Swallow Privacy Policy
Last updated: July 2026
This Privacy Policy describes how Llow Group Limited, trading as Swallow (“Swallow”, “we”, “us” or “our”), collects, stores, uses and discloses personal data regarding individuals who:
Please read this Privacy Policy carefully. You are not legally required to provide us with personal data, but without it we may be unable to provide the Swallow Services to you.
This Privacy Policy forms part of our Terms and Conditions. Capitalised terms not defined here have the meaning given in the Terms.
Swallow is the data controller for personal data described in this Policy, except where we act as data processor on behalf of a customer (see section 10).
Controller
Llow Group Limited (company no. 14334541)
3rd Floor
86–90 Paul Street
London EC2A 4NE
United Kingdom
Data Protection Officer
Callum Rimmer
contact@llow.io
ICO registration
We are registered with the UK Information Commissioner’s Office (registration C1340741).
When you register, we collect your name, email address, workplace or company name, password (stored as a hash, not in clear), and, optionally, other profile details you provide.
If you sign up via a federated identity provider (for example a magic-link email flow or a social login such as Google or Microsoft), we receive the identifiers and profile details that provider passes to us.
We collect API keys, OAuth client IDs and secrets you issue, MCP session tokens, request logs (including timestamp, endpoint, tool name, response size and error status), IP address, user agent string and quota accounting data.
This includes pricing models, projects, tests, calculations, uploaded spreadsheets, custom prompts and any other content you enter into the Swallow Services.
You retain ownership of Customer Data. See the Terms and Conditions for the licence you grant us to host and process it.
If you subscribe to a paid tier, our payment processor Stripe collects your payment details (card number, billing address and related information) directly.
We receive from Stripe a customer identifier, subscription status, invoice history and the last four digits of your card, but we do not store your full card details.
We collect connectivity, technical and aggregated usage data including:
We keep records of correspondence with our support team, feedback you submit and any calls with our team where we notify you that recording is taking place.
We use personal data to:
We do not sell your personal data.
We do not use Customer Data or your prompts to train third-party large language models.
Requests sent to our AI subprocessors (Google Gemini and Anthropic Claude) are transmitted under contractual terms that prohibit those providers from using the data to train their public models.
The Swallow Services use machine learning models (including large language models and structured extraction models) to suggest inputs, structure content and assist in authoring pricing models.
These tools assist your work but do not produce decisions with legal or similarly significant effects. You remain responsible for any decisions or outputs you produce using the Swallow Services.
For users in the United Kingdom or European Economic Area, our lawful bases are:
You may withdraw consent at any time.
The Swallow Services and supporting infrastructure, including hosting, authentication, databases, backups and disaster recovery systems, are located in the United States.
Where personal data is transferred outside the United Kingdom or European Economic Area, we rely on appropriate safeguards including:
We engage selected third-party providers to help operate the Swallow Services.
These may include providers of:
These providers may access personal data only where necessary to perform services on our behalf and only for the purposes agreed in our contracts with them.
Where Swallow acts as data controller, these providers act as data processors.
Where Swallow acts as data processor for a customer, these providers act as subprocessors.
We retain personal data only for as long as necessary to provide the Swallow Services, comply with legal obligations and defend legal claims.
We may retain personal data for longer where required by law or in connection with an active dispute.
We apply industry standard technical and organisational measures including:
No online service can guarantee absolute security.
If we become aware of a personal data breach affecting your personal data, we will notify you and the appropriate supervisory authority where required by law.
Where UK or EU GDPR applies, you have the right to:
To exercise your rights, email contact@llow.io.
We may need to verify your identity before responding.
If we process your data on behalf of a customer organisation, please contact that organisation’s administrator.
If you believe we have handled your data unlawfully, you may complain to the UK Information Commissioner’s Office on 0303 123 1113 or via ico.org.uk, or to your local supervisory authority within the EEA.
For visitors, individual account holders and administrators, Swallow acts as the data controller.
Where a customer organisation provides access to the Swallow Services for its employees or contractors, that customer acts as data controller and Swallow acts as data processor under our Data Processing Agreement.
If your data is processed on behalf of a customer organisation, please contact that organisation directly with any requests.
The Sites use cookies and similar technologies as described in our Cookie Policy.
Non-essential cookies are only used with your consent.
Our API and MCP endpoints do not use cookies and instead authenticate using bearer tokens.
We may send transactional communications relating to billing, service availability, security notifications and password resets. These cannot be opted out of while your account is active.
We may also send marketing communications where permitted by law and where you have consented where required.
You can unsubscribe at any time using the link in each email or by contacting contact@llow.io.
The Swallow Services are not intended for individuals under 16 years of age.
If we become aware that we have collected personal data from a child, we will delete it.
The Sites may contain links to third-party websites.
We are not responsible for their privacy practices and encourage you to review their privacy policies before providing personal data.
We may update this Privacy Policy from time to time.
Where changes are material, we will notify you through the Sites or by email.
Continued use of the Swallow Services after changes take effect constitutes acceptance of the updated policy.
For any questions, requests or complaints relating to this Privacy Policy or your personal data:
Llow Group Limited (trading as Swallow)
Attn: Data Protection Officer
3rd Floor
86–90 Paul Street
London EC2A 4NE
United Kingdom
Email: contact@llow.io
