Privacy Policy

1. Information we collect

Information you provide to us

Depending on how you interact with us, we may collect information such as:

• your name;
• email address;
• phone number;
• preferred contact method;
• inquiry subject and message;
• whether you permit us to text you about a particular inquiry;
• whether you choose to receive Workshop Updates;
• information you provide in direct email or another legitimate business communication channel; and
• information needed to provide or document services to you.

Our Contact form requires at least one usable contact method. Email is required if you choose to receive Workshop Updates.

The Contact form tells you not to include passwords, payment information, or other sensitive information. We do not intentionally ask for passwords, full payment-card numbers, Social Security numbers, medical information, government-identification numbers, or similar unnecessary sensitive information. Because free-text messages can contain information a sender chooses to provide, we cannot guarantee that sensitive information will never be received. If unnecessary sensitive information is received, we seek to minimize or remove it where practical.

Customer and transaction information

If you become a customer, we may maintain information reasonably needed to provide and document the service, such as your name, address, phone number, email address, service purchased, customer notes, estimates or invoices, amounts, payment status, payment date, and supporting documents that are genuinely needed for the transaction or service.

Our public website does not currently accept online payments, and we do not intentionally place full payment-card numbers or other unnecessary sensitive information in customer notes or supporting records.

Information collected automatically

Our website hosting, security, anti-abuse, and analytics systems may process technical information generated when your browser connects to the site. Depending on the system and your analytics choices, this can include information such as:

• page or path visited and page title;
• referrer;
• browser, operating system, device type, screen size, and language;
• approximate country or other coarse location derived from network information;
• page-load and performance measurements;
• date/time and interaction or event information; and
• network/security information such as IP address, user agent, browser signals, or challenge-verification information where needed to operate and protect the site.

We do not use GPS or another first-party mechanism to collect your precise physical location through the website.

2. How we use information

We use personal information as reasonably necessary to:

• respond to inquiries and communicate with you;
• provide, support, and document requested services;
• send inquiry-specific text messages when you have given permission for that inquiry;
• administer Workshop Updates when you affirmatively subscribe;
• maintain subscription and unsubscribe preferences;
• understand website usage and improve the website and services;
• operate, secure, troubleshoot, and protect the website and our systems;
• maintain business, accounting, transaction, and support records;
• handle privacy requests;
• comply with legal obligations and lawful requests; and
• establish, exercise, or defend legal rights when necessary.

We do not sell personal information. We do not use third-party advertising, retargeting, or advertising networks on the website. We do not use personal information for automated decisions that produce legal or similarly significant effects.

3. Website analytics, cookies, and privacy choices

We use separate systems for website performance/security and for optional website-usage analytics. These systems do not all operate in the same way.

Cloudflare website analytics and security

Our hosting and security provider supplies website infrastructure, security and anti-abuse functions, Turnstile verification, and Web Analytics/real-user performance measurements.

Cloudflare Web Analytics is configured in its regional exclusion mode. Cloudflare currently documents that this mode does not process RUM performance data for connections to its listed EEA data centers and also includes Great Britain and Switzerland in that exclusion list.

Cloudflare security and anti-abuse functions are separate from optional website analytics. Security systems may use necessary cookies or browser storage, such as challenge or clearance mechanisms, and may process technical signals needed to detect abuse or verify a browser. Declining optional analytics does not disable security measures that are needed to operate or protect the website.

Umami website analytics

We use Umami for deeper website-usage analytics, including page activity, anonymous session-level activity, and a small number of named website events. Our current custom events identify successful Contact submissions and Workshop Updates signups; we do not send the contents of Contact messages or other form fields as custom Umami event properties.

Umami is not included as an unconditional external script in the site's initial HTML. Our first-party analytics controller decides whether Umami may load.

Our release policy is:

• United States: Umami may load automatically unless Do Not Track is enabled or a valid stored refusal exists.
• EEA, United Kingdom, and Switzerland: Umami is disabled.
• Other countries, including Canada: Umami requires an affirmative Allow analytics choice before it loads.
• Unknown, ambiguous, malformed, or Tor-associated geography: we default to requiring consent rather than automatically loading Umami.

We use country information associated with the network connection to make this routing decision. The browser receives only an analytics class rather than the raw country value, and our analytics-choice cookie does not contain your IP address, country, identity, timestamp, analytics identifier, or session identifier. VPNs, proxies, Tor, and network routing can affect how a connection is classified.

If a choice is required, you can select Allow analytics or Continue without analytics. The website remains usable either way.

When you make a choice, we use a host-only cookie named sb_analytics_choice to remember allow_v1 or deny_v1 for up to 180 days. The cookie is not created for an ordinary United States visitor who has never made an analytics choice. A stored refusal continues to be respected if you later visit from the United States. A stored permission does not override a jurisdiction where Umami is disabled.

Where the site displays Analytics choices, you can reopen the choice and change it. If analytics have already loaded and you withdraw permission, the site records the refusal and reloads the page so the new choice takes effect cleanly.

Do Not Track and cross-site tracking

Our first-party analytics controller honors a browser Do Not Track signal when it is clearly enabled by keeping Umami off, and the Umami tracker is also configured to honor DNT as an additional safeguard. DNT does not create an analytics-choice cookie by itself.

We do not currently implement Global Privacy Control as a separate site-wide signal.

We do not use third-party advertising or retargeting technologies, and our website analytics are intended to measure activity on our own site rather than track visitors across unrelated websites for advertising.

4. Workshop Updates and marketing email

Workshop Updates is our opt-in marketing-email category. We do not subscribe you merely because you contact us, become a customer, receive an invoice, or because we otherwise possess your email address.

