Privacy Policy

This Privacy Policy explains how Swizzle Inc., which operates Achiral AI, collects, uses, discloses, and protects personal information when you visit our website, create an account, use the Service, or contact us. We, us, and our mean Swizzle Inc. For this processing, we are the controller.

Customer Content is different. When an organization uses the Service, we process the content in its account, including data from sources it connects, on the organization's behalf. The organization's own privacy notice governs that processing, and our Data Processing Policy sets our duties to the organization.

Account information: name, email address, organization name, role, account settings, administrator status, and invited-user details. You sign in with a link we email you, so we do not store a password for you.

Billing information: billing contact details, plan, invoices, tax details, and records from our payment processor. Our payment processor collects card numbers. We never receive full card numbers.

Communications: support requests, billing questions, security reports, contact-form and application submissions, survey answers, feedback, and other messages you send us.

Technical and usage information: IP address, device and browser details, logs, session events, product usage events, security events, integration status, and approximate location derived from the IP address. We do not collect precise location from your device.

Connected-account information: when you connect a tool such as Google, Slack, or Microsoft 365, we receive the account identifier and access tokens the provider issues. We encrypt the tokens. Data we then read from the tool is Customer Content.

We collect this information from you, from your organization's administrators when they invite you, from tools you connect, from our payment processor, and automatically when you use our website or the Service.

Customer Content may include prompts, messages, documents, connector data, Memory API requests and responses, Shelby agent runtime context, memory records, memory candidates, retrieval results, generated outputs, configuration data, and feedback submitted through an organization account.

Memories, their embeddings, and the source data an organization connects are stored and indexed on infrastructure Achiral AI operates, and so are their backups. We never send them to an AI company to be stored or indexed.

Each organization brings its own model. The only Customer Content that leaves our infrastructure for AI processing is the limited data a single answer, narrative, or extraction needs: the request, the relevant excerpts from memory and connected sources, and recent conversation context. We send it to the model provider the organization connects, under the organization's own agreement with that provider. Before a provider is connected, or if it fails and the organization allows the fallback, requests run on models Achiral AI hosts, and processing stays on infrastructure Achiral AI operates. The Data Processing Policy explains this in detail.

We do not use Customer Content to train or fine-tune AI models, ours or anyone else's, unless your organization agrees in a separate written agreement.

We use personal information to provide the Service, which includes creating and running accounts, processing billing, giving support, and sending service messages. Where the GDPR or UK GDPR applies, our legal basis is performance of our contract with you or your organization.

We use it to keep the Service secure, detect and prevent abuse, fix problems, and improve the Service, including by studying usage, latency, error, rate-limit, and storage signals. For the Memory API, Shelby, connectors, automations, and inference, this includes API telemetry, token and scope metadata, agent identifiers, and memory provenance. Our legal basis is our legitimate interest in running a secure, reliable product.

We use contact details to tell business customers and prospects about our products. You can unsubscribe at any time. Our legal basis is our legitimate interest in promoting our business, or your consent where the law requires it.

We use it to comply with law, respond to lawful requests, enforce our terms, and establish or defend legal claims. Our legal basis is legal obligation or our legitimate interest in protecting our rights.

We may create aggregated or de-identified information. We do not try to re-identify it, and we contractually require anyone we share it with not to either.

The Service uses only cookies it needs to work, such as cookies that keep you signed in and protect forms against forgery.

Our website uses Google Analytics to count visits and see which pages people use. Google Analytics sets cookies and receives your IP address and browser details. Our website also loads a Google script for news-source preferences, uses a cookie to remember whether you closed a banner, and uses Cloudflare Turnstile to block spam on the contact form.

We do not use advertising cookies or pixels. You can block or delete cookies in your browser settings, and Google offers a browser add-on that opts you out of Google Analytics.

We disclose personal information to service providers that help us run the Service and our business, such as network delivery and security, email delivery, payment processing, website analytics, and professional advisers. They may use it only to provide services to us.

When your organization connects a model provider or a third-party tool, we send data to that provider on your organization's instruction. Your organization's agreement with the provider governs its processing.

We disclose information to your organization's administrators, to comply with law or valid legal process, to protect rights and safety, to investigate abuse or security incidents, and as part of a merger, acquisition, financing, or similar transaction. In a transaction, this policy will continue to protect the information transferred, or we will tell you before it becomes subject to a different policy.

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as California law defines those terms.

