Legal

Privacy Policy

Education Bot, Inc. (operating as swivl)  ·  Effective Date: January 10, 2026  ·  Last Updated: January 10, 2026

1. Who We Are

swivl is an AI Operations Platform purpose-built for self-storage operators and related businesses, operated by Education Bot, Inc., a Delaware corporation headquartered in Austin, Texas. For personal information collected directly from website visitors and prospective customers, swivl acts as a data controller. For tenant and lead data submitted by Customers through the platform, swivl acts as a data processor governed by our Data Processing Addendum.

---

2. Information We Collect

2.1 Information You Provide Directly

We collect personal information you provide when you create an account, fill out a contact or demo request form, subscribe to communications, or contact our sales, support, or customer success teams. This may include your name, email address, phone number, job title, and company name.

2.2 Account and Platform Information

When you use swivlStudio, we collect information related to your account such as login credentials (stored in hashed form), account configuration settings, user preferences, and usage activity within the platform.

2.3 Communications and Voice Data

Our platform processes communications on behalf of our Customers, including inbound and outbound SMS messages, email threads, web chat transcripts, and voice call recordings and transcriptions. This data is processed in our role as a data processor under our Customers' instructions. We do not use this Customer-submitted communications data for our own marketing or analytics purposes.

2.4 Automatically Collected Information

When you visit our websites, our servers and third-party analytics tools may automatically collect certain technical information, including IP address and approximate geographic location, browser type and version, operating system, pages visited and time spent on our websites, referring URLs, and device type. This information is used in aggregate form to understand how visitors use our websites and to improve our Services.

2.5 Information We Do Not Collect

We do not collect or process: payment card or financial account information, video recordings of office visitors, biometric data, or data from children under 18.

---

3. How We Use Your Information

3.1 Providing and Operating the Services

Creating and managing your account, delivering the swivlStudio platform and its features, authenticating users and maintaining security, and processing and fulfilling your requests.

3.2 Customer Support and Communications

Responding to inquiries, support requests, and feedback; sending service-related notices, updates, and alerts; and communicating about your account or subscription.

3.3 Sales and Marketing

Sending marketing communications to prospective and current customers where you have opted in or where permitted by applicable law, and personalizing communications based on your role and expressed interests.

3.4 Product Improvement and Analytics

Analyzing aggregate usage patterns to improve product features and reliability, measuring how our websites and Services are used, and conducting internal research and development.

3.5 Legal and Compliance

Complying with applicable laws and regulations, enforcing our Terms of Use and other agreements, protecting our rights and property, and responding to lawful requests from government authorities.

---

4. Legal Bases for Processing

Where applicable law requires a legal basis for processing personal information, we rely on the following: Contract performance for processing necessary to perform our agreement with you; Legitimate interests for improving our Services, marketing to prospective customers, and maintaining platform security; Legal obligation for processing required by applicable law; and Consent where we rely on your consent for certain marketing communications, which you may withdraw at any time.

---

5. How We Share Your Information

We do not sell your personal information. We may share personal information with service providers and subprocessors who process it on our behalf (contractually required to protect it); with our self-storage Customers who control tenant data; with law enforcement or government authorities as required by law; and with acquirers in connection with a business transaction, subject to equivalent privacy protections.

---

6. Data Retention

We retain personal information only as long as necessary to fulfill the purposes described in this policy, or as required by applicable law. Retention periods are based on the duration of our contractual relationship, legal obligations, applicable statutes of limitations, and our legitimate business interests in maintaining accurate records. When personal information is no longer required, we delete or anonymize it in a manner designed to prevent unauthorized recovery.

---

7. Security

We implement administrative, physical, and technical safeguards to protect personal information against unauthorized access, alteration, disclosure, or destruction. Our security practices include TLS encryption in transit, encryption at rest where appropriate, logical access controls, regular security review, and confidentiality obligations for personnel with access to personal information. Our Services are hosted on Heroku on US-based servers. Telephony infrastructure is powered by Twilio. No method of electronic transmission or storage is 100% secure. If you believe your information has been compromised, please contact us immediately at info@tryswivl.com.