You can subscribe through a dedicated Workshop Updates signup or by checking the separate Workshop Updates option on the Contact form. When a signup succeeds, we may maintain your normalized email address, current subscription status, signup source, consent timestamp, and provider-generated metadata needed to administer the subscription.

We currently have recipient-level open tracking and click tracking turned off for Workshop Updates.

You can unsubscribe from Workshop Updates by:

• using the unsubscribe link provided in a Workshop Updates email;
• using the Workshop Updates unsubscribe form on this Privacy Policy page; or
• emailing privacy@swarmandburrow.com.

Unsubscribing changes your Workshop Updates marketing preference. It does not automatically delete an independently retained Contact inquiry, customer record, transaction record, privacy-request correspondence, or other information that we have a separate reason to retain.

A later affirmative Workshop Updates signup may resubscribe the email address under our current subscription design.

When we send Workshop Updates, the messages will include the sender identification, contact information, and unsubscribe mechanism required by applicable law. We do not use inquiry-specific text-message permission as consent for SMS marketing, and we do not operate a Workshop Updates SMS program.

5. How we disclose information

We disclose personal information only as reasonably necessary for the purposes described in this policy. Relevant categories of service providers can include:

• website hosting, infrastructure, security, and anti-abuse services;
• data analytics services;
• email and communication services;
• marketing-email and subscription-management services; and
• finance and accounting services when customer or transaction records are involved.

For example, a completed Contact inquiry is delivered to our business email system; an affirmative Workshop Updates signup is sent to our marketing-email provider; analytics information may be processed by our analytics providers when analytics are authorized; and technical security information may be processed by our hosting/security provider.

We may also disclose information when reasonably necessary to comply with law, respond to lawful process, protect rights or security, investigate abuse, or establish or defend legal claims.

We do not sell personal information or disclose it to third-party advertising networks for targeted advertising.

If you communicate with us through a third-party platform, such as a social network or business-profile service, that platform may also process the information under its own privacy practices.

6. How long we keep information

Retention depends on the type of record and why it is needed. Our general business rules are:

• Non-customer inquiries: generally three years after the last substantive interaction, unless a longer period is justified by an active dispute, security issue, legal obligation, or documented business need.
• Customer transaction and supporting records: generally six years after the relevant transaction or end of the customer relationship, subject to longer or shorter record-specific periods when appropriate for tax, asset-basis, warranty, dispute, legal, security, or similar requirements.
• Active Workshop Updates subscriptions: subscription information is retained while needed to administer the subscription.
• Unsubscribed Workshop Updates addresses: we retain information needed to preserve and document the unsubscribe/suppression state and related consent or compliance history as necessary. Provider-generated metadata or marketing-interaction history may also remain according to the provider's systems and retention practices.
• Privacy requests: we retain the minimum information reasonably needed to handle and document the request and any applicable legal obligations.
• Analytics, security, and infrastructure information: retention depends on the relevant provider, configuration, aggregation, and security needs. We do not make a universal deletion-time promise for provider-side logs or analytics records where the provider-specific period has not been established.

Where practical, we delete or minimize information that is no longer needed and review retention practices periodically. A stated business retention period is not a representation that every provider implements an automatic deletion rule on exactly that schedule.

7. Your privacy rights and choices

Depending on the law that applies to you and to a particular processing activity, you may have rights to request access to personal information, correct inaccurate information, request deletion, obtain information about processing, or withdraw consent.

You may email privacy@swarmandburrow.com to make a privacy request or to ask how information we maintain about you can be reviewed or corrected. We may take reasonable steps to verify your identity or authority before acting on a request. We will consider and respond to requests as required by applicable law. Some information may need to be retained despite a deletion request for transactions, taxes, legal obligations, security, disputes, warranties, unsubscribe suppression, or other legitimate and legally permitted purposes.

Marketing unsubscribe requests are handled separately from general privacy/deletion requests. Analytics choices are handled through the website controls described above where those controls apply.

8. Children under 13

Our website and services are intended for a general audience and are not directed to children under 13. We do not ask every visitor for age information merely because the site is general audience.

If we obtain actual knowledge through a message or other interaction that a sender is under 13, we stop ordinary processing of that submission and do not enroll the child in Workshop Updates based on the child's own submission. If no response is needed, we promptly delete the child's personal information. If a legally permitted one-time response is appropriate, we use only the minimum information needed for that response and then promptly delete the child's online contact information. If ongoing interaction is needed, a parent or guardian must take over and the appropriate consent and handling requirements must be evaluated before we continue.

If you are under 13, please have a parent or guardian contact us or provide information on your behalf.

9. Security

We use technical and organizational safeguards intended to protect personal information in light of the nature of our systems and the information we handle. These include access controls, anti-abuse verification, secure provider integrations, minimization practices, and restricted access to private operational systems where appropriate.

No method of Internet transmission or electronic storage can be guaranteed to be completely secure. Please do not send passwords, full payment-card numbers, Social Security numbers, medical information, government-identification numbers, or other unnecessary sensitive information through ordinary website or email channels.

10. Changes to this Privacy Policy

We may revise this Privacy Policy when our services, systems, providers, data practices, or legal obligations change.

For ordinary or non-material revisions, we will update the effective or revised date when the new version takes effect. For material changes, we will display a conspicuous sitewide notice for 30 days after the revised policy takes effect. Unusually significant changes affecting information already collected may require additional notice or consent depending on the circumstances and applicable law.

We do not create a separate cookie, beacon, or analytics identifier solely to determine whether a particular visitor has seen a Privacy Policy change notice.

11. Contact us

For privacy questions or requests, contact: