Privacy policy

This privacy policy explains how S M B D M TECHNOLOGY L.L.C (Dubai DET licence 1652369, Office C-11, Al Khabaisi, Deira, Dubai, United Arab Emirates; "we", "us") handles personal data in Sawadoo (sawadoo.com, app.sawadoo.com, the API, MCP server and apps). Privacy questions and requests go to support@sawadoo.com.

In short: we don't sell personal data; we follow the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, "PDPL"); and a data processing agreement is available on request.

Our role

• For the content your organisation puts into its account (projects, messages, files, and information about your employees, clients and other people), your organisation decides what is collected and who sees it. We process it on its behalf and on its instructions.
• For our own purposes (running accounts, sign-in, billing, security, support and telling you about the Service) we decide how data is used.

What we collect

• Account and profile: name, email address, password (stored only as a hash), two-factor settings, company, title, time zone, avatar and notification settings.
• Your content: everything people add to an account, including files, emails forwarded into projects, chat messages and voice notes.
• Billing (once online payment is live): plan, billing address, tax ID and invoices. Card details are entered on Stripe's payment pages and never stored by us.
• Usage and security records: sign-ins and active sessions (browser and device description, IP address), activity in projects, the audit trail of admin changes, API and AI usage counts, and error logs.
• Messages to us: support emails and anything you send us.

How we use it

To provide the Service and its features (including sharing with clients, notifications, exports and integrations you set up), to sign people in and keep accounts secure, to apply plans and limits, to bill, to answer support requests, to tell you about important changes, and to meet legal obligations. We don't use your content to advertise to you and we don't sell personal data.

AI features

• When someone uses the assistant or an agent, their prompt and the project content needed for the answer (only what that person may see) are sent to our AI provider, Anthropic, through its API, using the Claude Sonnet model. Anthropic processes this to produce the answer. Under its commercial API terms, Anthropic does not use this data to train its models and keeps it only for a limited period for trust and safety.
• If an owner or admin adds their own AI key (OpenAI, Anthropic, Google or OpenRouter), prompts and that content go to that provider instead, under the account's own agreement with it.
• Owners and admins can switch the assistant and agents off for the whole account. Answers and agent actions are kept in the account like other content.

Who processes data for us

• Amazon Web Services (Mumbai, India region, ap-south-1): hosting, the database, file storage, backups and email delivery (Amazon SES sends and receives the Service's email).
• Anthropic: the AI assistant and agents (see above).
• Cloudflare: domain name service and routing of mail sent to support@sawadoo.com.
• Stripe: payments, once online payment is live.
• Google: only if someone chooses "Sign in with Google".
• Your browser's push service (Apple, Google or Mozilla): delivers browser notifications, only if you turn them on.

These providers process data only as needed to provide their part of the Service. Some may process data outside the UAE (for example AWS in India, and Anthropic in the United States); where data leaves the UAE we rely on the safeguards the PDPL allows, such as contractual protections. We may also disclose data where the law requires it, or to protect people and the Service. Inside an account, people see what the account's owners and admins allow.

Where data is stored

Production data, files and backups are stored by AWS in the Mumbai (ap-south-1) region, encrypted at rest and sent over encrypted connections.

How long we keep it

• Account data is kept while the account exists. Items in the trash are deleted for good after 30 days. Account owners can set how long chat and direct-message history is kept.
• Closed accounts are deleted for good 30 days after closing.
• Backups: database backups are kept for 14 days and earlier versions of files for 30 days, so deleted data leaves our backups within 30 days.
• Account exports are deleted 7 days after they are made. Emails forwarded into a project are stored with it; the raw incoming messages are deleted after 90 days.
• Records we must keep, such as invoices and tax records, are kept for as long as the law requires.

Cookies

The app uses only cookies it needs to work, and no advertising or third-party tracking cookies:

• the sign-in session cookie (keeps you signed in, for up to 30 days);
• the interface language you chose on this device;
• the last account you opened (so the app opens it again);
• whether you hid the trial banner today;
• a one-time cookie that shows a new API token once after you create it;
• short-lived cookies used only while signing in (for example during two-factor sign-in).

The marketing site sets no cookies.

Your rights

Under the PDPL and other laws that apply, you may ask to access, correct or delete your personal data, to get a copy of it, to restrict or object to processing, and to withdraw consent where we rely on it. Email support@sawadoo.com; we may need to confirm who you are. If your data is in an organisation's account, we will usually pass your request to that organisation and help it respond. You can also complain to the UAE Data Office.

Security

Access is limited by account and by the permissions each organisation sets; accounts are isolated from each other in the database. Files are private and shared only through short-lived links. Two-factor sign-in is available. Exports leave out passwords, API tokens, webhook signing secrets and AI keys. Own AI keys are stored encrypted and never shown again. No system is perfectly secure; if a breach affects your personal data we will notify you and the authorities as the law requires.

Changes

We will post changes here with a new effective date and tell account owners by email or in the app before significant changes take effect.