Applies to swiftsoftware.net and every SwiftSoftware product · Last updated: 9 November 2026
In one line: we collect what a product needs to work — your account, your billing details, the records you put in, and the technical data needed to run and secure the service. We do not sell personal data, we do not run advertising trackers, and we do not use your data to train AI models.
SwiftSoftware ("SwiftSoftware", "we", "us", "our") builds and operates business software. This single Privacy Policy covers swiftsoftware.net and every product listed in Exhibit A below. It replaces the separate privacy notices that used to be published per product, so there is one current version of our policy and no conflicting copies.
Where you use a product on behalf of a business, that business decides what is stored in its workspace. In that case we act on that business's instructions as its data processor, and you should ask them about your data first — we will help them answer you.
Account information. Name, email address, workspace/organisation name, role, and a password stored only as a salted hash (we never store or recover a readable password). Some products are public and allow self sign-up; others create accounts by administrator invitation only (see Exhibit A).
Billing information. Plan, subscription status, invoice history, and the last four digits and expiry of a card. Card numbers are entered directly with our payment processor (currently Stripe); we do not receive or store full card numbers.
Customer data. The records you or your authorised users put into a product — for example contacts, companies, notes, lists, campaigns, rewards balances, call records, workflow definitions, and uploaded files. You own this data; we process it to run the service for you.
Integration credentials. Where a product connects to a third party on your instruction, we store the credential needed for that connection: your own AI provider API keys, social-platform OAuth tokens, or messaging/telephony credentials. These are stored encrypted at rest (AES-256-GCM or pgcrypto AES-256, depending on the product) and are used only to make the calls you asked for.
Usage and technical data. IP address, browser and device type, pages or API routes requested, timestamps, error and diagnostic records, and security events. We keep audit records of privileged actions (sign-in, password change, publishing attempts, administrative changes).
Communications. The content of messages you send us, and delivery records for the transactional email we send you.
We do not knowingly collect special-category data (health, biometric, political, religious), and we ask you not to put it into a product unless the product is explicitly designed for it.
We do not sell personal data, we do not share it with advertisers or data brokers, and we do not use your customer data or content to train AI models.
We rely on: contract (to deliver the service you signed up for), legitimate interests (security, fraud prevention, reliability, and product improvement, balanced against your rights), consent (non-essential cookies and optional integrations, which you can withdraw at any time), and legal obligation (tax, accounting, and lawful requests).
Our marketing site uses a first-visit consent banner. Essential cookies keep you signed in and protect
forms; optional cookies help us understand aggregate usage, and you may decline them. Business products set
one session cookie when you sign in — HTTP-only, Secure, SameSite, expiring within 24 hours — and no
advertising or cross-site tracking cookies. Content Studio sets exactly one cookie,
studio_session, for the same purpose. Cloudflare, which fronts our sites, sets its own security
cookies as part of protecting the connection.
Only what is necessary, and only with:
We do not sell personal data. A change of control (merger or sale of assets) would transfer data to a successor bound by this policy.
Product data is stored on SwiftSoftware-controlled servers in the United States. Some providers (Cloudflare, Stripe, and the platforms you connect) may process data in other countries under their own safeguards, including standard contractual clauses where required.
Account records are kept while the account exists and for a short period afterwards to close it out. Records you created are kept while your workspace exists, so the service can show them. Billing and tax records are kept for the period the law requires. Security and audit logs are kept for a limited period sufficient to investigate incidents. Deleting an account removes its records and sessions; residual copies may survive briefly in routine backups.
Traffic is encrypted in transit (HTTPS). Passwords are hashed with Argon2 or bcrypt. Integration credentials and platform tokens are encrypted at rest. Sessions are HTTP-only, expire, and are revoked when a password changes. Access to production data is restricted to the administrators who need it, and privileged actions are logged. No system is perfectly secure, and we do not pretend otherwise — but none of this is optional for us.
You may ask us to show you the personal data we hold about you, correct it, export it, delete it, or restrict or object to a particular use, and you may withdraw consent for optional processing at any time. Email legal@swiftsoftware.net and we will respond within 30 days, or within the shorter period your local law requires. We may need to verify your identity first. You may also complain to your local data protection authority.
If your data reached us because a business uses one of our products, we will forward your request to that business and support them in answering it.
Our products are business tools. They are not directed to children, and we do not knowingly collect information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.
Some products offer AI-assisted features using a provider key you or your workspace supplies. Outputs are generated on your instruction, may be inaccurate, and are not used by us to make decisions with legal or similarly significant effects about you. We do not use your content to train models.
If this policy changes materially we will update the date at the top and, where appropriate, tell account holders by email or in-product. The version published at this URL is the one in force.
Privacy questions, data requests, and complaints: SwiftSoftware — Privacy, legal@swiftsoftware.net. You can also use our contact form. Postal and other business details are available on request.
This policy covers the following products. Each entry describes the data specific to that product; the rest of this policy applies to all of them.
| Product | What it is | Product-specific data and notes |
|---|---|---|
| CoreSwift CRM | Multi-tenant CRM: contacts, pipelines, calendars, lists and API access. | Workspace account data; the contact, company, deal and calendar records you create; a workspace API key stored only as a hash. Administrators of a workspace can see the data inside that workspace, and no workspace can read another's. Self sign-up available. |
| FunnelSwift | Lead generation, funnels and affiliate marketing. | Account and plan data via Stripe; the funnel content you build; and personal data submitted by visitors to your forms (name, email, phone and your own custom fields), which you control. Affiliate referral and commission records. Self sign-up available. |
| IncentiveSwift | Viral campaigns, referral and loyalty rewards. | Campaign and participant records; reward balances and ledger entries; payout details needed to pay a reward. Accounts and API keys; self sign-up available. |
| WorkflowSwift | Visual workflow automation and orchestration. | Workflow definitions, run history, and the credentials you attach to a step so it can call a service you nominate. A workflow runs only when you or your schedule trigger it; whatever it sends to a third-party node is your instruction. |
| ADASwift | ADA/WCAG accessibility scanning and remediation tooling, delivered to end clients by SwiftImpact Solutions. | The website URLs scanned and the findings produced. Scans inspect publicly reachable pages; the account is held by the delivering business, which is responsible for telling its clients what is scanned. |
| MissedCall Respondr | Missed-call capture, text-back and call handling. | Business phone numbers, call events (time, duration, caller number, missed/answered), and the SMS messages sent or received, carried by our telephony/SMS provider. Caller numbers are personal data; the business using the product is responsible for having a lawful basis and for honouring opt-outs. |
| Content Studio | In-house content library and social posting scheduler at studio.swiftsoftware.net. | Administrator-created accounts only (no public sign-up); titles, captions, file names and review status of finished media; scheduling and publishing records; and, only if an account is connected, the platform account identifier plus OAuth access and refresh tokens stored with AES-256-GCM. Tokens are used only to publish the posts you queue and read back whether they succeeded. Disconnect an account in Content Studio or revoke access in the platform's own settings (TikTok → Settings → Security & permissions → Manage app permissions; Google Account → Security → Third-party apps; Facebook → Settings → Apps and websites) and the stored token is deleted on our side. |
This policy is published in one place only — here, on swiftsoftware.net. If you find an older privacy notice on a product subdomain, this version governs.