For Business Customers
Version date: September 19, 2026. Effective date: September 19, 2026.
This Data Processing Addendum (DPA) forms part of the SwiftTrail Terms of Service or other written service agreement (Agreement) between SwiftTrail Data Solutions Ltd (Company No. C2026091700015), a company incorporated in Trinidad and Tobago trading as SwiftTrail (SwiftTrail), and the business customer identified in the account or order (Customer). It applies when SwiftTrail processes Customer Personal Data to provide the Service. Acceptance of the Agreement incorporating this DPA makes this DPA binding without a separate signature. The person accepting for Customer must have authority to bind Customer.
This DPA addresses document extraction for business customers. Its protections apply contractually to Customer Personal Data even if Customer is below a particular state privacy law's coverage threshold. Statutory duties apply to each party to the extent the relevant law applies. This DPA takes priority over conflicting Agreement provisions concerning Customer Personal Data. A signed amendment overrides this DPA only to the extent it expressly identifies the provision being changed and the change is lawful.
Applicable Privacy Law means privacy, data security, breach-notification and data-protection laws applicable to a party's processing under this DPA, including applicable United States federal and state laws and the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations (CCPA). It also includes any applicable laws of the Trinidad and Tobago Data Protection Act, 2011.
Personal Data includes personal information and equivalent terms under those laws. Processing includes collection, access, storage, use, disclosure, transmission and deletion.
Customer Content means the documents, information and instructions Customer submits and the extraction results generated for Customer. Customer Personal Data means Personal Data within Customer Content, including document metadata associated with an individual. A Subprocessor is a third party engaged to process Customer Personal Data for SwiftTrail. A Personal Data Incident is an actual or reasonably suspected security event resulting in unauthorized access to, acquisition, use, disclosure, alteration, loss or destruction of Customer Personal Data. Unsuccessful attacks without compromise of Customer Personal Data are not Personal Data Incidents.
Customer normally acts as controller or business, and SwiftTrail acts as processor or service provider. If Customer is itself a processor or service provider, Customer represents that it has the necessary authorization from its controller and passes that controller's lawful instructions to SwiftTrail. The parties' legal roles ultimately depend on their actual processing. Account administration and SwiftTrail's own business records are described in the Privacy Notice; that separate role does not permit reuse of Customer Personal Data for SwiftTrail's unrelated purposes.
Customer instructs SwiftTrail to perform the activities described in Schedule 1. The Agreement, this DPA, authorized account settings and Customer's lawful written requests document those instructions. SwiftTrail will promptly inform Customer if it believes an instruction violates Applicable Privacy Law and may suspend the affected processing while the parties resolve the issue. SwiftTrail may process data as required by law and will inform Customer in advance unless legally prohibited.
Customer is responsible for the lawfulness of collection and disclosure, required notices and permissions, data minimization, account-user authority and its own use of extraction results. Customer will provide accurate instructions and will not submit prohibited information described in Schedule 1. Customer remains responsible for any decisions about individuals and must independently verify output against the source documents. Customer will not instruct SwiftTrail to make tenant-screening, eligibility, credit or other consequential decisions about individuals.
SwiftTrail will process Customer Personal Data only for the specific purposes in Schedule 1 and lawful instructions under this DPA, or as required or expressly permitted by Applicable Privacy Law within its processor or service-provider role. SwiftTrail will not sell Customer Personal Data, share it for cross-context behavioral advertising, use it for targeted advertising, or build profiles for another customer.
SwiftTrail will not retain, use or disclose Customer Personal Data for a commercial purpose outside the specified business purposes or outside the direct business relationship with Customer, except as expressly permitted by Applicable Privacy Law. SwiftTrail will not combine it with Personal Data obtained from another customer, another person or SwiftTrail's own interactions with individuals except to the limited extent permitted by Applicable Privacy Law and necessary for the instructed Service.
SwiftTrail will not use Customer Content to train or fine-tune its own or a third party's general-purpose AI models. SwiftTrail will use Anthropic's commercial API under terms that prohibit training by default, will not opt Customer Content into training, and will not submit Customer Content through optional model-feedback or data-contribution programs. Necessary security screening and legally permitted abuse investigation are distinct from model training and remain subject to this DPA and applicable provider terms.
For CCPA-regulated processing, SwiftTrail certifies that it understands these restrictions and will comply with them, comply with the CCPA obligations applicable to its role and provide the same level of privacy protection required by the CCPA. SwiftTrail will notify Customer without undue delay if it determines it can no longer meet those obligations. Customer may take reasonable and appropriate steps to verify compliance and to stop and remediate unauthorized processing, including instructions, assessments under Section 8 and termination of affected processing.
SwiftTrail will ensure that persons authorized to process Customer Personal Data are bound by confidentiality obligations and have access only as necessary for their duties. SwiftTrail will maintain the safeguards in Schedule 2, taking account of the data, processing and reasonably foreseeable risks. Updates must not materially reduce the overall protection during the applicable subscription term. Neither party promises that every security incident can be prevented.
Customer authorizes the Subprocessors identified in the Subprocessor List at useswifttrail.com/legal/subprocessors as of acceptance of this DPA. The initial providers are Anthropic, Neon and Railway. SwiftTrail will impose written data-protection duties appropriate to their functions and no less protective in substance than this DPA for the relevant processing. SwiftTrail remains responsible to Customer for their performance of those duties to the same extent as for its own performance.