Achiral AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use data from Gmail, Google Calendar, and Google Drive only to provide and improve the features you use in the Service. We do not use it for advertising, we do not sell it, and we do not use it to train AI models. We transfer it only as needed to provide those features, such as to the model provider your organization connects, for security, or to comply with law. Our staff read it only with your permission, for security, or to comply with law.

We keep account information while your account exists. When you delete your account, we delete your conversations and personal memory and anonymize your user record. We keep billing and tax records for as long as tax and accounting laws require.

We keep logs for set periods. Organization activity logs are kept for 90 days, retrieval events for 30 days, product usage events for 180 days, and memory access logs for 2 years. We keep other records only as long as needed for the purposes in Section 4, including security, legal claims, and proof of agreements.

Customer Content follows organization settings and the Data Processing Policy. Deleted data can remain in backups until those backups are removed.

We protect personal information with administrative, technical, and organizational safeguards. They include a separate tenant boundary for each organization, encrypted connections between browsers and the Service, encrypted storage of connector tokens and model-provider keys, role-based access, and logs of access to memory.

No online service is perfectly secure. Customers are responsible for their own users, permissions, connected tools, credentials, and devices.

Depending on where you live, you may have the right to know what personal information we hold about you, get a copy of it, correct it, delete it, object to or restrict some processing, withdraw consent, and move your data to another service. You can export your own data from your account settings.

To make a request, email [email protected]. We will verify your identity, usually by confirming control of your account email address. You may use an authorized agent; we will ask for proof that the agent may act for you. We answer within the time the law sets, such as one month under the GDPR and 45 days under California law.

If your request concerns Customer Content that we process for an organization, we will send it to that organization, which decides how to respond.

If we deny your request, we will explain why. You can appeal by replying to our answer, and we will review the decision. We will not treat you differently for exercising your rights.

This section applies to California residents and supplements the rest of this policy. In the past 12 months we have collected these categories of personal information under California law: identifiers, such as name, email address, and IP address; customer records, such as billing details; commercial information, such as plans and purchases; internet and network activity, such as usage and log data; approximate location derived from IP addresses; and professional information, such as job role and organization.

Some data counts as sensitive personal information: the access tokens for accounts you connect, and the contents of email and messages when you connect an email or chat tool. We use and disclose it only to provide the Service and for the other purposes California law allows. We do not use it to infer characteristics about you.

We collect each category from the sources in Section 2, for the purposes in Section 4, and keep it for the periods in Section 8. We disclose each category for business purposes to the recipients in Section 6. We do not sell or share personal information, including that of consumers under 16.

California residents have the right to know, access, correct, and delete personal information, and the right not to be discriminated against for using these rights. Section 10 explains how to use them. Because we do not sell or share personal information, or use sensitive personal information beyond permitted purposes, the rights to opt out of sale or sharing and to limit use of sensitive personal information do not apply.

We do not disclose personal information to third parties for their own direct marketing.

Swizzle Inc. is the controller for the processing this policy describes. Section 4 gives our legal bases.

We and our service providers may process personal information outside the country where you live, including in the United States. When we transfer personal information from the European Economic Area, the United Kingdom, or Switzerland, we use the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism. Contact us for a copy.

You may complain to the data protection authority where you live or work. We would like the chance to resolve your concern first, so please contact us.

Achiral AI is for business users who are at least 18 years old. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it.

When an Owner or Admin activates the Memory-Native Apps add-on or accepts changes to its terms, we record their user ID and role, the date and time, the price and document versions they accepted, billing identifiers, a keyed hash of their IP address, and their browser's user agent.

We store a keyed hash instead of the IP address. The hash uses a secret key held by Achiral AI, so no one can recover the address by hashing every possible IP address. We can still check whether a known IP address matches the record. If the key is unavailable, we store no IP information.

We use this record to show who agreed to the add-on, at what price, under which terms, and when; to resolve billing disputes and support requests; and to meet legal record-keeping duties. Where a legal basis is required, we rely on our legitimate interest in keeping proof of the agreement. We never edit these records. We keep them while the add-on is active and afterwards for as long as these purposes require.

Apps also record which user ran or viewed an app and which user took an action through it. App run records are deleted after 90 days. Members who can see an app can see the name of its steward.

We may update this Privacy Policy. The date at the top of this page shows the current version. Before a material change takes effect, we will tell account Owners by email or in the product.

Questions and privacy requests may be sent to [email protected], or by mail to Swizzle Inc., Attn: Privacy, 1908 Thomes Ave STE 71455, Cheyenne, WY 82001.