Version date: September 19, 2026. Effective date and last updated: September 19, 2026.
SwiftTrail Data Solutions Ltd (Company No. C2026091700015), a company incorporated in Trinidad and Tobago trading as SwiftTrail (we or us), provides document-processing software to business customers. This Notice explains our handling of Personal Information through our website, business accounts, support communications and Service. Personal Information means information that identifies, relates to or can reasonably be linked to a person, as defined by applicable law.
For our own account administration, website operations and business records, we determine the purposes of processing and act as a controller or business where those legal terms apply. For Personal Information in documents for example: uploaded leases, rent rolls and extraction results (Customer Content), we generally act as a processor or service provider for the business customer. The customer determines why that information is collected and used; our Data Processing Addendum at useswifttrail.com/legal/dpa governs our handling on its behalf. These roles depend on the actual processing.
If a tenant or another person's information appears in a customer's document, that person should normally contact that customer first. We will route requests and assist the customer as appropriate. This Notice does not replace the customer's own privacy notice or authorize us to reuse its documents for unrelated purposes.
We receive information directly from users and business representatives, from their employer or account administrator, from documents customers submit, automatically through operation of the website and Service, and from Paddle concerning purchases and subscriptions. Providing required account information enables us to supply the Service; optional information should be limited to what is needed for the request.
As of the Effective date of this Notice, SwiftTrail had not yet collected personal information about website visitors, prospective customers or customers through its website or Service. Development and testing used only synthetic data that did not identify or relate to real individuals. Consequently, SwiftTrail had not disclosed such personal information for a business purpose, sold it, or shared it for cross-context behavioral advertising before that date.
Beginning at launch, SwiftTrail collects, uses and discloses personal information as described in this Notice. The sections below explain the information categories, sources, purposes, recipients and retention practices. Personal information in customer-uploaded documents and extraction results is processed on the customer's behalf under the Data Processing Addendum.
We review this Notice and its collection and disclosure history at least annually and update them when changes in our information practices or applicable law require it.
Names, work email addresses, business names, roles, contact details, account identifiers and authentication records come from users, their organizations and account activity. These are identifiers and professional or employment-related information. We use them to create and administer accounts, verify authorization, secure access and communicate about the Service. Hosting, authentication and communications providers may receive the information necessary for those functions. We retain it during the relationship and thereafter only as needed for account closure, security, dispute resolution and legal records; unnecessary profile information is deleted within 30 days after closure, subject to those limited exceptions.
Uploaded documents and outputs may include names, signatures, property and unit addresses, business contacts, rent, deposits, lease dates, payment status and other ordinary lease terms. These can include identifiers, commercial information, information within California Civil Code Section 1798.80(e), and professional information. We receive them from the customer and use them to carry out its extraction, storage, support, export and deletion instructions. Anthropic, Neon and Railway process necessary Customer Content as described in the Subprocessor List. Retention follows Section 6 and the DPA.
IP addresses, device and browser information, timestamps, account activity, extraction counts, error records and access logs are identifiers and internet or electronic-network activity information. We collect them through Service operation for security, troubleshooting, usage measurement and administration. Hosting and necessary security providers may receive these records. We keep identifiable operational logs only for the period reasonably needed to investigate errors, misuse or security events, with longer restricted retention when an unresolved incident or legal duty requires it. We exclude complete documents and AI requests from routine logs.
Paddle may provide the business name, billing contact and address, tax details where needed, transaction identifiers, amounts, subscription status and limited payment-status information. These include identifiers, commercial information and billing information within California Civil Code Section 1798.80(e). We use them to activate and administer subscriptions, handle support, reconcile transactions and maintain required records. Paddle and relevant professional advisers may receive necessary information. Records are retained for the applicable accounting, tax, audit or limitation periods and deleted when no longer needed. We do not collect full payment-card numbers or security codes through our own forms.
We receive names, contact details, issue descriptions and messages supplied by a user or representative. The categories depend on the message. We use them to answer requests, investigate problems and maintain a record of resolution. Necessary communications providers and authorized staff may handle them. We retain correspondence until the matter and any related dispute or legal-retention need ends. Avoid sending entire leases or unnecessary tenant information in support messages; use an approved secure channel if document access is required.
Do not submit Social Security numbers, government identification numbers or identity-document copies, full card or bank-account details, financial-login credentials, health information, biometric identifiers or other sensitive information unnecessary for ordinary lease extraction. A customer must redact such information before upload unless a signed amendment expressly permits it. Account authentication information may itself qualify as sensitive information under some laws; we use it only as needed to authenticate, secure and provide the account, rather than to infer characteristics about a person.
We do not sell Personal Information, share it for cross-context behavioral advertising, use it for targeted advertising, or use Customer Content to build marketing profiles. We do not use extraction to make decisions about an individual's eligibility for housing, credit, employment or similar opportunities. The output organizes information for customer review; it does not decide those matters.
We may use nonidentifying aggregate service statistics for capacity planning and improvement. Where we treat information as legally deidentified, we take reasonable measures to prevent reidentification, commit to maintaining and using it in that form, do not attempt to reidentify it except for legally permitted validation, and require recipients to comply with applicable restrictions. We do not use deidentification as a reason to retain or repurpose customer documents beyond the DPA.
Our Customer Content Subprocessors and their functions appear at useswifttrail.com/legal/subprocessors. Cloudflare provides authoritative DNS for our domain; that role may involve DNS technical records but does not receive our application documents. Other providers may handle only account, communications or business-operation information as described above. We restrict providers' access and use as appropriate to their roles.
