Privacy Policy of Content Swarm

Content Swarm Limited is the owner and data controller for the website and for personal data it uses for its own business purposes. When a business customer directs how Content Swarm processes personal data in the service, that customer is the controller and Content Swarm is its processor. Our Data Processing Agreement covers that processing.

What this policy covers

This policy covers contentswarm.io, the Content Swarm web app and mobile apps, the Content Swarm Chrome extension, support, and related services. Content Swarm helps users coordinate LinkedIn content and engagement and offers AI-assisted content and comment generation.

Personal data we process

Account and contact data, such as first name, last name, email address, user ID, company email, team or swarm membership, and support messages.
LinkedIn connection data, such as LinkedIn identifiers, OAuth account information, access and refresh tokens, token status, granted access, company page information, and information returned by LinkedIn APIs.
Content data, such as LinkedIn post URLs and text, post author information, draft and published posts, generated or selected comments, reshare text, reactions, attachments, and content performance data.
Usage and technical data, such as IP address, browser and device information, cookies and similar trackers, session and security data, product events, page interactions, error logs, and request information.
Contact form data, including first name, email address, and the message supplied.

Chrome extension

The extension runs on linkedin.com and api.contentswarm.io. It adds Content Swarm controls to LinkedIn. When a user asks for a comment, it reads the visible post text and sends that text, the selected tone and length, and any optional example comment to Content Swarm's API. When a user adds a post to a swarm, it sends the LinkedIn post URL and selected team. When a user posts a selected comment, the comment text and selected team are recorded by Content Swarm.

The extension stores Content Swarm session and CSRF tokens, the selected swarm, cached account details, and analytics state in Chrome local storage. It also sends product usage events and identified account details to PostHog. Some analytics events can include a post URL, an example comment, or the generated comment selected by the user.

The extension does not request access to general browser history, camera, microphone, location, or downloads. It does have origin-wide access to linkedin.com, as shown in the Chrome permission prompt. The current code uses that access for LinkedIn post, feed, comment, and Content Swarm login workflows. See the full Chrome extension permission information.

The Chrome Web Store declaration currently says that the extension will not collect or use data. That statement does not match the current extension data flows and must be updated. This policy describes the processing found in the shipped extension.

AI features

Content Swarm uses OpenAI for AI-assisted comments, reshare text, similar posts, new posts, some performance reports, and internal error matching. For interactive generation, the input can include the prompt instructions, LinkedIn post text, tone and length choices, and an optional example supplied by the user. The code does not add the user's name, email address, or LinkedIn profile details to the interactive generation prompt. The text supplied by a user may itself contain personal data.

See AI provider information for the evidence and open questions about provider location, training, and retention.

Why we process personal data

To provide accounts, LinkedIn connection, content, engagement, and support.
To generate user-requested content and comments.
To secure, operate, measure, and improve the service.
To communicate about the service and respond to requests.
To meet legal duties and establish, exercise, or defend legal claims.

The lawful basis depends on the purpose and context. It may include contract, legitimate interests, consent, or legal obligation. The inspected materials do not contain a final purpose-by-purpose mapping.

Services and subprocessors

The existing policy names LinkedIn account access and OAuth, LinkedIn widgets, Amplitude Analytics, and Google Analytics 4. The product code also shows other service providers, including PostHog, OpenAI, Mailgun, Sentry, Datadog, TruConversion, Produktly, Google Firebase Cloud Messaging, Linear, and the public website host. The dated list, purposes, data categories, and transfer gaps are on our Subprocessor Information page.

International transfers

Where personal data is transferred outside the United Kingdom or European Economic Area, Content Swarm uses an applicable safeguard. This may include an adequacy decision, the European Commission Standard Contractual Clauses, the UK International Data Transfer Addendum, or the UK International Data Transfer Agreement. Consent is used only where it is a valid legal basis for the transfer.

The inspected materials do not state the contracting entity, processing locations, and transfer safeguard for every provider on the subprocessor page.

