Last updated: June 15, 2026
Contact: hello@tryswell.co

Swell (San Gregorio Labs Inc.) uses the following third-party service providers ("subprocessors") to operate the Service. This list applies to personal data and call content processed on our behalf.

We review subprocessors for security and privacy practices appropriate to their role. Enterprise customers requiring notification of subprocessor changes or a DPA should contact hello@tryswell.co.

INFRASTRUCTURE AND PLATFORM

Vercel
Purpose: REST API hosting, auth proxy, scheduled jobs
Data processed: Account tokens (transit), API metadata, session sync
Location: United States
Security documentation: https://vercel.com/security

Railway
Purpose: WebSocket coaching relay
Data processed: Transcript text (transit), session metadata
Location: United States
Security documentation: https://railway.app/legal/privacy

Convex
Purpose: Database (profiles, session storage)
Data processed: Email, user ID, transcripts, coaching data (temporary)
Location: United States
Security documentation: https://www.convex.dev/security

Upstash
Purpose: Distributed rate limiting
Data processed: User IDs, rate-limit counters (metadata)
Location: United States or EU (region-dependent)
Security documentation: https://upstash.com/trust

AUTHENTICATION

WorkOS
Purpose: User authentication (OAuth, email login)
Data processed: Email, user identifier, auth tokens
Location: United States
Security documentation: https://workos.com/security

AI AND SPEECH

Deepgram
Purpose: Speech-to-text
Data processed: Audio stream (transit); transcript text
Location: United States
Security documentation: https://developers.deepgram.com/trust-security/data-privacy-compliance

OpenAI
Purpose: Real-time coaching trigger
Data processed: Transcript snapshots (transit)
Location: United States
Security documentation: https://openai.com/security

Anthropic
Purpose: Coaching suggestions
Data processed: Transcript text, coaching context (transit)
Location: United States
Security documentation: https://www.anthropic.com/trust

Note: The Mac app connects directly to Deepgram for speech-to-text using a short-lived token issued by Swell's API. OpenAI and Anthropic are invoked server-side only from Swell's coaching infrastructure.

OBSERVABILITY

Sentry
Purpose: Crash and error reporting (Mac app)
Data processed: Stack traces, app version, error context; PII disabled by default
Location: United States
Security documentation: https://sentry.io/security

DISTRIBUTION (APPLE)

Apple
Purpose: Code signing, notarization, Gatekeeper
Data processed: Binaries submitted for notarization
Security documentation: https://support.apple.com/guide/security/welcome/web

Apple is listed for transparency on distribution; Apple does not process call content.

DATA FLOW SUMMARY

From the user's Mac:

• Deepgram (audio to text) — direct from Mac

• api.tryswell.co (auth, sessions) — Vercel

• coach.tryswell.co (coaching WebSocket) — Railway

• Convex (storage) — via Swell backend

• Sentry (crashes) — from Mac, if configured

Server-side only:

• OpenAI and Anthropic — invoked from Swell coaching infrastructure, not directly from the Mac

CHANGES TO THIS LIST

We will update this page when we add or replace subprocessors that process personal data or call content. Material changes may be communicated to active users where appropriate.

June 15, 2026 — Initial subprocessor list