Privacy Policy

SWELL's role depends on the context in which Personal Information is processed.

A. Information SWELL controls

SWELL generally determines the purposes and means of processing Personal Information relating to:

• Website visitors
• Prospective customers
• Account administrators
• Billing contacts
• Business contacts
• Sales inquiries
• SWELL marketing communications
• Platform-security information
• SWELL's own business operations

For such information, SWELL may act as a “controller,” “business,” or equivalent entity under applicable privacy law.

B. Information processed for clients

Where a Client submits Personal Information to SWELL and SWELL processes that information solely to provide services on the Client's documented instructions, the Client generally determines the purposes and means of processing.

In those circumstances, SWELL may act as a:

• Processor
• Service provider
• Contractor
• Similar legally defined processing entity

The applicable Client remains responsible for providing legally required notices, obtaining required consents, establishing an appropriate legal basis, and responding to individuals whose information it controls.

SWELL may process Client Data to provide the Platform and requested services.

SWELL does not use identifiable Client Personal Data, Client Confidential Information, or Client Content to train generalized artificial-intelligence models unless Client expressly authorizes such use in writing.

SWELL may use:

• Aggregated information
• De-identified information
• Statistical information
• Usage telemetry
• Diagnostic information
• Other information that does not reasonably identify Client or an individual

for product improvement, analytics, security, benchmarking, and business operations.

Certain Client-requested Platform features may transmit information to third-party AI providers acting as service providers or subprocessors.

During the preceding twelve months, depending on Platform functionality and the nature of the relationship, SWELL may have collected categories of Personal Information including:

• Identifiers
• Customer-record information
• Commercial information
• Internet or electronic-network activity
• Professional or employment-related information
• Approximate geolocation information
• Audio or visual information
• Inferences
• Account credentials
• Communications
• Payment and transaction information
• Client-submitted business data
• Sensitive Personal Information where specifically required for an authorized business purpose

Sources may include:

• The individual
• The individual's employer
• SWELL Clients
• Authorized users
• Connected third-party services
• Service providers
• Public sources
• Analytics technologies
• Business partners

SWELL does not seek to collect Sensitive Personal Information unless reasonably necessary for an authorized Platform or business purpose.

Depending upon applicable law, Sensitive Personal Information may include information such as:

• Account credentials
• Precise geolocation
• Government identifiers
• Financial-account information
• Certain health information
• Racial or ethnic origin
• Religious beliefs
• Sexual orientation
• Biometric information
• Contents of certain private communications

Clients should not submit Sensitive Personal Information unless the specific Platform workflow requires and permits its processing.

SWELL does not use Sensitive Personal Information to infer characteristics about individuals except as permitted by applicable law.

Clients in healthcare-related industries must not submit PHI through the Platform unless the applicable workflow has been specifically approved by SWELL and is covered by a legally sufficient Business Associate Agreement where required.

A general account, SOW, Privacy Policy, or TOS does not authorize PHI processing.

Certain health-related information may be subject to state consumer-health privacy laws even when HIPAA does not apply.

SWELL may impose additional consent, configuration, contractual, deletion, access, or vendor requirements before permitting such information to be processed.

SWELL may engage third-party vendors to assist with:

• Cloud hosting
• Artificial intelligence
• Data storage
• Payment processing
• Analytics
• Cybersecurity
• Customer support
• Telecommunications
• SMS
• Email
• CRM functionality
• Data enrichment
• Monitoring
• Other business operations

These providers may receive Personal Information only to the extent reasonably necessary to provide their contracted services or as otherwise permitted by law.

Where SWELL acts as a processor or service provider for a Client, SWELL will impose applicable contractual data-protection obligations on material subprocessors as required by law.

SWELL may maintain and periodically update a list of material subprocessors.

SWELL maintains administrative, organizational, and technical measures designed to protect Personal Information appropriate to the nature of the data processed.

No system is completely secure.

If SWELL confirms a security incident involving Personal Information for which notification is required under applicable law, SWELL will provide legally required notifications within applicable timeframes.

Where SWELL acts as a processor or service provider, security-incident notification obligations may also be governed by the applicable Data Processing Addendum.

SWELL retains Personal Information only for as long as reasonably necessary for legitimate business, contractual, security, operational, or legal purposes.

Retention periods are determined based on factors including:

• Nature and sensitivity of information
• Purpose for which information was collected
• Contractual requirements
• Legal requirements
• Security considerations
• Fraud-prevention needs
• Litigation or dispute holds
• Backup schedules
• Client instructions

When information is no longer reasonably required, SWELL may delete, anonymize, or de-identify it.

Deletion from active production systems may not result in immediate deletion from disaster-recovery or backup systems.

