Privacy Policy

Last updated: October 20, 2026

This Privacy Policy explains how Swarmed ("Swarmed", "we", "us", or "our") collects, uses, shares, and protects personal information when you use the website at beeswarmed.org and any related services, features, or messages we provide (collectively, the "Service"). It applies to visitors, people who report a swarm ("reporters"), registered beekeepers and removal professionals, association members and admins, and people we contact or work with in a business capacity.

It is written to meet the EU and UK General Data Protection Regulation (GDPR and UK GDPR), the Swiss Federal Act on Data Protection (FADP), the U.S. state privacy laws that apply to us (including the California Consumer Privacy Act as amended by the CPRA), the U.S. Telephone Consumer Protection Act, and the Australian Privacy Principles.

The short version. When you report a swarm, nearby beekeepers see roughly where it is, your photos and your description, but not your exact address or contact details. Only the beekeeper who claims the swarm gets your name, phone number, email address and exact address, so they can arrange collection. In the United States, if no beekeeper is available or the insects are not honey bees, we may pass your request to a pest-control or removal marketplace, which pays us a fee. We never sell beekeepers' phone numbers, and we never share mobile numbers collected for text or WhatsApp alerts with anyone for their marketing.

1. Who We Are (Data Controller)

The Service is operated by two affiliated businesses, both trading as "Swarmed". Which one is responsible for your personal data (the "controller") depends on where you are located:

• Swarmed, a sole proprietorship registered in the Netherlands (KvK 96813733), Louis Couperusplein 2 T, 2514 HP The Hague, the Netherlands, is the controller for people located in the European Economic Area (EEA), the United Kingdom, and Switzerland. For a swarm report, this is decided by where the swarm is.
• Swarmed LLC, a Wyoming, USA limited liability company, 30 N Gould St, Sheridan, WY 82801, USA, is the controller for everyone else, including people in the United States and Australia.

Both businesses use the same website, database, and service providers. Our main database and our hosting are in the United States (see Section 6).

Contact for either business, including for any privacy question or request: [email protected].

2. Personal Data We Collect

2.1 If you report a swarm

• Contact details: your name, email address, and phone number.
• Location: the swarm's street address and map coordinates. If you use "Locate me", we read your device's location with your browser's permission and use it only to place the swarm on the map.
• The report itself: photos, your answers about the swarm (size, height, how long it has been there, situation), any free-text description, and whether you own the property.
• Consent records: the exact consent wording you were shown, the time you submitted, your IP address and browser user agent, and a TrustedForm certificate (see Section 5.5). We keep these to prove what you agreed to.
• Updates: the status of your report, who claimed it, and messages about it.

2.2 If you use the photo identification tool

The photo you upload. You don't need an account, and we don't ask for your name or contact details there.

2.3 If you register as a beekeeper, removal professional, or association member

• Account data: name, email address, password (stored hashed), language, account type, and, if you sign in with Google, the basic profile Google shares with us.
• Alert settings: your alert location (a map pin), alert radius, which channels you want alerts on (email, text message, or WhatsApp), and your phone number if you choose text or WhatsApp.
• Activity: alerts sent to you, swarms you claim, release, or skip, outcomes you record, and the swarms you log.
• Billing: your plan and payment status. Card details are entered on Stripe's pages and we never see or store them.
• Profile and association data: association memberships, and anything you add to a profile.

2.4 Everyone who visits

• Technical and usage data: IP address, browser and device type, operating system, language, approximate country (from our hosting provider), referring website, pages viewed, clicks, and timestamps. See Section 9 for cookies, analytics, and error monitoring.
• Communications: emails, support requests, survey answers, and feedback you send us.
• Optional sign-ups: for example, the email address you give us to be told once when local honey is available.

2.5 People we contact or work with in a business capacity

If you work for a beekeeping association, research body, supplier, media outlet, or other organisation we contact or partner with, we hold your name, role, organisation, work contact details, and notes of our correspondence and meetings with you. We get these from you, from your organisation's public website or listings, or from business contact databases.

Some data is necessary for a feature to work. For example, we can't route a swarm report without a location and a way to reach you. If you don't provide it, we may be unable to deliver that feature.

3. How We Use Personal Data and Our Legal Bases

The GDPR requires a legal basis for each use. Where GDPR doesn't apply to you, we still use your data only for these purposes.

