Data Processing Addendum

Last updated: August 19th,2026 (change log)

This Data Processing Agreement ("DPA") is entered into between Swan AI, Inc., a Delaware corporation with its registered address at 108 West 13th Street, Suite 100, Wilmington, DE 19801 ("Swan" or "Processor"), and the customer using Swan's services ("Customer" or "Controller"). This DPA is the Data Privacy Addendum incorporated by reference into Swan's Terms of Service, forms an integral part of the agreement between Swan and the Customer ("Agreement"), and applies where Swan processes personal data on behalf of the Customer.

1. Definitions

1.1 "Data Protection Laws" means all data protection laws applicable to the processing of Personal Data, including but not limited to:

• EU GDPR (General Data Protection Regulation 2016/679),
• UK GDPR (as implemented in the UK),
• CCPA/CPRA (California Consumer Privacy Act as amended by CPRA),
• Any other applicable data privacy laws in jurisdictions where the Customer operates.

1.2 "Personal Data" means any information relating to an identified or identifiable natural person that Swan processes on behalf of the Customer as part of providing its services.

1.3 "Controller," "Processor," "Data Subject," "Processing," and "Personal Data Breach" have the meanings assigned to them in applicable Data Protection Laws.

1.4 "Standard Contractual Clauses" (SCCs) refers to the standard contractual clauses for data transfers approved by the European Commission and UK Information Commissioner's Office for cross-border data transfers.

1.5 "Sub-processor" means any third party engaged by Swan to process Personal Data on behalf of the Customer.

2. Roles and Responsibilities

2.1 Customer as Controller: The Customer is responsible for determining the purpose and legal basis for processing Personal Data and ensuring compliance with Data Protection Laws.

2.2 Swan as Processor: Except as set out in Section 2.5, Swan processes Personal Data only as instructed by the Customer and solely for the purpose of delivering its services. In respect of such Personal Data, Swan does not determine the purposes or means of processing.

2.3 Customer's Responsibilities:

• Ensuring it has the lawful basis to collect and share Personal Data with Swan.
• Providing all necessary privacy notices and obtaining any required consents from Data Subjects.
• Ensuring that its use of Swan's services complies with Data Protection Laws.

2.4 Prohibited Data: Customer shall not provide Swan with any Sensitive Personal Information (e.g., health data, biometric data, financial information) unless explicitly agreed in writing.

2.5 Swan as Independent Controller:

(a) "Account Data" means Personal Data relating to Swan's relationship with the Customer, including the names and contact details of individuals authorised to access the Customer's account, and billing contact information. "Usage Data" means data generated in connection with the operation of the Services, including activity logs, feature usage, and diagnostic and performance data.

(b) With respect to Account Data and Usage Data, Swan acts as an independent controller and not as a processor or joint controller with the Customer. Swan processes such data to manage the customer relationship; to carry out its own business operations including accounting, audit, tax and compliance; to monitor, investigate, prevent and detect fraud, security incidents and misuse of the Services; for identity verification; to provide, secure, maintain and improve the Services; and to comply with legal obligations to which Swan is subject.

(c) Personal Data processed by Swan as an independent controller is processed in accordance with Swan's Privacy Policy. Where Swan acts as an independent controller, each party is solely responsible for its own compliance with Data Protection Laws in that capacity.

(d) For the avoidance of doubt, Personal Data processed by Swan on the Customer's behalf under Section 2.2 does not include Account Data or Usage Data.

3. Data Processing Scope

3.1 Nature and Purpose: Swan processes Personal Data only to provide its services to the Customer, including:

• Researching and enriching company and contact records from public and third-party sources.
• Identifying website visitors based on IP and cookie data, including geo-location, to enforce Customer-defined targeting preferences (e.g., exclude/include countries from identification attempts).
• Processing Customer Data using third-party AI model providers in order to generate research, insights, recommendations and draft communications. Swan's agreements with such providers prohibit the use of Customer Data to train their models.
• Drafting, scheduling and sending outreach by email and LinkedIn through accounts the Customer connects, and processing replies in order to manage those sequences.
• Synchronising records with the Customer's CRM and other integrations the Customer enables.
• Maintaining conversation, workflow and execution history as the Customer's operating record of the Services.

