Legal
Privacy Policy
Last modified March 8, 2026
1. Who We Are
The data controller for your personal information is:
2. Information We Collect
2.1 Information you provide directly
- Account information — name, email address, and password when you create an account.
- Billing information — payment method details processed by our payment processor (Stripe). We do not store full card numbers.
- Communications — messages you send to our support team or through feedback forms.
- LLM API keys — keys you bring for third-party LLM providers (OpenAI, Anthropic, etc.) are stored encrypted and never logged or shared.
2.2 Information collected automatically
- Usage data — pages visited, features used, agent runs initiated, task outcomes, and session duration.
- Log data — IP address, browser type, device identifiers, referring URLs, and timestamps.
- Cookies and similar technologies — session cookies for authentication and optional analytics cookies. See Section 8 for details.
- Aggregate platform metrics — anonymized statistics on agent performance, task completion rates, and system health.
2.3 Customer Data (content you process through SwarmOS)
When you use SwarmOS to run agents, the platform processes content you provide — code, documents, task descriptions, Obsidian notes, and other inputs ("Customer Data"). We treat Customer Data as confidential. We do not use Customer Data to train our own AI models, and we do not sell or share it with third parties except as required to operate the Services (e.g., routing requests to your chosen LLM provider using your own API key).
3. How We Use Your Information
We use the information we collect for the following purposes:
- Providing the Services — authenticating your account, routing agent tasks, processing approvals, and delivering outputs.
- Billing and payments — managing subscriptions, processing charges, and enforcing API Spend Caps.
- Product improvement — analyzing aggregated, anonymized usage patterns to improve reliability and add features.
- Security and fraud prevention — detecting abuse, unauthorized access, and violations of our Terms of Service.
- Communication — sending transactional emails (account confirmations, alerts, invoices) and, with your consent, product updates.
- Legal compliance — meeting our obligations under applicable law.
We will never sell your personal information or Customer Data to third parties. We will never use your Customer Data to train AI models without your explicit written consent.
4. Legal Bases for Processing (GDPR)
If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following legal bases:
- Contract performance — processing necessary to provide the Services you have subscribed to.
- Legitimate interests — product analytics, security monitoring, and fraud prevention, balanced against your rights.
- Legal obligation — compliance with applicable laws and regulations.
- Consent — marketing communications and non-essential cookies, where you have opted in.
5. Data Sharing and Disclosure
5.1 Service providers
We share data with trusted third-party vendors who help us operate the platform, including cloud infrastructure providers, payment processors (Stripe), email delivery providers, and analytics tools. These providers are contractually bound to use your data only to perform services for us.
5.2 LLM providers
When you run agents, your prompts and task context are sent to the LLM provider you have configured, using your own API key. We do not store the content of these requests beyond what is necessary for logging agent activity within your account. Each LLM provider's privacy policy governs their handling of your data.
5.3 Communication integrations
If you connect SwarmOS to Telegram, Slack, Discord, WhatsApp, or Microsoft Teams, task notifications and approval requests are sent through those platforms. Those platforms' own privacy policies apply to data processed within them.
5.4 Legal requirements
We may disclose your information if required to do so by law, court order, or government request, or if we reasonably believe disclosure is necessary to protect the rights, property, or safety of SwarmOS, our users, or the public.
5.5 Business transfers
If Macrodeep Inc. is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website prior to your data being transferred and becoming subject to a different privacy policy.
6. Data Retention
We retain personal data for as long as your account is active or as needed to provide the Services. Specifically:
- Account data — retained for the duration of your account plus 90 days after deletion to allow for recovery.
- Billing records — retained for 7 years to comply with financial regulations.
- Agent task logs — retained for 90 days by default; Enterprise plans may configure custom retention.
- Support communications — retained for 3 years after the resolution of the request.
You may request deletion of your account and associated data at any time. See Section 9 for your rights.
7. Data Security
We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, loss, or misuse. These include:
- Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
- Encrypted storage of API keys — keys are never logged in plaintext
- Access controls limiting data access to authorized personnel
- Regular security reviews and monitoring
No method of transmission over the internet is 100% secure. If you discover a security vulnerability, please report it responsibly to security@swarmos.tech.
8. Cookies
8.1 Essential cookies
We use session cookies to keep you logged in and maintain your preferences (including your light/dark mode setting). These are required for the platform to function and cannot be disabled.
8.2 Analytics cookies
With your consent, we use analytics tools to understand how the platform is used in aggregate. These cookies do not identify you personally. You may opt out at any time via the cookie preferences banner or by contacting privacy@swarmos.tech.
8.3 No advertising cookies
We do not use advertising cookies or sell your browsing data to ad networks.
9. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
Access
Request a copy of the personal data we hold about you.
Rectification
Correct inaccurate or incomplete personal data.
Erasure
Request deletion of your account and personal data (subject to legal retention requirements).
Portability
Receive your data in a structured, machine-readable format.
Restriction
Request that we limit processing of your data in certain circumstances.
Objection
Object to processing based on legitimate interests, including direct marketing.
Withdraw consent
Where processing is based on consent, withdraw it at any time.
Complaints
Lodge a complaint with your local data protection authority.
To exercise any of these rights, email privacy@swarmos.tech. We will respond within 30 days. We may need to verify your identity before processing your request.
10. California Privacy Rights (CCPA)
If you are a California resident, you have the following additional rights under the California Consumer Privacy Act:
- Right to Know — request disclosure of the categories and specific pieces of personal information we have collected about you.
- Right to Delete — request deletion of personal information we have collected, subject to certain exceptions.
- Right to Opt-Out of Sale — we do not sell personal information, so this right does not apply in practice.
- Right to Non-Discrimination — we will not discriminate against you for exercising your CCPA rights.
To submit a CCPA request, email privacy@swarmos.tech with "CCPA Request" in the subject line.
11. International Data Transfers
SwarmOS is operated from the United States. If you access the Services from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your jurisdiction.
For users in the EEA and UK, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to legitimize cross-border data transfers where required. A copy of our SCCs is available upon request at privacy@swarmos.tech.
12. Children's Privacy
The SwarmOS platform is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you believe we have inadvertently collected such information, please contact us at privacy@swarmos.tech and we will promptly delete it.
13. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and/or by posting a prominent notice on the SwarmOS website at least 30 days before the changes take effect. The "Last modified" date at the top of this page reflects the most recent update. Continued use of the Services after the effective date constitutes acceptance of the revised policy.
14. Contact Us
For privacy-related questions, requests, or complaints, please contact:
Macrodeep Inc. — Privacy Team
405 Lexington Avenue
C/O Salestools AI Inc
New York, NY 10174