Swaddl Privacy Policy

This Privacy Policy explains how Swaddl LLC ("Swaddl," "we," "us") collects, uses, and shares information about you when you use the Swaddl platform (the "Platform"). It applies to families ("Families") and doulas ("Doulas") alike. If you create your account on or after September 28, 2026 (Eastern time), this Privacy Policy applies to you from the day you create it; for accounts created before then, it takes effect on the Effective Date above.

---

1. Information We Collect

From everyone

• Account information: name, email address, phone number, password (stored hashed), and city or service area.
• Communications: messages you send through the Platform, support emails, and text messages sent through our notification system.
• Device and usage data: IP address, browser type, pages viewed, links clicked, and timestamps, collected through cookies, server logs, and product analytics.

From Families

• Intake responses: estimated due date or birth date, number of children, support needs, prior birth experiences, postpartum mood and mental health, feeding plans, partner and household situation, employer benefits coverage, and other context you choose to share.
• Payment information: processed by Stripe. We do not store full card numbers.
• Benefits information: employer benefits provider, member ID, and eligibility documents.

From Doulas

• Professional information: certifications, licenses, training, work history, references, photo, bio, and languages.
• Verification information: government ID, proof of insurance, and the result page of the background check you obtain on yourself, showing its date and outcome. We do not receive or keep the full report.
• Background check review records: if we review a background check result before deciding whether to approve or keep listing you (Doula Terms, Section 10.6), we keep a record of that review: our description of the record we considered, anything you send us about it, our written assessment, and the notices we send you. The result page itself is kept on its own schedule below.
• Tax and payout information: legal name, taxpayer identification number, and banking information, collected by Stripe.
• Service records: visit logs, hours, and care notes recorded in connection with bookings, including the name of any individual a Doula records as having attended a visit in the Doula's place.

2. How We Use Information

We use information to:

• Operate the Platform: matching, scheduling, communication, and payments.
• Review Doulas' credentials, insurance, and background check results.
• Prepare invoices and claim-ready statements formatted for employer benefit programs, and provide them to the Family, who submits the claim.
• Provide customer support.
• Detect and prevent fraud, abuse, and security threats.
• Send transactional messages (booking confirmations, reminders, payment receipts) and, with appropriate notice, occasional product updates.
• Improve the Platform through analytics on aggregated, de-identified usage data.
• Comply with legal obligations.

We do not sell your personal information.

3. How We Share Information

We share information with:

• Doulas you are matched with or book: relevant intake information so they can provide care.
• Families a Doula is matched with or booked by: the Doula's profile, certifications, and verification status, including whether a current background check is on file and its date.
• Swaddl administrators: for matching, support, billing, and safety review.
• Service providers acting on our behalf: Stripe (payments), DocuSign (contracts), Twilio (SMS), Resend (email), Supabase (database hosting), Vercel (web hosting), Google (calendar and video calls), Sentry (error monitoring), and PostHog (product analytics). These providers are bound by contracts that limit their use of your information. A Doula obtains a background check from a screening provider directly; that provider does not act on our behalf, and we do not send it your information.
• Employer benefit programs: we do not send your information to them. We prepare a statement and give it to you; you submit it, and the program reimburses you directly. We have no integration with these programs and transmit nothing to them.
• Legal and safety: when required by law or legal process, or to protect the safety of users or the public.
• Business transfers: if Swaddl is acquired or merges, your information may transfer to the successor under the protections in this Policy.

4. Sensitive Information

Some information you provide, particularly in Family intake, is sensitive (for example postpartum mental health, birth experiences, and feeding difficulties).

• HIPAA: Swaddl is not a HIPAA covered entity, and Doulas generally are not. Information you share through the Platform is not protected by HIPAA. We handle it as described in this Policy.
• Access: sensitive intake information is accessible only to the Doula matched or booked with you, authorized Swaddl administrators, and the service providers that need it to operate the Platform.
• No advertising use: we do not use sensitive intake content for advertising, for training third-party AI models, or for sale.

5. Data Security

We use commercially reasonable safeguards, including encryption in transit, encryption at rest by our database host, access controls, and logging of administrative actions. No system is perfectly secure. If a breach affects your information, we will notify you as required by law, including the New York SHIELD Act.

6. Your Choices and Rights

• Access and update: you can review and update most account information from your dashboard.
• Deletion: you may request deletion by emailing hello@swaddl.co. We delete information except where retention is required by law (for example tax, payment, and claim records) or needed to complete an active engagement.
• Communications: you can opt out of non-transactional email using the unsubscribe link, and stop text messages by replying STOP. You cannot opt out of essential transactional messages while you have an active account.
• State privacy rights: depending on your state of residence, you may have rights to access, correct, delete, or port your information and to opt out of certain processing. To exercise them, email hello@swaddl.co.

7. Retention

We retain your information while your account is active and as needed to provide the Platform. After account closure:

• Tax and payment records: 7 years.
• Claim documentation: as required by employer benefit programs, typically 7 years.
• Account profile, intake content, and visit records: 24 months, unless you request earlier deletion.
• Background check result pages: on the same schedule as account profile information, unless the law requires otherwise.
• Background check review records: 5 years after a review that ended in a decision not to approve or to stop listing a Doula, including after account closure, so we can show the review was carried out; other review records on the same schedule as background check result pages.

8. Children's Privacy

The Platform is for adults. We do not knowingly collect personal information from anyone under 18 about themselves. Family intake may refer to the children of the Family; we treat that information as belonging to the parent or guardian who provided it.

9. Text Messaging (SMS)

If you provide your mobile number and opt in, we may send you transactional text messages such as appointment and intro-call reminders, match notifications, contract and billing updates, and care-coordination messages. You opt in by providing your mobile number and agreeing to receive texts during signup, intake, or when you request a specific notification. Message frequency varies, and message and data rates may apply. You can reply STOP to any message to opt out at any time, or HELP for assistance.

No mobile information, including your phone number and your SMS opt-in or consent, will be shared with third parties or affiliates for marketing or promotional purposes. We use your mobile information solely to deliver the Swaddl service messages described above; text-messaging opt-in data and consent are never sold or shared with any third parties.

Questions about text messages: hello@swaddl.co.

10. Google Calendar Integration

Doulas may connect their Google Calendar to Swaddl. When you connect it, you grant Swaddl permission to (a) create, update, and delete the calendar events Swaddl schedules on your behalf, meaning intro calls and care visits, including their Google Meet links, and (b) read your free/busy availability so we do not double-book you. We do not read the contents or details of events that Swaddl did not create.

Swaddl's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Calendar data only to provide the scheduling features described above. We do not sell this data, use it for advertising, or allow humans to read it except where required for security, to comply with the law, or with your explicit consent.

You can disconnect your Google Calendar at any time from your Swaddl account settings. Disconnecting stops all future calendar access; events Swaddl has already created remain on your calendar unless you delete them.

For intro calls held in video rooms Swaddl hosts on Google Meet, we check Google's record of the room to confirm whether the call took place. We keep only whether it happened, not who joined or for how long.

11. International Users

Swaddl operates in the United States. If you access the Platform from outside the United States, your information will be transferred to and processed in the United States.

12. Changes to This Policy

We may update this Policy. Material changes will be communicated by email and through the Platform at least 30 days before they take effect.

13. Contact

Questions, requests, or concerns: hello@swaddl.co