Swimm AI

The Privacy Policy mentions using data for 'Quality Control and Training' and 'Research and Development of Our Services' based on legitimate interest, but does not explicitly state whether user content or codebase data is used to train AI models. Language is vague about the scope of 'training' purposes.

“[Privacy] 'Quality Control and Training. We may use or access Personal Data for the purposes of quality control related to the Services and staff training.' and 'Research and Development of Our Services' based on legitimate interest.”

The ToS restricts use of website Content but does not clearly address the license scope for user-generated content or codebase data submitted to the Solution. The policy is silent on whether Swimm claims rights to customer content uploaded to the platform.

“[ToS] 'Except with our express written permission or as permitted by applicable laws, you may not copy, distribute, reproduce, mirror, frame, publicly display, publicly perform, translate, create derivative works of, re-publish or transmit the Websites or Content.' (applies to website content only, not user submissions)”

The Privacy Policy shares data with 'service providers,' 'professional advisors,' and mentions sharing with 'partners' and 'conference sponsors' where legally permitted, but lacks a published sub-processor list and does not clearly restrict sharing to essential infrastructure providers only.

“[Privacy] 'We may share your Personal Data with service providers that provide us with support services, such as secure website hosting, cloud storage, information technology maintenance, transaction monitoring, network infrastructure, payment processing, security, fraud detections, customer support and analytics.' No sub-processor list provided.”

Retention periods are stated for some data types (marketing contacts retained 'on an ongoing basis,' cookies up to one year, call recordings up to six years) but the policy lacks clear guidance on retention of customer codebase data and Solution-related content, creating ambiguity.

“[Privacy] 'Contact Information such as your name, email address and telephone number for marketing purposes is retained on an ongoing basis until you unsubscribe. Information collected via technical means such as cookies, webpage counters and other analytics tools is kept for a period of up to one year from expiry of the cookie.'”

Neither the ToS nor Privacy Policy explicitly addresses ownership of outputs generated by the Solution or codebase content submitted by users. The absence of clear IP ownership language for Solution-generated content creates moderate ambiguity.

“[ToS] 'All text, graphics, photographs, trademarks, logos, icons, user interfaces, sounds, music, videos, artwork, software and computer code...is owned by or licensed to us.' (refers to website content only, not user submissions to Solution)”

The Privacy Policy mentions implementing 'appropriate technical and organizational measures' and references GDPR/UK/EEA compliance with Standard Contractual Clauses, but provides no evidence of SOC 2, ISO 27001, HIPAA, or other formal security certifications. No trust page or published security documentation is referenced.

“[Privacy] 'Swimm maintains appropriate organizational and technical measures designed to protect the security and confidentiality of any Personal Data we process.' and 'We will use European Commission–approved Standard Contractual Clauses and UK ICO approved International Data Transfer Addendums where required' (no certifications mentioned)”