Privacy policy

Swell – Training and Development, Lda., NIF PT514093510, Rua Augusto Rosa, 79 — 4000-098 Porto, Portugal. We are the data controller for everything described here.

For anything in this policy: privacy@swell.com.pt. For anything else: hello@swell.com.pt.

The problem you describe, in your own words, exactly as you type it. You are asked not to include names or anything you would not put in an email to a colleague, and we do not check — so what you write is what we hold.

Your answers to the questionnaire. These are stored as the identifier of the option you chose, never as free text, and an answer of “I don’t know” is stored as exactly that rather than as a value.

A work email address, once you choose to verify one in order to receive the Brief. It is stored on its own: there is no password, no profile and no account.

How you arrived — the page you landed on, the referring address, and any campaign parameters in the link you followed.

Technical records of the assessment: which prompt versions and which models produced it, how long each call took, and a hash of the reply.

This is the part that makes this policy different from the one on swell.com.pt, and it is stated precisely rather than generally.

The problem you describe IS sent to OpenAI, so that it can be read and the decision underneath it proposed back to you for confirmation. That transfer leaves the European Union.

Your assessment — the bands, the gaps and the recommendation — is also sent, so that the Brief can be written in readable prose. The problem text is NOT sent again at that stage.

Your email address is never sent to a model, at any point. That is enforced by the software and covered by an automated test, not by a policy of care.

We do not use anything you write to train a model. What OpenAI itself may retain, and for how long, is governed by its own published terms for data sent to its API.

To produce your Decision System Brief, and to let you return to it later.

To count the one free completed assessment per email address.

To understand which parts of the method work — how many questions it takes, where evidence is usually missing, which readings needed correcting.

We do not sell your data, and we do not send marketing on the strength of an assessment. If we contact you about one, it will be because you asked us to.

Contract performance, for producing and returning the Brief you asked for.

Legitimate interest, for the technical records that let an assessment be explained and defended afterwards, and for improving the method.

Consent, for any commercial contact. It can be withdrawn at any time without affecting the Brief you already have.

Legal obligation, where one applies.

The Brief is kept indefinitely, deliberately. It is a record of exactly what you were shown on the day, and it is never re-generated — so that a sentence you quote back to us a year later is one we can still produce.

The problem text and your answers are kept with it, because the Brief cannot be explained without them.

Technical records of model calls are deleted after 90 days.

Ask us to delete any of it and we will, including the Brief.

OpenAI, as described above.

PTServidor, our hosting provider, which operates the server and the database. Both are in Portugal, and so are the backups: nothing about this application is stored outside the country. The transfer to OpenAI described above is the one exception, and it is a transfer of the text you write rather than of the database it is kept in.

Our email provider, Microsoft Azure Communication Services, which sends the verification message. It receives your address and nothing about your assessment.

Public authorities, where the law requires it.

Under the GDPR you may ask for access to your data, correction of it, its deletion, a restriction on how it is processed, a copy of it in a portable form, and you may object to processing or withdraw consent.

Write to privacy@swell.com.pt. If you are not satisfied with our answer you may complain to the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese supervisory authority.

Verification codes and links are stored only as a SHA-256 hash, and compared in constant time — a copy of the database does not let anyone verify an address.

The connection is encrypted in transit. Access to the database is limited to the application.

If this policy changes in a way that affects what we do with data already collected, we will say so rather than quietly update the date.