“Swarmfile,” “we,” “us,” or “our”) handles personal data in connection with our websites, desktop and command-line applications, and hosted control-plane and storage services (together, the “Service”). It should be read alongside our Terms & Conditions.

For the personal data we process on your behalf as part of operating the Service (for example, the account details of your organization’s members and the contents of Your Content), you are the data controller and we act as your data processor. For data we collect about you as our customer or website visitor (for example, billing and account-administration data), we act as the controller.

1. Data we collect

• Account data - name, email address, organization name, and credentials you provide when you register or are invited. If you sign in through your own identity provider, we receive the identity attributes it releases (such as email and a subject identifier).
• Billing data - plan, seat count, and billing contact details. Card details are handled directly by our payment processor; we do not store full card numbers.
• Your Content and metadata - the files you store or stream, and associated metadata such as file names, sizes, versions, permissions, comments, and activity events. Stored file content is always encrypted at rest; on the opt-in end-to-end tier we cannot read it at all.
• Usage and diagnostic data - log records, IP address, device and platform information, connectivity diagnostics, and error reports generated when you use the Service, used to operate, secure, and improve it.
• Support and contact data - information you provide when you contact us for sales or support.

2. How we use data

• to provide, maintain, secure, and improve the Service;
• to authenticate users, enforce permissions, and coordinate the distribution of data between your machines and our infrastructure;
• to process payments and manage your subscription;
• to detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms (including automated safety controls such as ransomware quarantine);
• to communicate with you about your account, service changes, security notices, and support requests; and
• to comply with legal obligations and enforce our agreements.

3. Legal bases

Where the GDPR or similar laws apply, we rely on: performance of a contract (to provide the Service you sign up for); our legitimate interests (to secure, operate, and improve the Service and prevent abuse); consent (where required, for example certain communications); and compliance with legal obligations.

4. How we share data

We do not sell your personal data. We share data only:

• with service providers (sub-processors) who host infrastructure, process payments, deliver email, and provide similar operational support, under contractual confidentiality and data-protection obligations;
• with other users in your organization, to the extent your projects, permissions, share links, and activity feeds make data visible to them;
• where required by law or to protect our rights, users, or the public; and
• in connection with a merger, acquisition, or sale of assets, subject to this Policy.

5. International transfers

We may process and store data in countries other than your own. Where we transfer personal data across borders, we use appropriate safeguards, such as standard contractual clauses, where required by law. Enterprise customers with data-residency requirements should raise them in procurement; see our security page for self-hosted and air-gapped options.

6. Retention

We retain personal data for as long as your account is active and as needed to provide the Service, then for a reasonable period afterwards to meet legal, accounting, security, and dispute-resolution needs. Your Content is retained according to your organization’s configured retention, trash, and version settings, and may persist in routine backups for a limited period after deletion.

7. Security

We take reasonable technical and organizational measures to protect personal data, including encryption of stored content, per-tenant isolation, access controls, and integrity verification. Details are on our security page. No method of transmission or storage is completely secure, and we cannot guarantee absolute security; please also keep your own backups of important data as described in our Terms.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete, or port your personal data, to object to or restrict certain processing, and to withdraw consent. If we process data on behalf of your organization, requests about that data should be directed to your organization, and we will assist it as its processor. To exercise rights we control, contact us. You also have the right to lodge a complaint with your local data-protection authority.

9. Cookies and analytics

We use strictly necessary cookies and similar technologies to keep you signed in, remember preferences, and secure the Service. Where we use analytics to understand and improve usage, we do so in a manner consistent with applicable law and, where required, with your consent.

10. Children

The Service is not directed to children and is intended for use by individuals aged 18 or older. We do not knowingly collect personal data from children.

11. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the “Last updated” date above, and material changes will be notified by reasonable means. Your continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

12. Contact

Questions about this Policy or your personal data? Contact us.