Paddle.com Inc. acts as Merchant of Record and reseller for purchases, handling invoicing, payments and applicable transaction taxes. Paddle and its payment partners collect payment information through their checkout. We exchange the limited billing and subscription data needed to operate the purchase and Service; we do not send uploaded leases, rent rolls or extraction results to Paddle. Paddle's own purposes and processing are described in its Privacy Policy, while specific processing for SwiftTrail is governed by the applicable agreements. That policy may describe different cookie and advertising practices from SwiftTrail's own site. Purchase terms are available in Paddle Buyer Terms.
We may disclose necessary information to professional advisers, insurers or auditors; to authorities or others where legally required or appropriate to establish or defend legal rights; and to a successor or prospective transaction party under appropriate protections in connection with a corporate transaction. Customer Content disclosures remain subject to the DPA and applicable law. We do not authorize an incompatible new use merely because ownership of the business changes.
SwiftTrail uses Anthropic's commercial API for extraction, with training opt-in disabled. We do not use Customer Content to train general-purpose models or submit it through optional vendor feedback or training programs. Provider processing and retention, including necessary safety handling, are explained in the Subprocessor List and DPA.
On SwiftTrail's own website and application, we use essential cookies or similar storage for authentication, security, session continuity and user-requested functions. We do not deploy advertising pixels, cross-site behavioral trackers or nonessential analytics under this Notice. You can manage cookies through browser settings, although blocking essential storage may prevent account functions. Paddle's separate checkout and website have their own controls and disclosures.
SwiftTrail does not track an individual's activity across unrelated websites for advertising or permit third parties to do so through SwiftTrail's own pages under this configuration. Because we do not engage in that tracking, browser Do Not Track signals do not alter those practices. Global Privacy Control and other legally recognized opt-out signals concern separate privacy rights; we honor them where applicable. We do not sell or share information or engage in targeted advertising, so there is no such activity on SwiftTrail's own site to opt out of. If our practices change, we will update this Notice and implement required choices before the changed processing begins.
We use the category-specific criteria in Section 2 and keep Personal Information only as long as reasonably necessary for its stated purpose or a lawful retention obligation. For Customer Content, SwiftTrail-controlled active copies are deleted within 30 days after termination or an earlier valid deletion instruction, and isolated backup copies expire within 90 days of that event, as described in the DPA. Customers should export available material promptly during the permitted export period.
Anthropic's API normally retains input and output for up to 30 days from receipt or generation, with exceptions for law and permitted safety or misuse investigation. Flagged content may be kept longer. See the Subprocessor List useswifttrail.com/legal/subprocessors, for provider-specific periods and links. We do not promise zero retention or that deleting a SwiftTrail account immediately deletes every provider copy. Exceptions must remain lawful and restricted to their necessary purpose.
SwiftTrail is based in Trinidad and Tobago. Authorized personnel may access information there for administration, support or security. Providers may store or process information in the United States and other countries under their arrangements and the configurations disclosed in the Subprocessor List. Country of storage is not necessarily the same as every country of processing or support access. We do not promise US-only residency under this Notice and will apply legally required safeguards to transfers.
We use reasonable administrative, technical and organizational measures appropriate to the information, including access controls and protection of production data in transit and at rest. No system can guarantee complete security. Contact [email protected] with concerns and avoid sending passwords or sensitive documents by ordinary email.
Depending on applicable law and our role, you may have rights to confirm processing; access categories and specific information; obtain a portable copy; correct inaccuracies; delete information; obtain information about recipients, including a list of specific third parties where required; and opt out of sale, sharing, targeted advertising or certain consequential profiling. You may also have rights concerning sensitive information and automated decisions where the relevant law applies. We do not undertake the sale, advertising or decision-making practices described above, and do not use sensitive information beyond permitted service and security purposes under this Notice. We will not unlawfully discriminate or retaliate for exercising privacy rights.
Submit a request through useswifttrail.com/legal/privacy-request or email [email protected]. We may verify identity and authority using information proportionate to the request and will not require unnecessary sensitive information. An authorized agent may act where permitted; we may require proof of authorization and appropriate verification. We will respond within the period required by applicable law and explain any lawful extension or refusal. We generally aim to resolve verified requests within 45 days, but will meet a shorter legally required period.
To appeal a refusal, reply to the decision or email [email protected] with the subject Privacy Appeal. We will review the decision and respond within the applicable deadline, generally aiming for 45 days. If an appeal is denied where law requires a further complaint route, we will identify how to contact the relevant state attorney general or regulator. You may also contact your regulator directly. Requests about information we process solely for a business customer will be forwarded or directed to that customer.
For California residents, these rights include knowing applicable collection and disclosure categories and specific pieces of information, correction and deletion, subject to exceptions. Sections 2 through 6 describe categories, sources, purposes, recipient categories and retention. We do not sell or share Personal Information as defined by the CCPA, including information about individuals we know are under 16. We do not offer a financial incentive in exchange for Personal Information under this Notice.
You may unsubscribe from promotional email using its unsubscribe link or by contacting us; necessary account and service messages may continue. We do not knowingly invite children under 18 to create accounts, and the Service is not directed to children under 13. Incidental information about an occupant in a customer's lease is handled for that customer under the DPA; it does not mean we offer accounts to children. Contact us if you believe a child has supplied information directly inappropriately.
We review this Notice at least annually and update it when practices or requirements change. We will post the revised date and give additional notice or obtain consent for material changes where required. Changes do not retroactively authorize an incompatible use of previously collected information.
Privacy contact: [email protected]. General support: [email protected]. Website: useswifttrail.com. Postal address: SwiftTrail Data Solutions Ltd (Company No. C2026091700015), 14 Begonia Drive, Couva, Trinidad and Tobago.
Postal mail is not a designated channel for routine customer support or privacy requests. This does not restrict any communication method required by applicable law or invalidate legally effective notices. Copyright notices are governed by our Copyright / DMCA Policy.