Privacy Policy

The controller for processing activities whose purposes and means are determined by SWAI is:

SWAI generally acts as controller when operating the Creator and processing account, subscription, billing, support, security and usage data.

When a business customer deploys a SWAI chatbot on its website, that customer generally determines the purpose and content of the conversations and is responsible for them. SWAI then processes conversation and knowledge data as a processor on the customer's instructions.

This policy applies to swai.chat and related subdomains, the Creator, the application programming interface and embedded SWAI chatbots. We process personal data under the Swiss Federal Act on Data Protection (FADP) and its Ordinance. Where the GDPR applies, processing is based, depending on the activity, on performance of a contract or pre-contractual steps (Art. 6(1)(b)), legal obligations (c), legitimate interests (f), or consent (a).

We obtain personal data from the following sources:

• directly from account holders, organisation members, support contacts and paying customers;
• from business customers that manage accounts, provide knowledge content or embed a chatbot;
• from visitors who communicate with an embedded chatbot;
• from public websites that an authorised user expressly selects for crawling;
• automatically from browsers, devices, servers and connected services.

• Identity, account and profile data, including name, email address, user identifier, organisation, role and access rights.
• Contract, subscription, invoice, usage and payment data. Full card or bank details are processed directly by Stripe and are not stored by SWAI.
• Chatbot configurations, system prompts, authorised domains, translations, FAQs, uploaded documents and content from expressly selected public websites.
• Chat and interaction data, including messages, generated responses, session identifier, timestamps, retrieved knowledge excerpts and any feedback.
• Files that visitors attach to a chat message, if the business customer has enabled file uploads (images, PDF and Word documents up to 5 MB). They serve only to answer the visitor in that conversation: the file, or the extracted text of a Word document, is sent to Google Gemini and kept with the conversation memory in our database at Supabase in Switzerland until the conversation is deleted. The visitor's browser keeps only the file name and type for the current session.
• Contact details and requests that visitors leave in a chat for a handover by email, if the business customer has enabled it: name, email address or phone number and the request. They are sent together with the conversation by email to the address the business customer has set. Apart from the conversation, in which they remain, SWAI only records the time of the handover.
• Technical, log and security data, including IP address, time, requested resource, referrer, browser and device information, and error or abuse signals.

• Providing and managing accounts, organisations, permissions and subscriptions; to perform our contract.
• Importing, splitting, indexing and searching knowledge sources, generating and delivering chatbot answers and, if the business customer has enabled it, forwarding visitor requests to it by email; to perform our contract.
• Managing payments, invoices, allowances and usage; to perform our contract and comply with legal obligations.
• Providing support and service communications; to perform our contract and in our legitimate interest in good customer support.
• Maintaining security, preventing abuse, diagnosing errors and ensuring availability and quality; in our legitimate interest in a secure and reliable service.
• Optional analytics (Google Analytics) only on the basis of consent (Art. 6(1)(a) GDPR) where consent is legally required.

We disclose personal data only where necessary for the purposes described above. Recipients include in particular:

• the relevant business customer and its authorised staff, who can view their chatbot's conversations, knowledge content, configurations and usage analytics;
• Supabase, Inc. (United States) for authentication, the application database and the conversation memory, including chat attachments, hosted in Switzerland (Zurich);
• Microsoft and affiliated companies for Azure application hosting, file storage and Azure OpenAI, which only creates embeddings (see section 11), all in the Azure region Switzerland North;
• Microsoft for email: Azure Communication Services Email (data stored in Switzerland) sends messages from our support, access-request and feature-request forms to our team and handover emails with a visitor's contact details, request and conversation to the business customer, and Microsoft 365 sends sign-in, invitation and password-reset emails and hosts our mailboxes;
• Cloudflare, Inc. (United States) as DNS provider and as proxy and content delivery network for the website and the Creator at swai.chat and for the chatbot scripts and images that cdn.swai.chat delivers to websites with an embedded chatbot, including protection against attacks. These requests pass through Cloudflare's global network and are processed in the data centre closest to the visitor;
• Weaviate B.V. (Netherlands) for the vector database and knowledge search, hosted in the EU;
• Google LLC for Google Gemini, which generates all chat answers and conversation summaries and reads files attached to a chat;
• Google Ireland Limited and Google LLC for web analytics (Google Analytics, Google Tag Manager), only after you have consented in the cookie banner;
• SideGuide Technologies, Inc. (Firecrawl) to crawl public web pages expressly selected by the user;
• Stripe Payments Europe, Limited and Stripe, Inc. for checkout, subscriptions, payments and invoice management;
• public authorities, courts, advisers or other third parties where disclosure is legally required or necessary to establish, exercise or defend legal claims.