SwiftTrail will email Customer's account administrator at least 30 days before a new or replacement Subprocessor begins processing Customer Personal Data. Notice will identify the provider, service, data and relevant processing locations. Customer may object within that period on reasonable data-protection grounds. The parties will seek an alternative or reasonable safeguards. If no solution is available, Customer may terminate the affected Service before that provider begins processing, and SwiftTrail will arrange through Paddle a prorated refund of prepaid fees for the unused affected period. If an urgent security or continuity event prevents advance notice, SwiftTrail may suspend affected processing while arranging a compliant alternative; this does not waive a legally required objection opportunity.
Processing may occur in the United States, in Trinidad and Tobago through authorized SwiftTrail personnel, and in other countries identified in the Subprocessor List and referenced vendor location disclosures. This is not a US-only storage or access commitment. Any stricter residency requirement must be agreed in writing before processing. This DPA does not itself supply EU standard contractual clauses, a UK transfer addendum or another international transfer mechanism. The parties must establish any legally required mechanism before a transfer that requires it.
Considering the nature of processing and information available, SwiftTrail will reasonably assist Customer with access, correction, deletion, portability, opt-out and other individual requests; data-protection and risk assessments; security compliance; and legally required notifications or consultations. SwiftTrail will forward requests relating to Customer Personal Data to Customer without undue delay and will not decide them independently unless law requires it. Customer will identify and verify the request as appropriate. Ordinary assistance is included in the Service; any charge for exceptional work must be reasonable, disclosed and agreed in advance and must not prevent timely legally required assistance.
SwiftTrail will provide information in its possession necessary to demonstrate compliance, including relevant safeguards and Subprocessor information. Customer may conduct reasonable assessments itself or through an independent assessor under confidentiality and security protections. An available, appropriate independent assessment report may be used where it adequately addresses Customer's lawful needs, but SwiftTrail does not represent that it holds a particular certification or report.
Routine assessments should use reasonable advance notice, occur during business hours and avoid disruption or disclosure of other customers' information. A usual once-per-year limit does not apply when additional review is reasonably required by law, a regulator, a Personal Data Incident or evidence of material noncompliance. SwiftTrail will cooperate with legally required Customer cybersecurity audits and risk assessments, provide relevant facts in its possession, custody or control and not misrepresent them. These arrangements do not restrict regulators' powers or mandatory audit rights.
SwiftTrail will notify the designated security contact or account administrator without undue delay after becoming aware of a Personal Data Incident, aiming to send the initial notice within 72 hours. SwiftTrail will comply with any shorter applicable legal deadline; the 72-hour target is not a waiting period or a statement that all US laws use that deadline. SwiftTrail will not postpone an initial notice to complete its investigation.
The notice will include available information about what happened, discovery and incident timing, affected data and individuals, likely consequences, containment and remediation, and a contact point. SwiftTrail will supplement it as material facts become available, preserve relevant evidence and reasonably cooperate with Customer. Customer controls notices to its individuals and regulators unless SwiftTrail has an independent duty to notify. Neither party will name the other publicly unnecessarily; legally required notices are not subject to the other's consent. Incident notice alone is not an admission of liability.
During the subscription, Customer may export available results and request deletion of Customer Content. At termination, Customer may direct return or deletion. Unless Customer instructs earlier deletion, SwiftTrail will make Customer Content available for a reasonably usable export during a 30-day period after termination, subject to secure identity checks, and delete remaining active copies at the end of that period. Customer should request export promptly within the period. An earlier valid deletion instruction will be completed within 30 days and ends the ability to export the deleted material. Deleted material need not be recreated.
Residual copies in SwiftTrail-controlled backups will be isolated from ordinary use and expire within 90 days after the applicable deletion instruction or termination. If a backup is restored, applicable deletion instructions will be reapplied. SwiftTrail will direct relevant Subprocessors to delete or return the data and will confirm completion on reasonable request, describing any permitted residual retention.
Anthropic API copies have a separate provider retention cycle: ordinarily up to 30 days from receipt or generation, with exceptions for law and permitted misuse or safety investigation. Flagged content can be retained longer. This Service is not offered as zero-retention. The provider-specific disclosure in the Subprocessor List forms part of this DPA, but does not authorize a retention practice that violates Applicable Privacy Law. SwiftTrail will not enable features with additional persistent content storage without first updating the processing disclosure and obtaining any required agreement.
Any legally required retention or permitted limited security retention must be restricted to its necessary purpose, protected by this DPA and ended when the basis expires. SwiftTrail will explain relevant exceptions to Customer unless legally prohibited. SwiftTrail will not retain Customer Content merely for general business convenience or product training. Separate minimal account, payment-status and legal-compliance records follow the Privacy Notice, without retaining source documents unnecessarily.
The Agreement's liability provisions apply to this DPA, without limiting non-waivable statutory obligations, individual rights or regulatory powers. This DPA continues for as long as SwiftTrail or its Subprocessors retain Customer Personal Data. Changes follow the Agreement's notice and acceptance process and cannot retroactively authorize a previously unauthorized use. Contact: [email protected].