---

8. Canadian Residents

PIPEDA & Provincial Laws

If you are a resident of Canada, additional rights and protections apply under the federal Personal Information Protection and Electronic Documents Act ("PIPEDA") and applicable provincial privacy legislation, including the Act Respecting the Protection of Personal Information in the Private Sector (Quebec Law 25).

8.1 Consent

We collect, use, and disclose your personal information only with your knowledge and consent, except where otherwise permitted or required by law. By providing us with your personal information, you consent to its collection, use, and disclosure in accordance with this policy.

8.2 Your Rights Under Canadian Law

As a Canadian resident, you have the right to access the personal information we hold about you, request correction of inaccurate or incomplete information, withdraw consent to our processing of your personal information (subject to legal and contractual restrictions), and file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

8.3 Cross-Border Data Transfers

Your personal information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in Canada. By using our Services, you acknowledge and consent to this transfer.

8.4 Quebec Residents

If you are a resident of Quebec, you have additional rights under Quebec Law 25, including the right to data portability and the right to request the anonymization or destruction of your personal information. To exercise these rights, please contact our Privacy team using the information in Section 15 below.

---

9. California Residents (CCPA/CPRA)

California Law

If you are a California resident, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) grants you additional rights. In the preceding 12 months, we have collected identifiers, commercial information, internet or network activity, audio and electronic data (voice recordings, platform users only), and professional or employment information.

As a California resident, you have the right to know what personal information we have collected, request deletion or correction, opt out of sale or sharing (we do not sell or share personal information for cross-context behavioral advertising), and non-discrimination for exercising your rights. To submit a request, contact us using the information in Section 15.

---

10. Your Privacy Rights

Depending on your location and applicable law, you may have the right to access, correct, delete, restrict, or receive a portable copy of your personal information, or to withdraw consent where our processing is based on consent. Contact us to exercise these rights. We will not discriminate against you for doing so. We may need to verify your identity before processing your request.

---

11. Client-Side Storage and Tracking

11.1 No Cookies for Tracking

We do not use cookies on our websites or platform for tracking or advertising purposes.

11.2 swivlStudio Platform

The swivlStudio platform uses browser local storage to maintain your session state and remember your preferences while you are logged in. This data is stored locally in your browser and is not transmitted to third parties.

11.3 Web Chat Widget

swivl's web chat widget, embedded on our Customers' websites, uses browser local storage to recognize returning visitors. When a visitor interacts with the chat, certain session identifiers and interaction preferences (such as the location they previously selected, their unit type interest, and price point) are stored locally in the browser. On a subsequent visit, the chat widget uses this stored information to personalize the greeting. This data is stored in the visitor's own browser, is not used for cross-site tracking or advertising, and is not transmitted to third parties. Visitors can clear this data at any time by clearing their browser's local storage through their browser settings.

If you are an operator using swivl's web chat widget on your website, you may need to disclose this use of browser local storage in your own privacy policy or cookie notice. See our Product Privacy Notice for guidance.

11.4 Third-Party Analytics

Our marketing websites may use third-party analytics tools that use cookies or similar technologies to help us understand how visitors use our sites. We use this information only in aggregate form. You can opt out through your browser settings or browser privacy extensions.

11.5 Do Not Track

We do not currently respond to "Do Not Track" browser signals, as no uniform standard has been adopted.

---

12. Children's Privacy

Our Services are intended for business users and are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we may have collected information from a child, please contact us at info@tryswivl.com.

---

13. International Data Transfers

swivl is headquartered in the United States, and our Services are operated from the United States. If you access our Services from outside the United States, your personal information will be transferred to and processed in the United States. We take appropriate steps to ensure that any such transfers comply with applicable data protection laws.

---

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our Services, or applicable law. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, provide additional notice. We encourage you to review this policy periodically.

---

15. How to Contact Us

If you are a Canadian resident and are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca. If you are a California resident, you may contact the California Privacy Protection Agency at cppa.ca.gov.