Privacy Policy

1. Overview

Swivel ("Swivel," "we," "us," or "our") provides a spin-to-win recognition and rewards application for Slack, available at playswivel.com and app.playswivel.com (together, the "Service"). This Privacy Policy explains what information we collect, how we use and share it, and the choices you have.

Swivel is a workplace tool. In most cases, the organization that installs Swivel into its Slack workspace (your employer or team, the "Customer") controls the data processed through the Service. We process that data on the Customer's behalf and in accordance with our agreement with them. If you are an individual user with questions about your organization's use of Swivel, please contact your workspace administrator first.

By installing or using Swivel, you agree to this Privacy Policy and to our Terms of Service.

2. Information we collect

Information you provide

• Account and workspace information — when Swivel is installed, we receive your Slack workspace name and ID, and the installing user's name, Slack user ID, and email address.
• Configuration content — spinner names, prize names and descriptions, win probabilities, quantities, channel selections, and permission settings created by admins.
• Recognition content — nominations, the nominee you select, and the note you write when triggering a spin. This content is posted publicly in the Slack channel you choose.
• Support communications — messages, attachments, and contact details you send us by email or through in-app support.
• Billing information — for paid plans, the billing contact, plan, seat count, and billing address. Card details are entered directly with our payment processor; Swivel does not receive or store full payment card numbers.

Information we receive from Slack

See Section 3 for detail on the specific Slack permissions Swivel requests and what each is used for.

Information collected automatically

• Usage data — spins triggered, wheel results, prizes won and claimed, fulfillment status, feature usage, and timestamps.
• Log and device data — IP address, browser type and version, operating system, referring pages, and diagnostic information when you use our website or dashboard.
• Cookies and similar technologies — we use strictly necessary cookies to keep you signed in to the dashboard and to maintain session security, and limited analytics cookies to understand aggregate site usage. You can block or delete cookies in your browser settings, though the dashboard may not function correctly without necessary cookies.

3. Slack data and permissions

Swivel requests only the Slack scopes it needs to operate. When your workspace installs Swivel, you grant the following:

Swivel does not read your Slack message history. We do not request or store the contents of channel conversations. When you use the "Use Swivel" message action (right-click on a message), Swivel receives only that single message's author and the channel context, so it can pre-fill the nomination form.

4. How we use information

We use the information described above to:

• provide, operate, and maintain the Service — running spins, selecting winners, posting results, and tracking prize fulfillment;
• deliver prizes, including passing a winner's email address to a fulfillment partner when a prize requires it;
• authenticate users and secure accounts;
• process billing and manage subscriptions;
• respond to support requests and communicate about service changes, outages, and security notices;
• analyze aggregate usage to improve features, reliability, and performance;
• detect, investigate, and prevent fraud, abuse, and violations of our Terms; and
• comply with legal obligations and enforce our agreements.

We do not sell your personal information. We do not share personal information for cross-context behavioral advertising, and we do not use Customer data to train third-party machine learning models.

5. How we share information

We share information only in the following circumstances:

• Within your workspace — spins, nominations, notes, and results are posted in the Slack channel selected by the person triggering the spin and are visible to the members of that channel. Workspace admins can see activity history and fulfillment status in the dashboard.
• With integrations you enable — if your admin connects HeyTaco, Bonusly, Zapier, or a gift card provider, we send the data necessary to award the prize (for example, a winner's email address or workspace user identifier).
• With service providers — vendors that host our infrastructure, process payments, send email, and provide analytics or support tooling, each bound by confidentiality and data protection obligations. See Section 6.
• For legal reasons — when we believe disclosure is required by law, regulation, legal process, or governmental request, or is necessary to protect the rights, property, or safety of Swivel, our users, or the public.
• In a business transfer — in connection with a merger, acquisition, financing, or sale of assets, subject to the acquirer honoring commitments made in this policy.

6. Subprocessors

We use the following categories of subprocessors to deliver the Service:

Email support@playswivel.com to request the current subprocessor list or to be notified of changes.

7. Data retention

We retain workspace configuration and activity data for as long as your workspace has Swivel installed, so that admins can review spin history and fulfill outstanding prizes. After uninstall or account closure, we delete or anonymize Customer data within 90 days, except where we are required to keep records for legal, tax, accounting, or dispute-resolution purposes. Backups are purged on a rolling schedule. Aggregate, de-identified statistics that cannot be linked to an individual or workspace may be retained indefinitely.

8. Security

We use industry-standard safeguards to protect information, including encryption in transit (TLS) and at rest, scoped access controls and least-privilege permissions for staff, encrypted storage of Slack OAuth tokens and integration API keys, and monitoring and logging of administrative access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your data, we will notify affected Customers without undue delay and as required by applicable law.

9. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information; to object to or restrict certain processing; to withdraw consent; and to appeal a decision or lodge a complaint with a supervisory authority. We do not discriminate against anyone for exercising these rights.

Because Swivel processes most personal information on behalf of the Customer, we will generally direct requests from individual users to the relevant workspace administrator and will assist that Customer in responding. To make a request, email support@playswivel.com from the address associated with your account. We will verify your identity before acting and respond within the time required by applicable law.

10. Deleting your data

An admin can remove Swivel from a Slack workspace at any time via Slack → Settings & administration → Manage apps → Swivel → Remove App. Uninstalling revokes Swivel's access tokens immediately and stops all further data collection. To request deletion of data already stored, email support@playswivel.com and we will delete it within 30 days of verifying the request, subject to the legal retention exceptions in Section 7.

11. International transfers

Swivel is operated from the United States and our infrastructure providers store data in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S., where data protection laws may differ from those in your country. Where required, we rely on appropriate transfer mechanisms, such as the European Commission's Standard Contractual Clauses.

12. Children's privacy

Swivel is a workplace product intended for use by people aged 16 and older. It is not directed to children, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above. For material changes, we will provide additional notice, such as an in-app message or an email to workspace administrators, before the change takes effect. Your continued use of the Service after an update takes effect constitutes acceptance of the revised policy.

14. Contact us

Questions, requests, or complaints about this policy or your data can be sent to:

Swivel
Email: support@playswivel.com
Web: www.playswivel.com