• To route your swarm report to beekeepers and arrange collection, including sharing it as described in Section 4. Legal basis: performing the service you asked for (Art. 6(1)(b)).
• To send beekeepers the alerts they signed up for by email, text message, or WhatsApp, and to run accounts, dashboards, subscriptions, and billing. Legal basis: contract (Art. 6(1)(b)).
• To check report photos and details with automated tools, so that wasp, hornet, and bumble bee reports and established colonies don't go to beekeepers as swarm alerts (see Section 13). Legal basis: legitimate interests in sending beekeepers only relevant alerts (Art. 6(1)(f)).
• To send service messages (confirmations, claim notices, security notices, changes to terms). Legal basis: contract and legitimate interests (Art. 6(1)(b) and (f)).
• To answer support requests, including with AI-assisted drafting that a person reviews. Legal basis: legitimate interests (Art. 6(1)(f)).
• To keep the Service secure (bot protection, fraud and abuse prevention, rate limiting, error monitoring, audit logs). Legal basis: legitimate interests (Art. 6(1)(f)).
• To measure and improve the Service (analytics, session replay). Legal basis: consent where the law requires it (Art. 6(1)(a)), otherwise legitimate interests (Art. 6(1)(f)).
• To send newsletters and other marketing emails. Legal basis: consent (Art. 6(1)(a)), or, for existing account holders where the law allows, legitimate interests with an unsubscribe link in every email.
• To contact and work with organisations (Section 2.5). Legal basis: legitimate interests in running and growing the Service (Art. 6(1)(f)).
• To share photos and stories about swarms on our website and social media, without your name or address. Legal basis: legitimate interests (Art. 6(1)(f)). Tell us if you'd rather your photos weren't used.
• To comply with the law (tax, accounting, lawful requests). Legal basis: legal obligation (Art. 6(1)(c)).
• To establish, exercise, or defend legal claims, including keeping consent records. Legal basis: legitimate interests (Art. 6(1)(f)).

Where we rely on legitimate interests, we have weighed them against your rights and concluded the processing is necessary and proportionate. You can object at any time (Section 11).

4. Who Sees Your Swarm Report, and When

A swarm report passes through stages. At each one, the people below can see the following:

Beekeepers are independent. Beekeepers and associations are not our employees or agents. Once a beekeeper or association receives your details, they decide how to use them to collect the swarm and are responsible for that use as a separate controller. They should use your details only to deal with your swarm. If you think a beekeeper has misused them, tell us and we will act, up to removing them from Swarmed.

Data about beekeepers that others see. When you claim a swarm, the reporter receives your first name and phone number (or email address), and your name and contact details appear on their private report page. The share page for a report you claimed shows your name. Our public homepage activity feed shows the first names of beekeepers who were alerted to a recent report, with each beekeeper's alert location rounded to about 1 km, to show reporters that real local beekeepers respond. Our legal basis is legitimate interests (Art. 6(1)(f)). If you'd rather not appear, email [email protected] and we will leave you out of the feed. Association admins can see members' names, email addresses, and phone numbers to manage membership, and, if the association turns it on, other members can see a member roster.

5. Other Sharing

We don't sell beekeepers' or account holders' personal data. We use Meta (Facebook and Instagram) to advertise Swarmed, and for that we share a limited set of data as described in Section 5.6, which California and some other U.S. states call "sharing" for targeted advertising. You can opt out. We share personal data only as follows.

5.1 Service providers (processors)

These vendors process personal data on our behalf, under contracts that limit them to our instructions:

5.2 Pest-control and removal marketplaces (United States only)

If you are in the United States, and your report is for wasps or hornets, there is no beekeeper available for it, or no beekeeper claims it within a few days, we may pass your request to a home-services marketplace that connects you with a local pest-control or removal professional. These currently are Networx Systems, Inc. and its partner contractors, and Inquirly.

• What we send: your name, email address, phone number, the street address, city, state and ZIP code, a description of the problem, whether you own the property, your IP address and browser user agent, and your TrustedForm certificate. We don't send your map coordinates or photos.
• Why: so a professional can contact you and offer to remove the insects. The marketplace pays Swarmed LLC a fee for each request it accepts. Under some U.S. state laws this counts as a "sale" of personal information (see Section 12).
• Their role: each marketplace and contractor is an independent business with its own privacy policy, and may contact you by phone, text message, or email, including by automated technology, as described in Section 10.
• Not outside the U.S.: we never send reports for swarms outside the United States to these marketplaces.
• Opting out: tick "Don't pass my request to pest-control or removal companies" on the report form, turn on Global Privacy Control in your browser, or email [email protected], and we won't pass on your requests. To stop a marketplace or contractor contacting you, reply STOP to their texts or ask them directly.

