Your data, handled with transparency and trust.
SwarmMind is designed around a simple principle: Private by default. Shared by choice. Collective by purpose. This notice explains what information we process, why we process it, where it is processed and what choices you and your organisation have.
Quick summary (2 minutes)
- No model training with your content: Intunex does not use customer or user content to train or fine-tune AI models. The AI API services used by SwarmMind process content to provide the requested function, with limited retention exceptions described below under their applicable terms and settings.
- Private by default: your personal reflection is private unless you deliberately share it through a described function.
- Visible to you: information proposed for your Learning Identity remains visible and manageable by you. SwarmMind does not build a hidden employee learning profile for management.
- Shared by choice: private reflection is not silently converted into organisational reporting. Collective learning is built from information people intentionally contribute for a shared purpose.
- Clear roles: in organisational pilots and customer deployments, the Customer is Controller for Customer Hive data and the customer-scoped Learning Identity. Intunex processes this information on the Customer's documented instructions. Intunex is Controller for the limited information needed to operate, secure and administer the platform.
- European core: persistent customer data is hosted in Stockholm, Sweden. Primary generative AI processing, embeddings and speech transcription run in Paris, France. Named supporting providers and any processing outside the EEA are described below.
Who is responsible for what
Customer Hive and customer-scoped Learning Identity
Customer = Controller · Intunex = Processor
This covers account, profile, reflection and deliberately shared learning information processed inside the customer's organisation and for the customer's defined purpose.
Platform operations
Intunex = Controller
Intunex acts as Controller for limited information necessary to operate, secure and administer SwarmMind, such as account administration, technical logs, abuse prevention, service security and billing or customer administration.
Other configurations
A separately offered non-organisational configuration may use different roles. The applicable roles are documented before use; they are not silently changed by a website update.
Human-first privacy principles
- Private by default: personal reflection stays private unless the user chooses to share it through a described function.
- Shared by choice: the user can review what is saved and what is deliberately contributed to a team or organisation.
- Collective by purpose: organisational insight is built for an agreed learning purpose, not for hidden employee monitoring.
- No hidden learning profile: information proposed for the Learning Identity remains visible and user-controlled.
- No customer-content training by Intunex: Intunex does not use customer or user content to train or fine-tune AI models.
Information we process
- Account, role, organisation and access information
- Customer-scoped profile and Learning Identity information
- Written or spoken reflections and saved outputs
- Deliberately shared team or swarm contributions
- Uploaded documents or URLs selected for a supported function
- Transcriptions and text-derived embeddings
- Visibility and sharing settings
- Audit, security and access events
- IP address, login information, user agent and other necessary connection metadata
- Customer administration and billing contacts
Data that does not belong in the current pilot
The current pilot is designed for work-related learning and reflection. It is not intended for patient records, client records, passwords, or special categories of personal data. If a future use case genuinely requires this kind of information, it must be assessed and agreed separately before use.
Why we process information and on what basis
| Processing | Role and purpose | Legal basis / instruction |
|---|---|---|
| Customer Hive, reflection and customer-scoped Learning Identity | Intunex processes the information to provide the customer-defined learning service | Customer determines the applicable lawful basis; Intunex acts on documented instructions and the customer agreement |
| Customer-scoped account access and requested platform functions | Provide authentication, roles, permissions and the function requested by the user inside the Customer's Hive | The Customer's lawful basis and documented instructions; Intunex processes the data on the Customer's behalf |
| Mandatory platform security, operations and necessary technical logs | Protect accounts, users, customers and the service; prevent abuse, maintain availability and investigate failures | Intunex's legitimate interests in operating a secure and reliable professional service, balanced against the limited nature and retention of the data |
| Customer administration and billing | Manage the business relationship and meet accounting obligations | Contractual necessity and legal obligations, as applicable |
Where information is stored and processed
Persistent customer data
SwarmMind's persistent customer data is hosted in Supabase's Stockholm region, Sweden (eu-north-1). Text-derived embeddings are stored in the same Supabase database.
Primary AI processing
Primary generative AI processing, embedding generation and speech transcription run on Scaleway infrastructure in Paris, France.
Managed technical logs
Supabase manages the separate Logs & Analytics service. Its current retention period is seven days; its processing region is not represented here as Stockholm.
Supporting providers
Named backup, web-search, page-reading and optional agent providers may involve limited processing outside the EEA. They are described below and in the applicable customer Data Processing Addendum.
Generative AI
Scaleway in Paris is the primary generative AI provider.
If Scaleway is unavailable and the applicable customer configuration permits it, the OpenAI API may be used as a backup. OpenAI receives the user request and the conversation context necessary to generate the response. OpenAI API content is not used for model training by default under its applicable API terms; limited abuse-monitoring logs may be retained for up to 30 days.
Intunex records the provider used for supported AI processing so the route can be verified afterwards.
Public web search
SwarmMind uses Tavily to retrieve current information from the public web.
Before a search is performed, SwarmMind generates and sanitises a short search query. Tavily does not receive the user's full conversation, reflection, document, name, email address or organisation identifier through this search route. If the query cannot be processed safely, the search is not performed.
