Privacy Policy

SWARP FOUNDATION S.R.L., Viale Tunisia 22, 20124 Milano (MI), Italy, is the controller for personal data processed through this website, the Swarp workspace, contact forms, and Swarp AI.

• ›Company registration/VAT: 14284090967
• ›Contact: info@swarpfoundation.com
• ›PEC: swarpfoundation@pec.it

We collect only the data needed to operate the services, respond to requests, secure the platform, and comply with legal duties.

• ›Account data: name, email address, profile image, and Google OAuth identifiers provided during sign-in
• ›Project data: project name, description, selected services, budget, quote status, and payment reference details
• ›Contact data: email address and message content submitted through forms
• ›Technical data: IP address, device/browser metadata, request headers, security logs, rate-limit events, and cookie/session identifiers
• ›Swarp AI data: messages you send to the chat endpoint and related technical metadata
• ›Payment, wallet, or identity-verification data only where an enabled product flow requires those providers

We process personal data under GDPR legal bases that depend on the context.

• ›Contract or pre-contract steps: creating accounts, receiving project requests, issuing quotes, and providing the dashboard
• ›Legitimate interests: platform security, abuse prevention, debugging, service improvement, and business communications
• ›Legal obligations: accounting, tax, regulatory, fraud-prevention, sanctions, and dispute obligations where applicable
• ›Consent: optional cookies or communications where consent is required

We do not sell user data. We do not share personal data for third-party advertising. We share data only where needed to provide and protect the service or comply with law.

• ›Authentication providers such as Google OAuth/NextAuth
• ›Hosting, database, email, rate-limiting, and infrastructure providers
• ›AI model providers such as OpenRouter, Groq, or Together AI when you use Swarp AI
• ›Payment, wallet, or identity-verification providers such as MoonPay, Solana infrastructure, or Veriff only where those product flows are enabled
• ›Professional advisers, authorities, or courts where legally required

Processors are expected to process data under contractual confidentiality, security, and data-protection obligations.

Some providers may process data outside the European Economic Area. Where that happens, we rely on appropriate safeguards such as adequacy decisions, Standard Contractual Clauses, or equivalent contractual and technical protections.

We keep personal data only for as long as needed for the purposes described in this policy.

• ›Session/account data is kept while your workspace account is active
• ›Project and quote data is kept while needed to manage the project, resolve disputes, and meet accounting or legal duties
• ›Contact messages are kept for support and business follow-up, then removed or archived under internal retention rules
• ›Security logs are retained for a limited period needed for abuse prevention and investigation
• ›Swarp AI messages are not intentionally stored by the application, but are processed transiently by the configured AI provider
• ›Backups are rotated on normal operational schedules

Depending on your location and the data involved, you may request access, correction, deletion, restriction, portability, or objection to processing.

• ›You can request deletion from the dashboard Account section for app-owned project and privacy request records linked to your authenticated email
• ›You can also contact info@swarpfoundation.com for privacy requests
• ›We may need to verify your identity before acting on a request
• ›Some data may be retained when required by law, accounting duties, security, or dispute resolution

You may lodge a complaint with your local data protection authority. In Italy, the competent authority is the Garante per la protezione dei dati personali.

We use technical and organizational controls aligned with the current codebase and deployment model.

• ›Google OAuth/NextAuth session authentication for the workspace
• ›Admin access restricted by configured admin email allow-list
• ›Server-side input validation using Zod schemas
• ›Rate limiting for contact, dashboard, admin, and AI routes
• ›Security headers including CSP, frame protection, content-type protection, and referrer policy
• ›No exposure of OAuth access tokens to client sessions

We may update this policy as the product, providers, or legal requirements change. Material changes will be published with a new revision date.