Privacy policy

Our commitment to privacy

Effective date: 30 July 2026.

This Privacy Policy explains how SwarmCraft Pty Ltd collects, uses, stores, and discloses personal information when you visit the SwarmCraft website, create an account, use the product, request support, or interact with our billing, documentation, blog, or marketing surfaces.

SwarmCraft Pty Ltd (ACN 700 703 386) is an Australian company and the legal entity responsible for the personal information described in this policy. We handle personal information in line with applicable privacy obligations, including the Australian Privacy Principles where they apply.

What we collect

The personal information we collect depends on how you interact with SwarmCraft. In general, we collect the information needed to operate accounts, secure the service, provide support, process payments, and understand whether the public site is working as intended.

• Identity and contact details such as name, email address, organisation name, and support correspondence.
• Account, authentication, and security information such as login events, MFA state, and session activity.
• Account communication preferences and consent records such as support-notification settings, onboarding email settings, marketing opt-in state, consent timestamps, and recorded consent source.
• Workflow, project, and planning information that you submit through chats, forms, or connected tools.
• For Deep Discovery, the exact text Discovery Package you preview and explicitly authorize for submission, including its consent and digest metadata, server-side validation findings, and project-level compiler provenance. The package contains the nine reviewed discovery documents plus only the supporting text sources or sidecars you selected; raw binary files and unselected repository files are not uploaded.
• Transaction and billing information such as project unlock status, invoice records, and Stripe-related payment events. Full payment card details are handled by Stripe, not stored directly by SwarmCraft.
• Technical and usage information such as browser type, device data, IP-based approximate location, route usage, and site interactions where analytics consent has been granted.

How we use personal information

We use personal information to operate, secure, support, and improve SwarmCraft. The exact use will depend on the product feature, support request, or billing event involved.

• Create and administer accounts, chats, projects, billing flows, and related service features.
• Authenticate users, protect sessions, detect abuse, and enforce platform security requirements.
• Respond to questions, troubleshoot issues, and communicate about service changes or account matters.
• Send required security and service emails, optional product lifecycle emails that remain enabled in your profile, and marketing messages only after explicit opt-in has been recorded.
• Process payments, maintain billing records, and manage subscription or project-unlock status.
• Measure and improve the public site and related content where analytics consent has been provided.
• Use admitted Discovery Package snapshots as untrusted input to server-side AI and deterministic validation to create the purchased initial project board. SwarmCraft does not use package content to train public models and does not place document text, filenames, private prompts, or ticket text in ordinary analytics.

Cookies, analytics, and online interactions

SwarmCraft uses cookies and similar technologies on the public site. Some cookies are necessary for the site to function, remember essential preferences, and support core session or security behaviour. Necessary cookies remain enabled because the site cannot operate properly without them.

We may also use analytics cookies, but only after you opt in through the cookie controls we provide. Our public-site analytics model uses Google Tag Manager as the delivery layer, with Google Analytics and Microsoft Clarity expected to be configured through GTM. These analytics tools help us understand route usage, session flow, aggregate traffic patterns, and on-site interaction behaviour.

Where analytics consent is granted, analytics cookies may collect information such as device type, browser type, general usage patterns, pages viewed, approximate location based on IP address, and interaction signals like clicks, scroll depth, or heatmap-style behavioural insights.

• Necessary cookies support core site behaviour and cannot be disabled from our preference manager.
• Analytics cookies are optional and remain off until you opt in.
• You can reopen and change your cookie decision at any time through the footer Cookie Settings control or the Cookie Settings legal page.

Disclosure and service providers

We may disclose personal information to trusted service providers and advisers where that is reasonably necessary to operate SwarmCraft, secure the service, process payments, comply with law, or respond to legitimate business needs.

Examples may include hosting and infrastructure providers, authentication and email providers, analytics vendors used after consent, professional advisers, payment processors such as Stripe, and authorities where disclosure is required by law or reasonably necessary to protect rights, safety, or the service.

Deep Discovery may also use contracted AI model providers as subprocessors to interpret an admitted Discovery Package after Project Unlock. Provider and regional processing details are disclosed through current product or privacy materials; customer content is sent only for the contracted processing purpose and subject to the provider's configured training posture.

Security, retention, and overseas handling

We use technical and organisational measures designed to protect personal information against unauthorised access, misuse, loss, and disclosure. No online service can promise absolute security, so you should also protect your credentials, devices, and connected systems.

We keep personal information only for as long as we reasonably need it for the purposes described in this policy, including to provide the service, maintain records, resolve disputes, meet security needs, and comply with legal, accounting, or tax obligations. Some of our service providers may process information outside Australia.

An admitted Discovery Package snapshot is encrypted at rest and retained with its resulting project for provenance. An eligible unlinked snapshot may be deleted through its lifecycle; linked content follows the project deletion and backup-retention lifecycle. Access is limited by role and audited where support access is required.

Your choices and rights

You can contact us to request access to or correction of personal information we hold about you, subject to legal and operational limits. You can also manage analytics-cookie consent through our cookie controls, manage product and marketing email preferences from your authenticated profile page, and may choose not to provide certain information, although that may limit access to parts of the service.

Security-critical email categories such as verification and password reset remain enabled because they are required to operate and protect the account. Marketing email remains off unless you opt in.

• Request access to or correction of your personal information.
• Withdraw analytics-cookie consent through our preference controls.
• Manage support, onboarding, and marketing email preferences from your account profile, including withdrawing marketing consent at any time.
• Contact us if you believe your privacy has been handled improperly or if you want to make a complaint.

Contact and changes

Questions, access requests, correction requests, and privacy complaints should be sent to the Privacy Officer at hello@swarmcraft.ai. The responsible entity is SwarmCraft Pty Ltd (ACN 700 703 386).

We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date and publish the revised policy on this page.

Related legal documents