Swoop

1. About this policy

Swoop ("we", "us", "our") is committed to protecting your privacy and the privacy of individuals whose personal information may be collected through your use of our platform. This policy explains how we collect, use, store, and disclose personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Swoop is a field data capture and enrichment tool that enables users to photograph shopfronts and business cards, extract business information using machine vision, and enrich that data using public databases and APIs.

2. What personal information we collect

Account information (about you, the user):

• Name and display name
• Email address
• Organisation name
• Password (stored securely via Supabase Auth, never in plaintext)
• Billing information (processed by Stripe; we do not store credit card details)

Business data (about third parties captured via the platform):

• Business names, trading names, and ABN details
• Business contact details (phone numbers, email addresses, websites)
• Business addresses and GPS coordinates
• Names and job titles of individuals (from business cards)
• Photographs of shopfronts and business cards

Usage data:

• Session activity (batches processed, timestamps)
• Credit usage and billing history
• API error logs for system reliability

3. How we collect personal information

We collect personal information in the following ways:

• Directly from you when you create an account, upload photos, or contact us
• From photographs you upload, using AI-powered machine vision to extract text and business details from images of shopfronts and business cards
• From third-party sources used to enrich and verify extracted data, including:
  • Google Places API (business details, addresses, opening hours, ratings)
  • Australian Business Register (ABN, entity details, GST status)
  • Anthropic Claude API (AI-powered data extraction and gap-filling via web search)
  • OpenStreetMap / Nominatim (geocoding and address resolution)
• From Stripe for payment processing and subscription management

4. Why we collect and use personal information

We collect and use personal information for the following purposes:

• To provide the Swoop service: extracting, enriching, and organising business data from field photographs
• To manage your account and subscription
• To process payments and manage billing
• To improve our service and fix technical issues
• To communicate with you about your account or service updates
• To comply with legal obligations

5. Third-party data processing

To provide our service, certain data is transmitted to third-party services for processing. These services are used solely for the purpose of delivering the Swoop platform and are not used for marketing or unrelated purposes.

By using Swoop, you acknowledge that data may be processed in jurisdictions outside Australia, including the United States. We take reasonable steps to ensure these services provide adequate privacy protections.

6. Third-party business data and your responsibilities

Swoop enables you to capture and process information about businesses and individuals (e.g., from shopfront signage or business cards). This data may constitute personal information under the Privacy Act.

As the user, you are responsible for:

• Ensuring you have a lawful basis to collect and process the business data you capture
• Complying with your own organisation's privacy obligations and any applicable APP requirements
• Using the data only for the purposes for which it was collected
• Handling any access, correction, or complaint requests from the individuals whose data you have captured

Swoop processes this data on your behalf as a service provider. We do not use third-party business data for our own marketing or unrelated purposes.

7. Data security

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, including:

• Encryption in transit (TLS/HTTPS) and at rest
• Secure, httpOnly authentication cookies
• Password complexity requirements (minimum 12 characters with mixed character types)
• Rate limiting on authentication and API endpoints
• Role-based access controls for administrative functions
• Content Security Policy and security headers
• Regular security assessments of our codebase

8. Data retention

• Uploaded images: Retained for 14 days after upload, then automatically deleted from storage
• Business data (results): Retained for the duration of your account
• Account data: Retained for the duration of your account and for a reasonable period after closure for legal and billing purposes
• Error logs: Retained for 90 days
• Billing records: Retained as required by Australian tax law (minimum 5 years)

9. Your rights

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you (APP 12)
• Request correction of inaccurate or outdated information (APP 13)
• Request deletion of your account and associated data
• Complain about how we handle your personal information

To exercise any of these rights, contact us at the details below. We will respond within 30 days.

10. Cookies

Swoop uses essential cookies only for authentication (session management). We do not use tracking cookies, analytics cookies, or third-party advertising cookies.

11. Changes to this policy

We may update this privacy policy from time to time. Material changes will be communicated via email or a notice within the platform. The "last updated" date at the top of this page indicates when the policy was last revised.

12. Contact us

If you have questions about this privacy policy, wish to make an access or correction request, or want to lodge a complaint, please contact us:

Swoop Privacy Officer
Email: privacy@swoopnow.app

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).