Privacy policy

Last updated: 2026-09-01

Data controller

The data controller for personal data collected on this site is SwarmForge, a project pending registration, led by Jean-Philippe Riposo and Frédéric Aime. The registered office will be specified once the company is registered.

Data Protection Officer (DPO): dpo@swarmforge.fr.

Our privacy stance

This site is designed to collect the minimum of personal data:

No advertising cookies, remarketing pixels, or sharing for commercial targeting purposes.
Cookieless audience measurement operates with analytics storage denied. Cookie-backed measurement remains disabled until you explicitly accept it. Refusing is as direct as accepting, and the choice can be changed later.
Server logs (nginx) are anonymised at collection: the last octet of IP addresses is zeroed before writing to disk. Logs are kept for 30 days, then automatically erased.

Cookies and trackers

The site stores one preference cookie after you accept or reject analytics cookies. It prevents the consent banner from reappearing on every page.

Cookie	Issuer	Purpose	Duration
`sw_consent`	swarmforge.fr	Stores your cookie choice	6 months

The authentication cookies below apply only when you visit the separate accounts service:

Cookie	Issuer	Purpose	Duration
`sw_oauth_tx`	accounts.swarmforge.fr	Google OAuth handshake	10 minutes
`sw_sess`	accounts.swarmforge.fr	Authenticated session (`accounts` subdomain)	30 days

Audience measurement — Google Analytics 4

The site loads Google Analytics 4 (property G-PX0965Q4RH) in advanced Consent Mode for aggregate audience measurement. Analytics storage is denied by default. Before you make a choice, and after a rejection, the Google tag sends cookieless measurement signals but does not read or write analytics cookies. With your explicit consent only, analytics storage is granted and Google Analytics uses cookies for more accurate measurement.

Cookies after consent: _ga and _ga_PX0965Q4RH, configured for no more than 13 months. No analytics cookie is created when analytics storage is denied.
Data sent: cookieless and consented measurement may include the page path without its query string, the referring path without its query string, consent state, device and browser information, language and traffic source. Form values and use-case descriptions are never sent.
Purpose: aggregate site-usage statistics. Advertising storage, advertising user data, personalisation and Google signals remain disabled.
Legal basis: legitimate interests in aggregate, cookieless audience measurement (GDPR article 6(1)(f)); consent (GDPR article 6(1)(a)) for analytics storage and cookie-backed measurement.
Event-data retention: 14 months in the Google Analytics property.
Processor: Google Ireland Limited. Transfers to Google LLC in the United States may occur under the EU–US Data Privacy Framework.
Withdrawal: use the Cookies link available from the site footer. Withdrawal applies immediately and removes recognised analytics cookies.

Demo-request form

The form published on app.swarmforge.fr allows you to request a platform demo. Submitting the form involves collecting the following data:

Data collected: name, work email address, firm or company (optional), role (optional), free-text message (optional).
Purpose: to organise and conduct the requested demo; if you have explicitly accepted, to send you product communications (news, invitations).
Legal bases:
- pre-contractual measure (organising the demo);
- explicit consent (tick-box, GDPR art. 6.1.a) for marketing communications.
Recipients: SwarmForge staff handling your enquiry.
Retention:
- active lead (before demo + 12 months): kept on our infrastructure;
- no follow-up: 3 years after last contact;
- marketing consent withdrawal: applied immediately;
- erasure on request: within 30 days.

Use-case form

The use-case page provides a contact form for a paid integration run jointly with your team. It lets you briefly introduce a project and request an initial conversation with SwarmForge.

Data collected: name, work email, organisation and a brief description of the project, its current blocker and its objectives.
Purpose: understanding the request, preparing an initial conversation and contacting its author. These answers are not sent to an AI model.
Legal basis: steps taken at your request before entering into a contract (GDPR art. 6.1.b). The form checkbox confirms that you have read this notice and wish to be contacted; it is not marketing consent.
Recipients: SwarmForge staff responsible for partnerships and integration. A notification is sent to contact@swarmforge.fr after the request has been recorded.
Abuse protection: a self-hosted anti-robot challenge, submission rate limits and temporarily retained pseudonymised technical keys. No third-party CAPTCHA service is called.
Retention: the same periods as demo requests: active follow-up, then no more than 3 years after the last contact when there is no further action; erasure on request within 30 days. Anti-replay and rate-limit receipts have a 48-hour useful window, then are deleted by the next processing or maintenance operation.

Each consent (T&Cs + marketing) is timestamped, versioned and stored in an append-only consent ledger. A withdrawal appears as a new entry, never as a modification of an earlier entry. You can request an export of your consent history at any time.

Visitor account (Google OAuth)

You can create a visitor account on accounts.swarmforge.fr by signing in with Google. This account lets you track the status of your demo request, manage your GDPR consents, and self-delete your data at any time.

Data collected at sign-in: opaque Google identifier (sub), verified email address, name, profile picture URL, preferred language. We do not store your Google password or access tokens; the identity token (id_token) is verified then discarded.
Purpose: tracking your demo request, managing your communication preferences, exercising your GDPR rights.
Legal basis: explicit consent (GDPR art. 6.1.a) at the first Google sign-in.
Strictly-necessary cookies: sw_oauth_tx (10 minutes, duration of the OAuth round-trip) and sw_sess (30 days, authenticated session). No cookie banner is required for these two cookies (CNIL guidance for strictly-necessary cookies).
Retention: as long as your account exists. You can delete it at any time from accounts.swarmforge.fr/en/me/. Deletion erases your demo requests, linked consents, and your session. A cryptographic trace (SHA-256 hash of your email and your Google sub) is kept as proof of erasure for GDPR audit purposes.

Unsubscribing

Every marketing message contains a one-click unsubscribe link. You can also:

click the native Unsubscribe button in your mail client (Gmail, Outlook, Apple Mail) — we implement RFC 8058;
write to dpo@swarmforge.fr with subject “unsubscribe”.

Sub-processors

The following sub-processors may process your personal data, strictly within the scope of their assignment:

Sub-processor	Purpose	Data location	DPA
Google Ireland Limited (Google Workspace)	Receiving and sending email from `contact@swarmforge.fr` and `dpo@swarmforge.fr`	EU	Workspace DPA
Google Ireland Limited (Google Identity Services)	Verifying identity during the Google OAuth handshake — only at sign-in	EU / international	Google API Services User Data Policy
Google Ireland Limited (Google Analytics)	Cookieless aggregate audience measurement; cookie-backed measurement only after explicit consent	EU / international	Google Ads Data Processing Terms

No other sub-processor is used for the activities described in this notice. The website and platform servers are hosted in France (Côte d’Azur) on dedicated infrastructure controlled by SwarmForge.

Under the EU General Data Protection Regulation (2016/679), you have:

right of access, rectification, and erasure;
right to restrict and object to processing;
right to data portability;
right to define post-mortem directives;
right not to be subject to automated decision-making;
right to withdraw your consent at any time.

To exercise these rights, write to dpo@swarmforge.fr. You will receive a response within one month.

Recourse

If after contacting us you consider your rights are not respected, you may lodge a complaint with the CNIL (French data protection authority): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.