1. About this Policy

This Privacy Policy explains how SWAGENTI Inc. ("SWAGENTI", "we", "us", or "our") collects, uses, discloses, protects, and retains personal information in connection with ChloAI, an AI-powered fashion workflow platform for business users.

This Policy is intended to satisfy applicable transparency requirements, including those that apply in Quebec and Canada, and to provide a GDPR-ready explanation of our practices where European or UK law applies.

2. Scope and Roles

ChloAI is intended for business use.

When a customer organization uses ChloAI for a workspace, uploaded content, prompts, outputs, and most workspace-user activity are generally processed by us on behalf of that organization. In that context, the organization generally acts as the controller or business customer, and we act as a service provider or processor.

We act as a controller for personal information we process for our own business purposes, including:

• creating and securing accounts;
• managing our relationship with customers and prospects;
• sending service, legal, and administrative notices;
• preventing fraud, abuse, and security incidents;
• providing support;
• complying with legal obligations; and
• maintaining business records.

If you use ChloAI through your employer or another organization, that organization's own privacy notice may also apply to your use of the service.

3. Privacy Officer

The person in charge of the protection of personal information for SWAGENTI is:

Title: Privacy Officer

Email: privacy@chloai.design

Mailing address: info@chloai.design

Questions, complaints, and privacy-rights requests may be sent to that contact.

4. Personal Information We Collect

We collect only the information we need to operate, secure, support, and improve ChloAI.

a. Account and identity information

• name, display name, and email address;
• authentication method;
• organization membership, role, invitations, and account status.

b. Workspace and collaboration information

• workspace structure, collections, boards, comments, approvals, handoff records, audit events, and related metadata.

c. Customer content

• images, design assets, briefs, reference materials, documents, prompts, notes, and other content uploaded, created, or submitted through the service.

Customer content may include personal information about the customer's own personnel or third parties. The customer organization is responsible for ensuring it has an appropriate lawful basis and authority to upload and use that content.

d. AI interaction data

• prompts, instructions, model inputs, generated outputs, and generation metadata such as timestamps, model or feature used, and success/error status.

e. Technical, usage, and security information

• IP address, device and browser information, session identifiers, timestamps, log data, and performance or error information;
• information reasonably necessary for security monitoring, fraud prevention, and service reliability.

f. Communications and support information

• information you provide when contacting us for support, reporting bugs, sending feedback, or otherwise communicating with us.

g. Billing information

• during paid plans, billing contact details, billing history, and related account records.
• payment card details are processed by our payment processor, not stored in full on our own systems.

We do not intentionally request special-category or highly sensitive personal information. Do not upload that kind of information unless it is strictly necessary, lawful, and covered by appropriate safeguards.

5. How We Use Personal Information

We use personal information to:

• provide, operate, maintain, and secure ChloAI;
• authenticate users and manage organization membership and permissions;
• store, display, search, and process customer content and workspace data;
• generate AI-assisted outputs requested by users;
• provide support, respond to inquiries, and communicate important service information;
• monitor performance, diagnose bugs, and improve reliability;
• improve features and user experience using aggregated or de-identified information where reasonably possible;
• prevent fraud, abuse, misuse, and security incidents;
• enforce our Terms of Service and other lawful agreements; and
• comply with legal obligations.

We do not sell personal information.

We do not use customer workspace content for advertising.

We use cookies for operational purposes, including authentication and session management.

6. Legal Grounds, Consent, and Notice

Under Quebec and other Canadian privacy laws, we rely on consent and other lawful grounds recognized by applicable law, depending on the context and purpose of the processing.

Where the GDPR or UK GDPR applies, our legal grounds may include:

• performance of a contract;
• legitimate interests, where those interests are not overridden by the individual's rights;
• legal obligation; and
• consent, where consent is specifically required or requested.

If we request consent for a specific purpose, we will seek it in a clear and specific manner. You may withdraw consent where the law gives you that right, subject to legal or contractual limits and the possibility that withdrawal may prevent us from providing the service or feature.

7. AI Features and Model Providers

ChloAI includes AI-assisted features. These features process prompts, content, and related inputs in order to generate requested outputs.

