Privacy Policy

Effective date: September 1, 2026

1. Who we are and what this covers

Swooply is operated by Mithra Labs LLC, a Washington limited liability company ("Swooply," "we," "us," "our"). This Privacy Policy explains what personal information we collect, why, who we share it with, and the choices and rights you have.

It applies to swooply.ai, our web application, our emails and newsletters, and any other service that links to it (the "Service").

It does not apply to what an employer does with your information after you accept an introduction to that employer. Once your information is released to an employer at your direction, that employer handles it under its own privacy practices, and you should direct questions about it to them.

The Service is intended for users in the United States. We do not target it to individuals in the European Economic Area, the United Kingdom, or Switzerland, and this policy does not describe rights under the GDPR.

2. The short version

• Candidates control their own visibility. Nothing about you is shown to an employer until you enroll, approve your summary, and turn discoverability on.
• Your name is withheld by default. Employers browse anonymized profiles. Your name, contact details, résumé, and current or former employer are released to a specific employer only when you accept an introduction to that employer.
• You can see who looked. Your account includes a log of employer access to your profile.
• We do not sell your personal information, and we do not share it for cross-context behavioral advertising or targeted advertising.
• Candidates never pay us. Our revenue comes from employers.
• You can leave. Turn off discoverability, delete your profile, or close your account at any time.

3. Personal information we collect

3.1 Information you give us

If you are a candidate:

If you are an employer contact: name, business email, title, company, and the job postings and board URLs you connect.

If you subscribe to our newsletter: email address, and any name or company you choose to provide.

3.2 Information collected automatically

IP address, approximate location derived from IP (city/region level), browser and device type, operating system, referring URL, pages viewed, links clicked, timestamps, and email open and click events. Collected through cookies and similar technologies — see Section 12.

3.3 Information from other sources

• Public regulatory filings, including Form D filings made with the U.S. Securities and Exchange Commission, used to identify recently funded companies.
• Publicly accessible job boards and career pages, including boards an employer connects to the Service, used to build and maintain role listings.
• Business contact data providers used to identify hiring contacts at prospective employer accounts. This is business contact information about people in their professional capacity.
• Separating employers. Where a company engages us in connection with a workforce transition, it may provide a roster of affected employees — typically name and work or personal email — so that we can invite them to enroll. See Section 6.
• Analytics and email providers, as described in Section 8.

3.4 Sensitive information — what we do not want

We do not ask for, and ask you not to provide: Social Security or other government identification numbers, financial account or payment card numbers, precise geolocation, health or medical information, biometric or genetic data, immigration or citizenship status, criminal history, union membership, religious beliefs, political affiliation, sexual orientation, or racial or ethnic origin.

We do not collect consumer health data as defined by the Washington My Health My Data Act, and we do not use the Service to infer health status. If you include any of the above in a free-text field or in your résumé, you do so voluntarily; we do not use it in matching and you may ask us to remove it.

We do not knowingly collect information from anyone under 18.

4. How we use personal information

We use personal information to:

1. Operate the Service — create and maintain your account, build your masked profile, and honor your visibility settings.
2. Generate summaries and matches — see Section 5.
3. Make introductions — surface relevant candidates to employers and, when a candidate accepts, release that candidate's identifying information to that specific employer.
4. Maintain the access log — record which employers viewed which profiles, so candidates can see it.
5. Communicate with you — service, account, security, and match notifications; support; and, if you opted in, our newsletter and other marketing email.
6. Improve the Service — analytics, debugging, measuring which features are used.
7. Verify employers and prevent misuse, fraud, scraping, and unauthorized access.
8. Report on cohorts — where a separating employer engaged us, provide that employer with aggregate and status-level reporting, subject to the limits in Section 6.
9. Comply with law and enforce our Terms of Use.

Legal bases and consent. For candidates, the core processing above is performed at your direction and with your consent, which you may withdraw at any time by turning off discoverability or deleting your profile.

5. Automated processing and AI

We use automated processing, including machine learning and large language models, to:

• extract structured information from résumés and job postings;
• generate a written summary of a candidate's background; and
• compute a relevance score between a candidate and a role, with an explanation of contributing factors.

Safeguards:

• A candidate's summary is not published until that candidate approves it. You see exactly what employers will see, before they see it.
• Scores and summaries are advisory. They are not employment decisions. Every hiring decision is made by the employer, by human beings.
• You may request human review of any automated output about you, and correction of anything inaccurate, by writing to privacy@swooply.ai.
• You may opt out of being included in automated matching by turning off discoverability, without losing access to your account.

6. Rosters from separating employers — the rule that matters

Where a company engages us in connection with a layoff or workforce reduction, it may give us a list of affected employees so we can invite them to use the Service.

A roster creates invitations, never profiles.

• Receiving your name on a roster does not create a profile for you.
• It does not make you visible to any employer.
• You become discoverable only if you enroll, approve your own summary, and turn discoverability on.
• If you never enroll, you never appear, and we delete your roster entry.

What your former employer can see. If your former employer engaged us, it receives reporting on the cohort's progress — how many people enrolled, how many are active, how many have landed, and status-level information about individuals. It does not receive your résumé, your profile content, your summary, the names of employers interested in you, or where you go. It sees status, never content.

We do not accept, and will not process, disclosure schedules provided under the Older Workers Benefit Protection Act (29 U.S.C. § 626(f)(1)(H)) or comparable age-and-title listings.