5.3 Associations you join

If you join an association through Swarmed, its admins can see and download your name, email address, and phone number to manage membership.

5.4 Legal reasons and business transfers

We may disclose personal data if required by law, legal process, or a lawful request from a public authority, or to protect the rights, safety, or property of Swarmed, our users, or the public. If our business is merged, acquired, financed, or sold, personal data may transfer under confidentiality protections, and we will tell you if that materially changes this policy.

5.5 Consent certificates

On the report form, a TrustedForm script from ActiveProspect records how the form was displayed and submitted, so that we and the marketplaces in Section 5.2 can prove what you agreed to. The certificate is shared only with those marketplaces. The script never loads for visitors in the EEA, the UK, or Switzerland, or when we can't tell where you are.

5.6 Advertising on Meta

We advertise on Facebook and Instagram, and we use three kinds of data for it.

• Website activity through Meta's pixel. Where optional marketing cookies are on (Section 9) and your browser doesn't send a Global Privacy Control signal, Meta receives the pages you view and actions such as signing up, submitting a report, starting checkout or paying, together with your browser identifiers. With the same consent we may also send Meta the payment event from our server (the amount, the currency, and the browser identifiers, IP address and browser type captured at checkout), but never your name, email address or phone number in that event. We don't send that event for anyone who has opted out as described below.
• Hashed contact lists of account holders. We may upload the email addresses and phone numbers of confirmed account holders in the United States, Canada and Australia who agreed to receive marketing email from us, to Meta in hashed (scrambled) form. We decide the country from your alert area and your phone number, and leave you out if either points elsewhere. Meta matches them to its own users and tells us nothing back about who matched. We use this to avoid showing recruitment ads to people who already have an account, and to ask Meta to find people similar to our paying members. We don't upload the details of reporters, of anyone outside those three countries, of anyone who declined marketing email, or of our own staff and test accounts, and a list is never sold to anyone else. Meta handles the data under its own Custom Audience terms.
• Audiences built from our Facebook Page. People who engaged with our Facebook Page can be grouped by Meta into an audience we can advertise to. We don't receive their identities.

Our legal basis is legitimate interests (Art. 6(1)(f)) for the account-holder lists, and consent where it is required for the pixel (Art. 6(1)(a) and the ePrivacy rules). To opt out of the list uploads and the server-side payment event, email [email protected] with the subject "Do not share my information". We will stop sending the payment event for your account, leave you out of future uploads, and remove you from any list we have already uploaded within 30 days. To stop the pixel, turn off marketing in "Cookie settings" (Section 9) or use Global Privacy Control in your browser.

6. International Data Transfers

Our database and hosting are in the United States, and several providers in Section 5.1 process data there or elsewhere outside your country. When we transfer personal data from the EEA, the UK, or Switzerland, we rely on an adequacy decision (including the EU-U.S. Data Privacy Framework, the UK Extension, and the Swiss-U.S. framework where the provider is certified) or on the European Commission's Standard Contractual Clauses with the UK Addendum and Swiss amendments. You can ask us for a copy of the relevant safeguards.

If you are in Australia, your personal data is held in the United States and may be processed in the other countries listed in Section 5.1. We take reasonable steps, including contracts, to make sure overseas recipients handle it consistently with the Australian Privacy Principles.

7. Data Retention

8. Security

We use administrative and technical safeguards designed to protect personal data, including encryption in transit (TLS), encryption at rest where our providers support it, hashed passwords, row-level access controls in our database so that beekeepers can only read the reporter details they are entitled to, and audit logging. No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will notify the competent authority and, where required, you, within the time the law requires.

Bot and abuse protection. Our forms are protected by Cloudflare Turnstile, which runs invisibly and processes a limited set of technical signals from your browser (including IP address, TLS fingerprint, user agent, and the page's sitekey and origin) to tell people from automated scripts. It is not used for advertising or cross-site tracking. See the Cloudflare Turnstile Privacy Addendum. Legal basis: legitimate interests in keeping the Service secure (Art. 6(1)(f)).

9. Cookies, Analytics, Error Monitoring, and Similar Technologies

We use cookies, local and session storage, and similar technologies. Our cookie banner groups them into four categories:

• Strictly necessary: sign-in, security, remembering your cookie choice, and basic site operation. Always on.
• Functional: preferences such as language and saved form drafts.
• Analytics: usage measurement so we can see which pages help people report swarms.
• Marketing: measuring whether our campaigns work.