AI outputs are probabilistic and may not always be accurate, complete, unique, or suitable for production use without human review. Please see our Terms of Service for the contractual rules that apply to AI outputs.

8. Sharing and Disclosure

We disclose personal information only as needed to operate the service, comply with the law, or protect rights and security.

We may disclose personal information to:

• hosting, infrastructure, database, storage, authentication, email, payment, and AI service providers;
• customer-enabled integrations and identity providers;
• professional advisers, auditors, insurers, and acquirers in connection with corporate transactions;
• competent authorities, regulators, courts, or law enforcement where required by law; and
• other parties where necessary to establish, exercise, or defend legal claims or protect rights, safety, and security.

Our current service providers may include providers such as:

• Supabase for authentication, database, and storage;
• Vercel for hosting and related infrastructure;
• Resend for transactional email; and
• Google for optional OAuth sign-in.

If we maintain a separate subprocessors page, it will provide the most current list.

9. International and Cross-Border Processing

Personal information may be stored, accessed, or processed outside Quebec, outside Canada, and outside the jurisdiction where the individual is located, including in the United States and other jurisdictions where our service providers operate.

Where required, we use reasonable contractual and organizational safeguards for those transfers.

Before communicating personal information outside Quebec, we conduct any privacy impact assessment required by applicable Quebec law.

Where the GDPR or UK GDPR applies to a transfer, we rely on an appropriate lawful transfer mechanism, which may include standard contractual clauses or another recognized safeguard.

10. Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including to provide the service, meet legal requirements, resolve disputes, and enforce agreements.

Unless a different period is required by law or agreed in writing:

• active account information is retained while the account remains active;
• customer content and workspace data are deleted within 30 days after account closure or workspace termination, subject to legal retention needs and any agreed export window; and
• billing and tax records are retained as required by applicable law.

11. Your Rights

Depending on your location, your relationship to the account, and the nature of the processing, you may have the right to:

• access personal information;
• request correction of inaccurate or incomplete information;
• request deletion, subject to legal or contractual limits;
• withdraw consent where processing is based on consent;
• request portability of certain personal information in a structured, commonly used technological format, where required by law and technically feasible;
• object to or request restriction of certain processing, where applicable; and
• complain to a competent privacy regulator.

If your request relates to workspace content controlled by your employer or another customer organization, you should normally direct the request to that organization first. We may forward or refer your request to the relevant customer organization where that organization is the controller and we act as its processor or service provider.

We generally respond to valid requests within 30 days or within another period required by applicable law. We may need to verify identity and authority before acting.

12. Automated Processing

ChloAI uses automated systems, including AI-assisted generation features, to process content and generate outputs.

ChloAI does not use personal information to make decisions based exclusively on automated processing that produce legal effects concerning an individual or similarly significant effects on an individual, unless expressly disclosed otherwise and required safeguards are provided.

If that changes for any feature, we will provide the notices and rights required by applicable law.

13. Security and Confidentiality Incidents

We use reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, disclosure, loss, and other misuse.

These safeguards may include measures such as:

• access controls and role-based permissions;
• tenant-scoped permissions and workspace isolation measures;
• encryption in transit and encryption at rest;
• logging and monitoring for security and reliability; and
• controlled internal access to production systems.

No system is perfectly secure.

If a confidentiality incident or breach involving personal information occurs, we will take the steps required by applicable law, including mitigation, recordkeeping, and notifications to affected persons and regulators where legally required.

14. Children

ChloAI is a business service and is not intended for children.

We do not knowingly collect personal information directly from children under 14 in Quebec, or under the age threshold applicable under other relevant laws, without the legally required authorization.

If you believe a child has provided personal information in violation of this section, contact us and we will investigate and take appropriate action.

15. Changes to this Policy

We may update this Privacy Policy from time to time.

If we make a material change, we will post the updated version, update the "Last updated" date, and provide any notice required by law or reasonably appropriate in the circumstances.

16. Contact

Privacy Officer: privacy@chloai.design

General inquiries: info@chloai.design

Security reports: security@chloai.design

Mailing address: info@chloai.design