Legal  ·  For Operators

Product Privacy Notice

Education Bot, Inc. (operating as swivl)  ·  Effective Date: January 10, 2026

1. Understanding the Roles: Controller and Processor

When you use swivl to handle calls, texts, and web chat on behalf of your locations, two distinct roles exist under data protection law.

Because you are the Controller, your customers' and tenants' privacy rights run to you first. When an end user asks who recorded their call, or requests deletion of their data, they are exercising rights against your organization. swivl supports you in fulfilling those obligations, but the primary legal responsibility is yours.

---

2. What swivl Processes on Your Behalf

Through swivlStudio, swivl may process the following categories of personal information belonging to your customers, tenants, leads, and prospects, depending on the features you have enabled:

Category	Examples	Features Involved
Contact identifiers	Name, email, phone, address	All channels
Account and unit data	Balance, payment status, unit number, gate code	Support Agent, Billing Agent, FMS integrations
Voice recordings	Inbound/outbound call recordings and transcriptions	Voice AI (Disruptor), Contact Center
Written communications	SMS content, web chat transcripts, email	SMS, chat, email channels
Behavioral data	Reservation intent, collections response, review status	Agents, Sequences
Device and session data	IP address, browser type, local storage identifiers	Web chat widget

How swivl Retrieves Account Data: FMS Integration

Much of the account and tenant data swivl processes is retrieved in real time through a secure API connection to your Facility Management Software ("FMS"), such as SiteLink, StorEdge, QuikStor, or SSM Cloud. When an end user contacts your location via voice, SMS, or web chat, swivl queries your FMS to look up account details, unit information, gate codes, or payment status needed to fulfill the interaction.

A few important points on this:

• Your FMS vendors are not swivl's subprocessors. They are your own systems of record, operating under your separate agreements with those vendors. swivl queries them on your behalf but does not control or process data within those systems.
• Data accuracy depends on your FMS. swivl can only surface information that exists and is accurate in your FMS. If a record is incomplete or outdated, the data swivl retrieves will reflect that.
• FMS API credentials are provided by you. You are responsible for ensuring swivl's API access is properly authorized and that access is revoked upon termination of your swivl subscription.

---

3. Your Obligations as the Data Controller

Because you are the Controller, applicable privacy laws place specific obligations on your organization when you engage a vendor like swivl to process data on your behalf.

• Update your privacy policy. Your privacy policy must disclose that you use third-party AI communications technology to process customer and tenant interactions, including voice calls, SMS, and web chat. Identify swivl by name or by category. See Section 4 for sample language.
• Establish a lawful basis for processing. For most operators, this will be contract performance and legitimate interests. In jurisdictions requiring affirmative consent (Quebec, GDPR-covered locations), you are responsible for obtaining and documenting that consent.
• Obtain consent for outbound AI communications. If you use swivl's outbound voice AI, SMS sequences, or collections outreach, you are responsible for ensuring you have required consents under TCPA, CASL, and any other applicable law.
• Respond to data subject requests. When a customer or tenant exercises a privacy right, that request is directed to you. swivl will assist you in fulfilling such requests as described in our DPA. You are responsible for responding within applicable legal timeframes.
• Notify end users of voice recording. Many US states and Canadian provinces require notice before recording a call. You are responsible for ensuring your locations comply. swivl's platform supports configurable AMD disclosures and scripted openings to help.
• Honor opt-outs and suppression lists. swivl's platform honors opt-out statuses imported from your FMS. You are responsible for keeping those records accurate and current.

---

4. Updating Your Own Privacy Policy

At a minimum, your privacy policy or customer-facing disclosures should include:

• Types of personal information collected through customer and tenant interactions
• Purposes for which that information is used
• Disclosure that you use third-party AI communication technology (swivl) to handle certain interactions, including voice calls, SMS, and web chat
• How customers and tenants can exercise their privacy rights
• Contact information for privacy inquiries

We strongly recommend consulting with legal counsel in your jurisdiction to ensure your privacy disclosures are complete and compliant.

---

5. Jurisdiction-Specific Requirements

The following is a non-exhaustive summary of key compliance considerations by geography. This is not legal advice. Consult qualified counsel in each jurisdiction where you operate.

---

6. Sample Disclosure Language

The following is sample language you may adapt for inclusion in your customer-facing privacy policy or notice. Review with your own legal counsel before use.

---

7. A Note on GDPR

swivl is a US-based company and our standard agreements are designed for US and Canadian compliance. GDPR applies based on where the data subject is located, not where your business operates. If your locations are accessed by EU or UK residents, GDPR obligations may apply to you.

swivl's standard DPA covers US and Canadian legal requirements. If you require GDPR-compliant processing terms, including Standard Contractual Clauses for cross-border data transfers, please contact us before deploying swivl to process EU resident data. We will work with you to put appropriate supplemental terms in place.

---

8. Questions