Tools in use.

• Google Tag Manager loads our measurement tags, including Google Analytics 4 (Google Ireland Ltd. / Google LLC). See policies.google.com/privacy and the Google Analytics opt-out add-on.
• Meta Pixel (Meta Platforms, Inc. and Meta Platforms Ireland Ltd.), loaded through Google Tag Manager only where marketing cookies are allowed. It sets Meta's _fbp and _fbc cookies and tells Meta which pages you view and which actions you take so we can measure and target our ads. See Section 5.6 and facebook.com/privacy/policy.
• PostHog (PostHog, Inc., United States) for product analytics. It receives a random identifier, page addresses, and clicks, and, for signed-in users, your account ID and account type. We don't send PostHog your name, email address, phone number, postal address, or photos, and we strip the tokens from single-use links (such as claim or sign-in links) before any address is recorded.
• Sentry (Functional Software, Inc., United States) for error monitoring. When something breaks, Sentry receives technical details of the error: what failed and where in our code, the page address, your browser and operating system, and the last few actions on the page before the error. We have configured Sentry not to store your IP address, cookies, or anything you typed into a form, and we don't send it your name, email address, phone number, or account ID. Error reports are sent on every visit, because they are how we find and fix faults; our legal basis is legitimate interests (Art. 6(1)(f)). Sentry can also keep a short replay of the page for a sample of visits and for visits where an error occurs, with all text and form inputs masked and images blocked inside your browser before anything is sent. Replay counts as analytics: where consent is required it starts only after you accept analytics, and it stops as soon as you revoke it.

Session replay in PostHog. With your analytics consent, PostHog reconstructs a replay of a sample of visits so we can see where the Service breaks or confuses people. It is not a video and can't see your screen or other tabs: it is rebuilt from the page's structure plus your clicks, scrolling, and page changes. Anything you type into a form field is masked in your browser before it is sent. Replay is switched off entirely in our admin area, on the beekeeper dashboard, and on reporters' report management pages, so reporters' names, addresses, and phone numbers never reach PostHog.

How you found us. When you arrive, we record in your browser's session storage the campaign tags in the link you followed (if any), the domain of the website that linked to you, and your first page. If you then report a swarm or create an account, we save this with it so we can tell which outreach helps people find us. It isn't used to profile you or shared with advertisers, and it is discarded when you close the tab if you don't submit anything.

How consent works. If we detect that you are in the EEA, the UK, or Switzerland, or we can't tell where you are, the banner appears on your first visit, every optional category is off until you choose, and neither PostHog nor Sentry's session replay runs. In the same cases Google tags start in Google Consent Mode v2 "denied" mode, so they don't set identifying cookies; that includes visitors whose location we can't identify. Your choice is stored in a first-party cookie (swarmed_cookie_consent) for up to 6 months. Elsewhere, optional cookies are on by default and you can switch them off in the banner. Wherever you are, if your browser sends a Global Privacy Control signal, we treat marketing as off: Meta's pixel doesn't run and we don't capture Meta's browser identifiers at checkout, whatever the banner says. Legal basis for optional cookies where required: consent (Art. 6(1)(a) GDPR and the ePrivacy rules).

Changing your choice. Use the "Cookie settings" link in the footer at any time. Revoking analytics or marketing also clears Google, Meta, Microsoft, and Hotjar tracking cookies from your browser on the next page load.

10. Text Messages, WhatsApp, and Phone Calls

10.1 Swarm alerts for beekeepers

If you choose text message or WhatsApp alerts and give us your phone number, you agree that Swarmed may send you automated swarm alerts and messages about swarms you claim at that number. You can also reply to a WhatsApp alert to claim a swarm.

• Frequency: varies with how many swarms are reported in your alert area, from none to several a day in swarm season.
• Cost: message and data rates may apply.
• To stop: reply STOP to any text or WhatsApp message, or change your alert channel in your dashboard settings. Reply HELP for help, or email [email protected].
• Not a condition: text and WhatsApp alerts are optional. Email alerts are free and always available.
• Plans that include text alerts: if you subscribe to a plan that includes text alerts and have a mobile number on your account, we switch your alerts to text message when the plan starts. You can switch back in settings at any time.
• Your number stays with us: we don't sell, rent, or share mobile numbers or text-message opt-in data collected for alerts with any third party for their marketing. Text message originator opt-in data and consent are never shared with third parties, except the providers that deliver the messages (Section 5.1).