Retention and deletion

We keep personal data only for as long as needed for the purpose for which it was collected, to meet legal duties, or to resolve disputes. The codebase does not define a complete numerical retention schedule. The current categories and unanswered periods are published at Retention and Deletion.

To ask for account or personal data deletion, email support@contentswarm.io. We may need to verify the request. Some data may be retained where required by law or needed for legal claims.

Security

We use technical and organisational measures intended to protect personal data. No method of electronic transmission or storage is completely secure. Security duties for customer data are also described in the DPA.

Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to processing, to receive a portable copy, to withdraw consent, and to complain to a data protection authority. UK users can complain to the Information Commissioner's Office. You can exercise rights by contacting support@contentswarm.io.

United States privacy rights

California consumers may have rights to know, access, correct, delete, and receive a portable copy of personal information, to opt out of sale, sharing, or targeted advertising where applicable, and to receive equal service. Virginia, Colorado, Connecticut, and Utah consumers may have similar access, correction, deletion, portability, and opt-out rights under their state laws. We do not discriminate against a person for exercising a privacy right.

The inspected materials do not establish whether any current analytics activity is a sale, sharing, or targeted advertising under every applicable state law. Contact support for an applicable opt-out request.

Brazilian users

Users covered by Brazil's Lei Geral de Protecao de Dados may have rights to confirm processing, access, correct, anonymise, block, delete, or port data, obtain information about sharing, and withdraw consent, subject to the law.

Existing statutory disclosures

Information for Californian Consumers

This section applies to all Users who are consumers residing in the state of California, United States of America, according to the "California Consumer Privacy Act of 2018" (the "CCPA"), as updated by the "California Privacy Rights Act" (the "CPRA") and subsequent regulations.

Notice at Collection

Categories of personal information collected, used, sold, or shared

We have collected the following categories of personal information:

Identifiers
Internet information

We do not collect sensitive personal information.

Your Rights Under CCPA

The right to know what personal information is being collected
The right to know whether personal information is sold or disclosed and to whom
The right to say no to the sale of personal information
The right to access your personal information
The right to data portability
The right to deletion
The right to equal service and price

How to Exercise Your Rights

You can exercise your rights by contacting us using the contact information provided in this document. We will respond to your request within 45 days and will not discriminate against you for exercising your rights under the CCPA.

Information for Virginia Consumers

This section applies to all Users who are consumers residing in the Commonwealth of Virginia, according to the "Virginia Consumer Data Protection Act" (the "VCDPA").

Your Rights Under VCDPA

The right to access your personal data
The right to correct inaccuracies
The right to delete your personal data
The right to data portability
The right to opt out of targeted advertising

Information for Colorado Consumers

This section applies to all Users who are consumers residing in the State of Colorado, according to the "Colorado Privacy Act" (the "CPA").

Your Rights Under CPA

The right to opt out of targeted advertising
The right to access your personal data
The right to correction
The right to deletion
The right to data portability

Information for Connecticut Consumers

This section applies to all Users who are consumers residing in the State of Connecticut, according to "The Connecticut Data Privacy Act" (the "CTDPA").

Your Rights Under CTDPA

The right to access personal data
The right to correction
The right to deletion
The right to data portability
The right to opt out of targeted advertising

Information for Utah Consumers

This section applies to all Users who are consumers residing in the State of Utah, according to the "Utah Consumer Privacy Act" (the "UCPA").

Your Rights Under UCPA

The right to access personal data
The right to deletion
The right to data portability
The right to opt out of targeted advertising

Information for Brazilian Users

This section applies to all Users who reside in Brazil, according to the "Lei Geral de Proteção de Dados" (LGPD).

Your Brazilian Privacy Rights

The right to confirmation of the existence of processing
The right to access your personal data
The right to correction
The right to anonymization, blocking, or deletion
The right to data portability
The right to information about shared data
The right to revoke consent

Contact

Content Swarm Limited, 727-729 High Road, London N12 0BP, United Kingdom. Email support@contentswarm.io.

Content Swarm Limited, 727-729 High Road, London N12 0BP, United Kingdom. Contact support@contentswarm.io.