Privacy Policy

1. Information We Collect

Information you provide

Depending on how you use the Services, we may collect:

• Account and identity information, such as name, email address, account type, authentication-provider information, password-verification status, and account identifiers.
• Student-organization information, such as organization name, school or campus, leadership contact, member count, categories, description, website and social links, sponsorship interests, logo, banner, gallery images, and payout-onboarding status.
• Brand information, such as brand or company name, representative information, industry, website and social links, company description, branding assets, goals, and billing-plan information.
• Opportunity, event, and partnership information, such as opportunity or event details, eligibility, applications, invitations, agreements, deliverables, deadlines, compensation, product information, submissions, approvals, cancellations, and partnership status.
• Communications and support information, such as messages, attachments, notifications, support requests, feedback, issue reports, and correspondence with us.
• Payment and operational information, such as subscription status, transaction and payout identifiers, payment status, reimbursement requests, receipts, shipment details, delivery information, and limited payment-method information provided by our payment processor. Complete card and bank-account details are generally collected directly by the payment provider rather than Swaya.
• Content and files, such as profile images, event banners, work submissions, receipts, message attachments, and other materials you choose to upload.
• Waitlist and inquiry information, such as name, email, organization, school, website or social profile, member count, and other information submitted through our website.

Please do not provide sensitive personal information unless a Swaya feature expressly requests it and it is necessary for that feature.

Information collected automatically

When you use the Services, we and our service providers may automatically collect technical and activity information, including IP address, browser type, device type, operating system, referring page, pages or features used, timestamps, error and diagnostic information, security events, approximate location derived from IP address, session information, and identifiers stored through cookies, browser storage, or similar technologies.

Information from other sources

We may receive information from:

• authentication providers, such as Google or Microsoft, when you choose social sign-in;
• payment providers, such as Stripe, regarding subscriptions, payment methods, identity or payout verification, transactions, refunds, disputes, and account status;
• other Swaya users when they invite, message, apply to, contract with, report, or otherwise interact with you or your organization;
• schools, organizations, public websites, social profiles, and other sources used to verify or complete organization information; and
• service providers that help us prevent fraud, secure the Services, deliver communications, and diagnose errors.

2. How We Use Information

We may use personal information to:

• create, authenticate, maintain, and secure accounts;
• verify users, organizations, authority, eligibility, and payment or payout status;
• operate profiles, discovery, opportunities, events, applications, invitations, messages, agreements, partnerships, submissions, shipments, reimbursements, payments, and notifications;
• display information to other users or the public according to the feature and account settings;
• process subscriptions, payments, payouts, refunds, chargebacks, and related records;
• provide customer support and respond to privacy, account, or legal requests;
• send transactional emails, security notices, account communications, partnership updates, and, where permitted, product or marketing communications;
• personalize and improve the Services, understand usage, diagnose errors, develop features, and conduct internal analysis;
• protect users, prevent fraud and misuse, enforce agreements, investigate disputes, and maintain safety and security;
• comply with law, legal process, sanctions, tax, accounting, and regulatory obligations; and
• support a merger, financing, acquisition, reorganization, or sale of all or part of our business.

3. How We Disclose Information

Other users and public profiles

Profile, organization, brand, event, and opportunity information may be visible to other users and, where a feature is public, to anyone. Applications, invitations, agreements, messages, submissions, payment workflow details, and similar records are shared with the users and organizations involved in the relevant interaction.

Do not include personal information in a public profile, opportunity, event, message, or upload unless you are comfortable sharing it with the intended audience and have permission to do so.

Service providers

We disclose information to providers that help us operate the Services. Depending on the features used, these providers may include:

• Google Firebase and Google Cloud for authentication, database, file storage, hosting, backend services, and abuse protection;
• Google reCAPTCHA/App Check for security and abuse prevention;
• Stripe for subscriptions, payments, identity or payout onboarding, billing portals, refunds, and related financial services;
• Resend or similar email providers for verification, security, transactional, and support email;
• Sentry or similar monitoring providers for error reporting, diagnostics, and service reliability;
• Google Maps/Places for address and location features;
• Google and Microsoft when users choose their authentication services;
• Apollo for website analytics, company-level visitor identification, lead prioritization, and business outreach; and
• hosting, security, customer-support, file-preview, and professional-service providers.

These providers process information on our behalf or under their own terms where they independently provide a service to you.

Legal, safety, and business purposes

We may disclose information when we reasonably believe disclosure is necessary to comply with law or legal process; protect the rights, safety, property, or security of Swaya, users, or others; investigate fraud, misuse, nonpayment, or disputes; enforce agreements; or respond to an emergency.

We may disclose information in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate confidentiality protections.