3.2 Duration of Processing: Swan retains Personal Data only for as long as necessary to provide services and in accordance with its retention policy (see Section 7).

3.3 Categories of Personal Data: The Personal Data processed by Swan may include:

• IP addresses, cookie identifiers and geo-location data of website visitors.
• Business contact information, including name, business email address, telephone number, job title, employer and LinkedIn profile URL, sourced from the Customer, from public sources, and from third-party data providers.
• Engagement metadata, including pages viewed, timestamps and interaction history.
• The content of outreach messages drafted or sent through the Services, and of replies received to them.
• CRM records and metadata synchronised from systems the Customer connects.
• Conversation and execution history generated through the Customer's use of the Services, including prompts and instructions submitted by the Customer's users.

4. Security Measures

4.1 Technical & Organizational Measures: Swan implements reasonable security measures to protect Personal Data, including:

• Encryption in transit and at rest (TLS 1.2/1.3, AES-256).
• Access controls and authentication (including MFA for internal systems).
• Regular security audits and penetration testing to identify vulnerabilities.

4.2 Customer's Security Obligations: Customer is responsible for securing its own systems, including access to Slack, HubSpot, LinkedIn, and other integrations.

5. Data Subject Rights

5.1 Customer's Responsibility: The Customer is solely responsible for handling Data Subject rights requests (e.g., access, deletion, correction) under applicable laws.

5.2 Swan's Assistance: If Swan receives a request from a Data Subject, it will not respond directly but will forward the request to the Customer within five (5) business days. If the Customer wishes to delete a Data Subject's information from Swan's systems, they may reach out to us at hello@getswan.com, and we will ensure that all relevant data is permanently deleted.

5.3 Opt-Out Requests (CPRA and Similar Laws): This Section applies to Personal Data for which Swan acts as an independent controller under Section 2.5. Swan does not sell or share Personal Data processed on the Customer's behalf. Individuals may exercise applicable opt-out rights by sending an opt-out request to hello@getswan.com.

6. Sub-processing

6.1 General Authorisation. The Customer provides general written authorisation for Swan to engage sub-processors to process Personal Data in connection with the Services. Swan's current sub-processors are listed in Schedule A (the "List").

6.2 Notice of Changes. Swan will update the List before engaging a new sub-processor, and at least ten (10) business days before that sub-processor begins processing Personal Data. Publication of the updated List constitutes notice for the purposes of this Section. The Customer may subscribe to notifications of changes to the List at Schedule A, and is responsible for maintaining a current subscription if it wishes to receive them.

6.3 Objection. The Customer may object to a new sub-processor by written notice to Swan within ten (10) business days of the List being updated, provided the objection is on reasonable grounds relating to data protection. If the Customer does not object within that period, the change is deemed accepted.

6.4 Resolution. If the Customer objects on reasonable grounds and Swan cannot make available a commercially reasonable alternative within a reasonable period, the Customer may discontinue the affected part of the Services on written notice. Discontinuation under this Section does not relieve the Customer of fees owed under the Agreement. The Customer acknowledges that certain sub-processors are essential to the Services and that objecting to one may prevent Swan from providing the Services.

6.5 Urgent Changes. Swan may engage a replacement sub-processor immediately where necessary to preserve the security, availability or lawful operation of the Services, and will update the List and notify the Customer as soon as reasonably practicable.

6.6 Exclusions. The following do not require notice under Section 6.2: engagement of Swan's affiliates; a change in a sub-processor's name, legal entity or corporate ownership where the processing is unchanged; and replacement of a sub-processor by another performing the same function in the same jurisdiction.

6.7 Sub-processor Terms. Swan will impose on each sub-processor data protection obligations no less protective than those in this DPA, and remains liable to the Customer for the performance of each sub-processor's obligations.

7. Data Retention & Deletion

7.1 Retention Periods:

• Website visitor data (IP & cookies): 12 months, then automatically deleted.
• Slack integration data: Not stored permanently; retained for 12 months if required for lead management.
• HubSpot CRM integration: Swan does not store HubSpot CRM data beyond real-time processing.