Processors are contractually required to maintain privacy, confidentiality and appropriate security. Some providers, particularly Stripe, may also process certain data as an independent controller for their own legally defined purposes.

Depending on the selected AI model, project and provider configuration, and support case, data may be processed in Switzerland, the Netherlands, Ireland, other European Economic Area states and the United States. Cloudflare processes requests to swai.chat and cdn.swai.chat in the data centre closest to the visitor, which may also be outside Switzerland and the EEA. Providers may use approved subprocessors in further countries identified in their current subprocessor lists. If you consent to Google Analytics, usage data may also be transferred to and processed by Google in the United States.

For recipient countries without a recognised adequate level of protection, we use in particular recognised standard contractual clauses with the adaptations required for Switzerland and, where necessary, additional contractual, organisational or technical measures. Statutory exceptions are used only where their conditions are met. Information about safeguards applicable to a specific transfer can be requested using our contact address.

The website and the Creator use technically necessary cookies for login, security, session management, language settings and navigation, and to unlock password-protected demo pages. If you vote on our public roadmap, a cookie with a random identifier (swai_roadmap_voter, valid for one year) prevents duplicate votes; we store this identifier only as a hash. An embedded chatbot stores the conversation identifier, the messages of the current conversation and whether the chat window or its greeting popup was closed in the browser's session storage, so that the conversation can continue while the tab stays open. Attached files themselves are not stored there. It also remembers the chosen chatbot language in a session cookie (i18next) and in local storage (i18nextLng) of the website where it is embedded. Your cookie choice is stored in your browser's local storage, and the banner asks again after 180 days. The cookie banner manages only Google Analytics (see below). The cookies and storage described in this paragraph are needed for the functions you use and are therefore not covered by the banner.

On our public website pages (including this one) we optionally use Google Analytics 4 by Google to understand how visitors use our website. Google Analytics is loaded via Google Tag Manager (googletagmanager.com) and only after you have accepted analytics cookies in the cookie banner. It then sets the cookies _ga and _ga_<container ID>, which allow Google to recognise a browser and group page views into sessions, and usage data such as pages viewed, approximate location and browser and device information is transmitted to Google. We do not use Google Signals or advertising personalisation features. The legal basis is your consent (Art. 6(1)(a) GDPR, or consent under the FADP).

You can change your choice or withdraw your consent at any time with the cookie settings button at the bottom left of our website. After you withdraw, Google Analytics is no longer loaded and its cookies are deleted.

• Account, profile, configuration, knowledge and conversation data are generally retained for the duration of the account or contract, or until deletion by the authorised customer. After the contract ends, remaining data is deleted or anonymised once no longer needed for settlement and evidence purposes.
• For website imports, crawl jobs and intermediate results are needed only to perform and troubleshoot the import; imported content remains as a knowledge source until the customer deletes it.
• We generally retain contractual, billing and accounting records for ten years to comply with statutory obligations.
• Application, access and security logs are kept only as long as needed for operations, security and investigation of specific incidents. The period varies by system and event.
• Data collected by Google Analytics is deleted automatically after two months.
• Deleted data may remain temporarily in access-restricted backups until their scheduled overwrite. Statutory retention obligations and legitimate evidence-preservation needs remain reserved.

We implement technical and organisational measures appropriate to the risk, including encrypted transmission, role-based access, separated permissions, logging, backups and protection against abusive requests. No system is completely secure, and absolute protection cannot be guaranteed.

To generate an answer, the chat visitor's message, any attached file, the course of the conversation, relevant excerpts from the knowledge sources provided by the customer and instructions are sent to the Google Gemini model selected for the chatbot. Google Gemini generates all chat answers and, in longer conversations, summaries of earlier messages that serve as the chatbot's memory. Microsoft Azure OpenAI only creates embeddings, i.e. numerical representations of knowledge content and of search queries derived from visitor messages, which are used to find relevant excerpts; it does not generate answers. SWAI does not use customer or conversation data to train generally available AI models.

The service is not intended to make solely automated decisions about individuals that produce legal or similarly significant effects. Customers that use the chatbot in decision-relevant processes are responsible for appropriate human review and any additional required notices.

Subject to applicable law, you may in particular request access, correction, deletion, or delivery or transfer of your data. Where the GDPR applies, you may also have rights to restriction and objection. Consent can be withdrawn at any time with future effect. We may ask for proof of identity and may restrict rights to the extent permitted by law. You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, where applicable, a competent European supervisory authority.

If your request concerns a conversation with a business customer's chatbot, please first contact the operator of the relevant website. The operator will send any necessary instructions to SWAI.

Swiss Federal Data Protection and Information Commissioner (FDPIC)

Send privacy requests to info@swai-solutions.ch. We update this policy when the service, the providers used or the legal position changes materially. The version published on this page applies; its update date is shown at the top.