Privacy Policy

Swazona Ltd is the controller of your account, billing and contact data. That means we decide how it is used.

The code and files you give us may contain personal data, such as names or email addresses in a seed file. For that data we are your processor: we handle it only to provide the service, under the Data Processing Addendum in section 13.

• Account details: your name, your email address, and your GitHub username if you sign in with GitHub.
• Code you connect through our GitHub App or upload as a .zip file.
• Product requirement documents (PRDs) and business documentation that you give us or that we write with you.
• What our work produces: findings, tasks, test results and evidence records.
• Tokens we issue to your AI agent, and what your agent does with them, such as reading tasks and reporting fixes.
• For Review: pull-request metadata, such as the title, author, branch and the files changed.
• Emails you send us, including orders, and our replies.
• Billing records: what you bought, when, and your invoices. Stripe holds your card details; we never see them.
• Minimal technical logs: IP address, request times and errors, used to run and protect the service.

• To provide the services you ask for, take payment, and send you reports and service emails: this is needed for our contract with you.
• To keep the service secure, prevent abuse and improve how we work: these are our legitimate interests, which we weigh against your rights.
• To keep billing and tax records: this is a legal obligation.
• To send you marketing emails: only with your consent, which you can withdraw at any time.

When you connect a repository or upload a .zip file, we receive a copy of your code and store it on our servers. We work only on that separate copy.

• We never connect to your live database or production systems.
• If we find keys, passwords or other secrets in your code, we never use them. We tell you, so that you can change them.
• We never change your code. Fixes are made by your own AI agent or developer.
• Our GitHub App reads only the repositories you choose, and you can remove its access in GitHub at any time.

We use only strictly necessary cookies, for example to keep you signed in and to remember your language. We use no advertising cookies and no analytics cookies.

We share personal data only with the service providers (sub-processors) listed at the end of this policy, and only what each one needs to do its job. Each one works under a data-processing agreement.

We send code and related context to Anthropic and OpenAI, whose AI models help us review code and write reports. We use them only under business or API terms that forbid training on customer content, and we never train any model on your code.

Stripe takes payments. For card data, Stripe is also an independent controller under its own privacy policy.

We may also share data when the law requires it, to protect our rights or our users, or with a buyer if Swazona Ltd is sold, under the same protections. We never sell your personal data.

See the list of sub-processors

Our servers are in Frankfurt, Germany. Some providers, such as our AI and email providers, are in the United States. When personal data leaves the UK or the EU, we rely on an adequacy decision (including the UK–US Data Bridge and the EU–US Data Privacy Framework, for providers certified under them), or on the UK International Data Transfer Agreement or Addendum and the EU Standard Contractual Clauses. Email legal@swazona.ai for a copy of these safeguards.

• Account details: while your account is open, plus 30 days.
• Code and uploads: while your account is open. If you ask us to delete them, we do so within 30 days, and copies in our backups roll off within 35 days.
• Findings, tasks, test results and evidence records: while your account is open.
• Billing records: 6 years, as UK tax law requires.
• Technical logs: 30 to 90 days.

Data travels to and from Swazona over encrypted connections. Our backups are encrypted and kept on servers we operate. Only the people who need access to do the work have it.

Tokens we issue for your agent are stored hashed, work only for your app, and can be revoked at any time.

If a personal data breach affects your data, we tell the regulator within 72 hours where the law requires it, and we tell you without undue delay.

Depending on where you live, you can ask to see the personal data we hold about you, correct it, delete it, receive a copy in a portable format, restrict or object to how we use it, and withdraw your consent. Email legal@swazona.ai and we reply within one month.

If you are unhappy with how we handle your data, please tell us first. You can also complain to the UK Information Commissioner’s Office (ico.org.uk) or to the data protection authority where you live.

Swazona is not for anyone under 18, and we do not knowingly collect data about children.

This addendum applies when the code or files you give us contain personal data. It forms part of our Terms of Service and sets out the terms required by Article 28 of the UK GDPR and the EU GDPR. You are the controller of that data and we are your processor.

The data is whatever personal data your code or files contain, such as names, email addresses and other details of your users. We process it only to review and test your code and report to you, for as long as we provide the service.

We:

• act only on your documented instructions, which are these terms and the work you order;
• make sure everyone who handles the data is bound by confidentiality;
• keep the data secure, as described in the Security section;
• use only the sub-processors listed in this policy, under written terms that protect the data in the same way, and tell you before we add or replace one so that you can object;
• help you answer requests from people using their data rights, and help with security, breach notices and impact assessments where needed;
• tell you within 48 hours of becoming aware of a personal data breach that affects your data;
• delete the data when the service ends or when you ask, unless the law requires us to keep it;
• give you the information you need to show that these terms are met. Audits are done by documents: we answer your reasonable written questions and share our records.

We may update this policy, and we change the date at the top when we do. If a change is significant, we email you before it takes effect.

Email legal@swazona.ai, or write to Swazona Ltd, 142 Cromwell Road, London SW7 4EF, England.