7.2 Data Deletion Upon Termination: Upon termination of services, Swan will make Customer Data available to the Customer for electronic retrieval for thirty (30) days, after which Swan will delete stored Personal Data unless otherwise agreed with the Customer or required by law to retain it.

7.3 Customer Responsibility for Exporting Data: The Customer is responsible for exporting any required data before termination.

8. International Data Transfers

8.1 Location of Processing. Swan is established in the United States and its processing operations take place primarily in the United States. The Customer acknowledges that transfer of Personal Data to the United States is necessary for Swan to provide the Services.

8.2 Transfers from the EEA, UK and Switzerland. Where the Customer transfers Personal Data subject to the GDPR, UK GDPR or the Swiss Federal Act on Data Protection to Swan, such transfers are made under the Standard Contractual Clauses, together with the UK International Data Transfer Addendum where UK Personal Data is in scope, or another legally recognised transfer mechanism. Module Two (controller to processor) applies where the Customer is a controller and Swan is a processor. Module Three (processor to processor) applies where the Customer is itself a processor.

8.3 Onward Transfers to Sub-processors. Where Swan transfers Personal Data onward to a sub-processor located in a country for which no adequacy decision is in force, such transfers are made under the Standard Contractual Clauses (Module Three) together with the UK Addendum where applicable. Transfers to sub-processors located in countries benefiting from an adequacy decision, including Israel and the EEA member states, require no additional mechanism. The transfer mechanism applicable to each sub-processor is stated in Schedule A.

9. Personal Data Breach Notification

9.1 Swan's Responsibilities: In the event of a Personal Data Breach, Swan will, without undue delay after becoming aware of it, notify the Customer and provide, to the extent then known and as further information becomes available: the nature of the breach including the categories and approximate number of Data Subjects and records concerned; the likely consequences; the measures taken or proposed to address it; and a contact point for further information. Swan will provide the Customer with reasonable cooperation and assistance in connection with the Customer's own notification obligations. Swan's notification is not an acknowledgement of fault or liability.

9.2 Customer's Responsibilities: The Customer is responsible for notifying Data Protection Authorities or affected Data Subjects if required by law.

10. Audits & Compliance

10.1 Customer's Right to Audit: Customer may conduct an audit once per year, subject to:

• 30 days' written notice to Swan.
• The audit being limited in scope and conducted during business hours with minimal disruption.
• Any costs for additional audits being covered by the Customer.

10.2 Compliance Reports: Upon request, Swan may provide security certifications, audit reports, or other documentation to confirm compliance.

11. Term & Termination

11.1 Duration: This DPA remains in effect as long as Swan processes Personal Data for the Customer.

11.2 Termination: Either Party may terminate this DPA if the other materially breaches its obligations and fails to remedy the breach within 30 days.

12. Miscellaneous

12.1 Conflicts: If there is a conflict between this DPA and the Agreement, this DPA prevails regarding data protection matters.

12.2 Governing Law: This DPA is governed by the laws of the State of New York, United States, without regard to its conflict of laws principles, consistent with the Terms of Service, and any disputes arising under this DPA shall be resolved in the state or federal courts located in New York, NY, except that (a) where the Standard Contractual Clauses apply to transfers from the EEA, those clauses are governed by the laws of Ireland and disputes arising from them will be resolved before the courts of Ireland; (b) where the UK Addendum applies, it is governed by the laws of England and Wales and disputes arising from it will be resolved before the courts of England and Wales; and (c) nothing in this Section limits any mandatory requirement of applicable Data Protection Laws.

12.3 Amendments: Swan may update this DPA as needed to comply with legal or regulatory changes, with notice to the Customer.

12.4 No Third-Party Rights: This DPA does not create any third-party beneficiary rights.

12.5 Limitation of Liability: Except as otherwise required by applicable law, the total aggregate liability of Swan arising out of or related to this DPA shall be subject to the limitations and exclusions of liability set forth in the Agreement.

By using Swan's services, the Customer accepts this DPA as part of the Agreement.

‍

Schedule A — Sub-processors and Data Recipients

See here.