7. How we disclose personal information

We disclose personal information in these circumstances, and no others:

7.1 To an employer you chose. When you accept an introduction, we release your name, contact information, résumé, and profile to that specific employer. We tell you which employer, before you accept.

7.2 To employers, in masked form. Verified employers can browse profiles in which your name, contact details, and current and former employer identity are withheld.

7.3 To a separating employer that engaged us, limited to the status-level reporting described in Section 6.

7.4 To service providers who process information on our behalf under contract, and only on our instructions: hosting and infrastructure, database, email delivery, analytics, error monitoring, AI model providers, and customer support tooling.

7.5 For legal reasons. To comply with law, valid legal process, or a government request; to enforce our Terms; or to protect the rights, property, or safety of Swooply, our users, or the public. ****

7.6 In a business transaction. In connection with a merger, financing, acquisition, or sale of assets, subject to the acquirer honoring this policy for information collected under it.

7.7 With your direction. Anything else you ask us to do.

We do not sell personal information, and we do not share it for cross-context behavioral advertising or targeted advertising, as those terms are defined by California and other state privacy laws. We have not done so in the preceding 12 months.

8. Third-party services we use

9. How long we keep information

Backups are purged on a rolling [__]-day cycle, so deleted data may persist in backup for that period before it is overwritten.

10. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, access controls limiting employee access to what is necessary, and logging of access to candidate profiles.

No system is perfectly secure. We cannot guarantee the security of information transmitted to or from the Service. If we become aware of a breach affecting your personal information, we will notify you and any regulator as required by applicable law.

11. Your rights and choices

11.1 Available to everyone

• Access the personal information we hold about you.
• Correct anything inaccurate.
• Delete your profile and account.
• Turn off discoverability at any time, without deleting your account.
• Review the access log showing which employers viewed your profile.
• Approve or withdraw your AI-generated summary.
• Unsubscribe from marketing email.
• Request human review of an automated output about you.
• Port your data — receive it in a portable, machine-readable format.

We extend these rights to all users of the Service, regardless of where you live.

11.2 State privacy law rights

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, your state's comprehensive privacy law may give you rights to know, access, correct, delete, obtain a copy of, and limit certain uses of your personal information, and to opt out of sale, targeted advertising, and certain profiling.

For California residents specifically. In the preceding 12 months we have collected the categories of personal information described in Section 3 (identifiers; professional or employment-related information; education information; internet or network activity; approximate geolocation; and inferences drawn from the foregoing), from the sources in Section 3, for the purposes in Section 4, and disclosed them to the categories of recipients in Section 7. We have not sold personal information and have not shared it for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes beyond those permitted by Cal. Civ. Code § 1798.121. You have the right not to be discriminated against for exercising your rights; we do not offer financial incentives.

Job applicants and employees. California's privacy law also covers information collected in an employment context. Candidates using Swooply are not our employees or applicants; you are a user of our service, and the disclosures above cover you.

11.3 How to exercise your rights

Most rights can be exercised directly in your account settings. Otherwise, write to privacy@swooply.ai with the email address associated with your use of the Service and a description of your request.

• Verification. We will verify your request by confirming control of the associated email address, and may ask for additional information for high-risk requests. We will not use it for anything else.
• Timing. We respond within 45 days, and may extend once by another 45 days where permitted, with notice to you.
• Authorized agents. An agent may submit a request on your behalf with proof of authorization; we may still contact you to confirm.
• Appeals. If we deny your request, you may appeal by replying to our decision with the word "Appeal." We will respond to an appeal within 45 days. If we deny the appeal, you may contact your state attorney general.

12. Cookies, analytics, and Global Privacy Control

We use cookies and similar technologies that are:

• Strictly necessary — authentication, session management, security. These cannot be turned off.
• Functional — remembering your preferences.
• Analytics — understanding how the Service is used.

We do not use advertising or cross-site tracking cookies.

You can control cookies through your browser. Disabling strictly necessary cookies will break the Service.

Global Privacy Control. We honor the GPC signal as a valid opt-out of sale and sharing where applicable law requires it. Because we do not sell or share personal information, the signal does not change our practices, but it is respected.

Do Not Track. Browsers' DNT signals are not standardized and we do not respond to them; we honor GPC instead.

13. Marketing communications

If you subscribe to our newsletter or other marketing email, you can unsubscribe using the link in any such message or by writing to privacy@swooply.ai. We honor unsubscribes promptly and keep a minimal suppression record so we don't email you again.

Service and transactional messages — account, security, and match notifications — are not marketing, and you will continue to receive them while your account is active.

14. Children

The Service is for adults. We do not knowingly collect personal information from anyone under 18. If we learn we have, we will delete it. Contact privacy@swooply.ai if you believe a minor has provided us information.

15. Changes to this policy

We may update this policy. If we make material changes, we will update the effective date and give reasonable notice — by email to registered users, by notice on the Service, or both — before the changes take effect. Where required by law, we will obtain your consent.

16. Contact us

Mithra Labs LLC (d/b/a Swooply) [street address] [city], WA [zip]

Privacy: privacy@swooply.ai Legal: legal@swooply.ai

Washington residents may contact the Washington State Attorney General's Office. California residents may contact the California Privacy Protection Agency or the California Attorney General. Residents of other states may contact their state attorney general.