Backup information may remain until overwritten or deleted according to normal backup cycles, provided it remains protected and is not restored for ordinary business purposes except as necessary for recovery or compliance.

If the California Consumer Privacy Act, as amended (“CCPA”), applies to SWELL's processing, California residents may have the right, subject to applicable limitations and exceptions, to:

1. Request information regarding Personal Information collected about them
2. Access specific pieces of Personal Information
3. Request correction of inaccurate Personal Information
4. Request deletion
5. Obtain information regarding categories of sources
6. Obtain information regarding business or commercial purposes for processing
7. Obtain information regarding categories of third parties receiving Personal Information
8. Opt out of the sale or sharing of Personal Information
9. Limit certain uses of Sensitive Personal Information where applicable
10. Exercise applicable rights concerning certain automated decisionmaking technologies where required by law
11. Exercise applicable rights without unlawful discrimination

SWELL will process verified requests in accordance with legally required procedures and timeframes.

Certain Platform functions may use artificial intelligence, automated workflows, scoring, classification, recommendations, or other automated technologies.

SWELL generally provides these technologies as tools to business Clients and does not independently determine how Client-generated outputs are used in Client's business decisions.

Where applicable law grants rights relating to covered automated decisionmaking technology, SWELL will comply with requirements applicable to SWELL's role.

Clients remain responsible for determining whether their own use of Platform-generated recommendations or automated workflows triggers notice, consent, opt-out, access, risk-assessment, or other obligations under applicable law.

SWELL does not sell Personal Information for monetary consideration.

However, depending upon SWELL's use of website advertising, analytics, cookies, pixels, or similar technologies, certain disclosures may constitute “sharing,” “sale,” or use for targeted advertising under some state privacy laws.

Where such laws apply, SWELL will provide legally required opt-out mechanisms.

This may include recognition of legally valid browser-based opt-out preference signals where required.

The Swell Digital Marketing OS Platform is intended for business users and is not directed to children.

SWELL does not knowingly permit children under 13 to create Platform accounts.

Where a Client submits Personal Information concerning minors through an authorized workflow, Client is responsible for having all legally required authority, consent, and notices for such processing.

Nothing in this Policy authorizes Client to use the Platform in violation of laws protecting minors.

SWELL is based in the United States and may use service providers located in the United States and other countries.

Where Personal Data is transferred internationally and applicable law requires a transfer mechanism, SWELL may use legally recognized mechanisms such as:

• Standard Contractual Clauses
• Appropriate contractual safeguards
• Adequacy decisions
• Other legally permitted transfer mechanisms

Additional terms may be contained in SWELL's Data Processing Addendum.

To protect Personal Information, SWELL may take reasonable measures to verify the identity and authority of a person submitting a privacy request.

Verification may include matching information provided with existing account or business records.

SWELL will request only information reasonably necessary for verification.

An authorized agent may submit a request where permitted by applicable law, subject to verification of the agent's authority.

Residents of jurisdictions that provide a right to appeal a denied privacy request may submit an appeal by contacting SWELL at the privacy address below.

Privacy email: Hello@swell.country

The request should identify the original decision being appealed.

SWELL will process appeals in accordance with applicable law.

Where SWELL processes Personal Data on behalf of a business Client, the processing may be governed by SWELL's Data Processing Addendum (“DPA”).

The DPA may address:

• Processing instructions
• Controller and processor roles
• Service-provider restrictions
• Confidentiality
• Security
• Subprocessors
• Data-subject requests
• Security incidents
• Deletion and return
• Audits
• International transfers
• Applicable state privacy requirements

If this Privacy Policy conflicts with a signed DPA concerning Client-controlled Personal Data, the DPA controls with respect to that processing.

SWELL may use business-contact information to:

• Administer customer relationships
• Provide service notices
• Manage contracts
• Communicate regarding Platform functionality
• Provide support
• Conduct account management
• Send relevant business marketing where permitted
• Maintain business records

Recipients may opt out of promotional communications without affecting necessary transactional communications.

If SWELL materially changes the purposes for which Personal Information is collected or processed, SWELL will update this Privacy Policy and provide additional notice or obtain consent where required by applicable law.

SWELL will not materially expand the use of Personal Information in a manner inconsistent with legally required notices or consents without completing applicable compliance steps.

Privacy requests and questions may be directed to Swell Country LLC, d/b/a Swell Digital Marketing OS.

Privacy email: Hello@swell.country

Business address: 5904 Warner Ave. Ste A2002, Huntington Beach, CA 92649

Where applicable law requires an additional request method or telephone number, SWELL will publish such method before the applicable requirement applies.