4. Payments and Financial Information

Stripe and other payment providers collect and process payment-card, bank-account, identity-verification, tax, and payout information under their own privacy policies. Swaya generally receives limited information, such as customer or connected-account identifiers, payment-method type and last digits, subscription status, transaction status, payout eligibility, refunds, disputes, and verification status.

We retain financial and transaction records as needed to operate the Services, prevent fraud, resolve disputes, and meet tax, accounting, payment-network, and legal obligations.

5. Cookies and Similar Technologies

Swaya and its providers may use cookies, browser storage, pixels, SDKs, and similar technologies to keep users signed in during a browser session, remember settings, protect the Services, prevent abuse, understand performance, diagnose errors, identify company-level website activity, and support business outreach.

Our landing page uses Apollo’s website visitor technology. Apollo may process technical and activity information, such as IP address, pages viewed, visit frequency, and timestamps, to provide company-level visitor and engagement insights. Apollo states that its website visitor feature does not identify individual visitors by name or email address.

You can control cookies through browser settings, although blocking necessary storage or cookies may prevent account, security, or other features from working. Because there is not yet a uniform industry standard for browser “Do Not Track” signals, the Services do not currently respond to those signals. Swaya does not sell personal information.

If our advertising, analytics, or data-sharing practices materially change, we will update this Policy and provide any controls required by applicable law.

6. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Policy, including to maintain an account, provide the Services, preserve partnership and transaction records, resolve disputes, enforce agreements, prevent fraud, comply with legal obligations, and maintain security and backups.

Retention varies by data type. For example, account and profile information is generally retained while an account is active; messages and partnership records may be retained for the life of the applicable relationship and a reasonable period afterward; and payment, tax, fraud, and legal records may be retained for legally required or operationally necessary periods.

When information is no longer reasonably needed, we may delete, de-identify, or aggregate it. Deletion requests may not remove information that must be retained for legal, security, payment, dispute, backup, or completed-partnership purposes.

7. Your Choices

You may:

• review or update certain account and profile information through the Services;
• manage profile visibility and content through available settings;
• opt out of marketing email through the unsubscribe link or by contacting us;
• manage or cancel eligible brand subscriptions through account settings or the Stripe billing portal;
• request access, correction, or deletion of personal information; and
• request account deletion through available settings or by contacting us.

We may need to verify your identity and authority before completing a request. We may deny or limit a request where permitted by law, including where information must be retained to complete a transaction, protect security, prevent fraud, preserve another person’s rights, comply with law, or maintain required records.

8. U.S. State Privacy Rights

Depending on where you live and whether an applicable law covers Swaya, you may have rights to request access to, correction of, deletion of, or a copy of personal information; to obtain information about categories of collection, use, and disclosure; to opt out of certain sales, targeted advertising, or profiling; and to appeal a denied request.

Swaya does not discriminate against a person for exercising an applicable privacy right. An authorized agent may submit a request where permitted by law, but we may require proof of authorization and identity verification.

To submit a request or appeal, email team@getswaya.com with the subject “Privacy Request.” We will respond within the period required by applicable law.

Swaya does not currently sell personal information. If our practices change in a way that creates a legally recognized sale, targeted-advertising use, or sharing right, we will update this Policy and provide legally required opt-out methods.

9. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. These measures may include access controls, authentication safeguards, encryption in transit, provider security controls, monitoring, and rules limiting access to stored data.

No online service, transmission, or storage system is completely secure. You are responsible for using a strong password, protecting your devices and account credentials, and notifying us if you suspect unauthorized access.

10. Children’s Privacy

The Services are intended for users who are at least 18 years old and are not directed to children under 13. We do not knowingly collect personal information directly from children under 13. If you believe a child under 13 has provided personal information, contact us so we can investigate and take appropriate action.

11. International Users

Swaya is based in the United States. If you access the Services from another country, your information may be transferred to, stored in, and processed in the United States and other countries where Swaya or its providers operate. Those countries may have different data-protection laws from your country.

Before actively offering the Services to users in the European Economic Area, United Kingdom, or other jurisdictions requiring additional disclosures or transfer mechanisms, Swaya will update this Policy as appropriate.

12. Third-Party Links and Services

The Services may link to third-party websites or services. Their privacy practices are governed by their own policies, and Swaya is not responsible for those practices. Review a third party’s terms and privacy policy before providing information to it.

13. Changes to This Policy

We may update this Privacy Policy as the Services, our practices, or applicable laws change. We will post the updated Policy and revise the effective date. If a change is material, we will provide additional notice as appropriate, such as an in-product notice or email.

14. Contact Us

For privacy questions or requests, contact Swaya at team@getswaya.com.