Under Intunex's current account setting, Tavily has confirmed that query inputs and outputs are not used for model training or fine-tuning. Tavily may retain limited operational metadata under its applicable terms.
Page and document reading
Jina Reader may be used when a user or organisation administrator deliberately asks SwarmMind to read a supported webpage or document.
For a webpage, Jina receives the URL required to retrieve it. For a supported private document, it may receive a temporary signed link required to retrieve the selected document. Private organisational documents use this route only when the customer configuration and written agreement permit it.
Jina processing is not contractually restricted exclusively to the EEA in the current pilot configuration. Applicable international-transfer safeguards are documented in the customer Data Processing Addendum.
Voice input and derived data
Voice input is sent through a SwarmMind Edge Function to Scaleway in Paris for transcription.
Intunex does not write the raw audio to its database, object storage or application logs. Scaleway may exceptionally retain content for up to 14 days for abuse, security or failure investigation under its current service conditions.
The returned transcription may be saved as user content. Text-derived embeddings are generated by Scaleway in Paris and stored in the SwarmMind Supabase database in Stockholm.
The speech function's technical Edge Function log contains request and organisation metadata, language, data size and processing measurements, but not raw audio, transcript, user identifier or email address.
Technical logs and retention
Customer and user content
Retained for the customer relationship and according to user actions, the customer agreement and documented customer instructions. Return, deletion and backup-removal periods are specified in the applicable customer agreement and Data Processing Addendum.
Supabase Edge Function logs
Current retention: seven days. Across the service, these technical logs may include event and request metadata, pseudonymous user or organisation UUIDs and, in six currently identified account, invitation and email-delivery functions, an email address.
Rate-limit counter
A separate database counter stores a pseudonymous user identifier, endpoint, time window and request count for security and abuse prevention. It does not contain audio, transcription or message content. It currently has no scheduled deletion and is retained on an ongoing basis.
Scaleway exception
Content may exceptionally be retained for up to 14 days for abuse, security or failure investigation.
OpenAI backup
If used, limited abuse-monitoring logs may be retained for up to 30 days under the applicable API terms.
Key service providers
| Provider | Role | Primary location / processing | Use in SwarmMind |
|---|---|---|---|
| Supabase Pte. Ltd. and its subprocessors | Database, authentication, storage, Edge Functions and managed logs | Customer-data origin Stockholm; managed log region not yet verified | Core infrastructure for the service. |
| Scaleway SAS | Primary GenAI, embeddings, speech-to-text and selected system emails | Paris, France | Primary AI infrastructure. |
| OpenAI Ireland Ltd. | Backup GenAI if Scaleway is unavailable | Processing and subprocessors may involve locations outside the EEA | Backup AI only when permitted by the applicable customer configuration. |
| Tavily / AlphaAI Technologies Inc. | Public-web retrieval using a generated and sanitised search phrase | United States | Supported public-web retrieval. Customer-specific use and restrictions are documented in the applicable Data Processing Addendum. |
| Jina AI GmbH / Elastic | Deliberately requested page and document retrieval | Not restricted exclusively to the EEA in the current pilot | Used only for deliberately requested page or document retrieval when the customer configuration and agreement permit it. |
| Anthropic | Optional Visiting Agents | Determined by the customer's activation and agreement | Off by default. Requires separate activation, a customer API key and an agreement update. |
Supabase Pte. Ltd. is registered in Singapore. The primary customer-data project and storage origin are in Stockholm. Limited support access may take place from the United States under Supabase's current Data Processing Addendum, standard contractual clauses and supplementary safeguards.
The applicable customer Data Processing Addendum records the customer-specific configuration, processors, international-transfer safeguards and any separately agreed use of private documents. For a full, customer-specific sub-processor list, contact us at info@intunex.fi.
Sources, required information and rights
Information comes from the user, the customer organisation's administrators, requested service functions and necessary platform operations. SwarmMind may propose derived learning information, but the proposal remains visible to the user.
Account, role and necessary technical information is required to provide and secure the service. Reflection, profile details, uploaded materials and deliberate sharing are voluntary within the customer's agreed use.
In organisational deployments, requests concerning Customer Hive and customer-scoped Learning Identity data are normally handled first by the Customer as Controller. Intunex assists the Customer as Processor. For information where Intunex is Controller, you may contact info@intunex.fi to request access, correction, deletion, restriction or objection where applicable.
You may also lodge a complaint with the Office of the Data Protection Ombudsman in Finland or the competent supervisory authority in your country.
Website and interface delivery
This Privacy Notice is published on SwarmMind's separate public marketing website, delivered through GitHub Pages. The signed-in pilot interface at beta.swarmmind.app is a static application delivered through Lovable hosting.
These delivery services may process necessary connection information such as an IP address when serving the page or interface. Customer content does not pass through the public marketing website or the Lovable hosting layer after the static interface has loaded; application data and AI requests are sent to the SwarmMind backend and the named providers described above.