Privacy Policy
Last updated 23 August 2026. Swurl is operated by m2Dev LLC.
1. Who we are
Swurl is a service operated by m2Dev LLC ("we", "us"), a limited liability company registered in [STATE] with its principal place of business in Austin, Texas. For UK and EU data protection purposes m2Dev LLC is the controller of account data and a processor of the content you send through the service. Contact privacy@swurl.ai.
2. What we collect
- Account data — name, work email, workspace name, role, authentication identifiers. Provided by you or your identity provider.
- Billing data — plan, seat count, invoices, and a payment token. Card numbers are held by our payment processor, never by us.
- Content — the messages, files and prompts you send through the service, and the responses returned.
- Usage metadata — model used, token counts, latency, cost, timestamps, and the routing decision for each request.
- Technical data — IP address, user agent, and coarse location derived from IP, used for security and abuse prevention.
3. How we use it
To provide the service, route requests, meter and bill usage, secure the platform, support you, and comply with law. We do not sell personal data, we do not share it with advertisers, and we do not use your content to train any model.
4. Legal bases (UK and EU)
| Purpose | Basis |
|---|---|
| Providing the service | Performance of a contract |
| Billing and records | Legal obligation and contract |
| Security and abuse prevention | Legitimate interests |
| Product analytics on aggregated metadata | Legitimate interests |
| Marketing email | Consent, withdrawable at any time |
5. Who we share it with
Model providers receive the content of your request in order to generate a response, over encrypted transport and, wherever the provider offers it, on zero-retention terms. They do not receive your identity or billing details. Our other processors — hosting, payments, email, error monitoring — are listed and versioned at /subprocessors/.
6. International transfers
We are based in the United States and our providers operate globally. Transfers out of the UK and EEA rely on the UK IDTA and the EU standard contractual clauses, with a transfer risk assessment on file. Enterprise workspaces may pin processing to a single region; see Security.
7. Retention
| Data | Retained |
|---|---|
| Thread content | Until you delete it; purged from backups within 30 days |
| Usage metadata | 24 months |
| Billing records | [7] years, as required by tax law |
| Security logs | 12 months |
| Closed accounts | Deleted within 30 days, except records we must keep |
8. Your rights
Depending on where you live you may have rights to access, correct, delete, port or restrict your data, to object to processing, and to complain to a regulator. Export and deletion are self-service in the workspace under Settings. For anything else write to privacy@swurl.ai; we respond within 30 days.
California residents: we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not use sensitive personal information for inferring characteristics.
9. Children
The service is not directed at anyone under 16 and we do not knowingly collect their data. If you believe we have, write to us and we will delete it.
10. Changes
Material changes are announced by email and in the product at least 30 days before taking effect. The current version and its date are always at the top of this page.