10.2 If you report a swarm (U.S. TCPA notice)

We don't send text messages or WhatsApp messages to reporters; we contact you by email. When you submit a report from the United States, you agree, in the consent statement shown next to the submit button (which we record with your report), that the beekeeper or removal professional handling your report, and the marketplaces in Section 5.2 (Networx Systems, Inc. and its partners, and Inquirly) and the professionals they work with, may contact you at the phone number and email address you gave about your request, including by automated technology and text message, in line with the U.S. Telephone Consumer Protection Act (47 U.S.C. § 227) and state law.

• Your consent is not a condition of buying any goods or services.
• Message and data rates may apply. Message frequency varies.
• You can revoke consent at any time by any reasonable means, including replying STOP to a text, telling the caller, or emailing [email protected].

Revoking consent doesn't affect messages sent before you revoked it, and doesn't stop the service emails about your report.

11. Your Rights

Depending on where you live, you have some or all of these rights:

• Access: get a copy of the personal data we hold about you.
• Correction: fix inaccurate or incomplete data.
• Deletion: ask us to delete your data, subject to legal exceptions. One limit: once a beekeeper has claimed your report, your details have been sent to them, sometimes by email, text, or WhatsApp. We can delete them from our systems, but we can't remove a message already delivered to a beekeeper's inbox or phone.
• Restriction: ask us to limit how we use your data in some circumstances.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests, and to direct marketing at any time.
• Opt out of sale: ask us not to pass your requests to the marketplaces in Section 5.2.
• Withdraw consent: at any time, without affecting earlier processing.
• Complain: to a data protection authority (see Sections 14 and 15).

How to make a request. Email [email protected]. Account holders can delete their account in dashboard settings, and reporters can delete a report from its management page. We may need to verify your identity, usually by confirming the email address or phone number linked to your data. You can use an authorised agent where your law allows; we may ask for proof of their authority. We respond within one month under the GDPR, and within 45 days under U.S. state laws, extendable where the law allows. If we decline a request, we will tell you why, and U.S. residents can appeal by replying to our decision; we will answer an appeal within the time your state's law requires. We won't treat you differently for exercising your rights.

12. U.S. State Privacy Notice

This section is for residents of California and other U.S. states with consumer privacy laws. In the past 12 months we collected and disclosed these categories of personal information:

Sources, purposes, and retention for each category are described in Sections 2, 3, and 7.

Sensitive personal information. The exact location of a swarm, and coordinates from "Locate me", may be precise geolocation. We use it only to route your report and arrange collection, never to infer anything about you, and we don't sell or share it. We don't collect other sensitive categories.

Opting out of sale and sharing. To opt out of the advertising uses in Section 5.6, email [email protected] with the subject "Do not share my information", turn off marketing in "Cookie settings", or turn on Global Privacy Control in your browser. To opt out of sale, tick the opt-out box on the report form, or email [email protected] with the subject "Do not sell my information", and we won't pass any of your current or future reports to the marketplaces. We also treat a Global Privacy Control signal from your browser as an opt-out of sale. We don't knowingly sell the personal information of anyone under 18.

13. Automated Decisions

We use automated image checks (Google Gemini and our own model) to estimate whether a report shows honey bees, and whether it is a swarm or an established colony. That estimate decides whether beekeepers get an alert, or whether the report is marked as likely wasps and, in the United States, offered to the marketplaces in Section 5.2. You can ask for a person to review the result by replying to the email we send you, and you can always add more photos. We don't make decisions with legal or similarly significant effects about you solely by automated means.

14. EEA, UK, and Swiss Users

If you are in the EEA, the UK, or Switzerland, the GDPR, the UK GDPR, or the Swiss FADP applies, and our Dutch business (Section 1) is your controller. Because that business is established in the Netherlands, our lead supervisory authority in the EU is the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). You can also complain to the authority where you live (directory). In the UK, contact the ICO (ico.org.uk); in Switzerland, the FDPIC (edoeb.admin.ch).

15. Australian Users

We handle Australians' personal information in line with the Australian Privacy Principles. Swarmed LLC is responsible for it. You can ask to access or correct your information, or complain about how we have handled it, by emailing [email protected]. We will answer within 30 days. If you aren't satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au). Overseas disclosure is described in Section 6.

16. Children

You must be at least 18 to create an account or report a swarm. The Service is not directed to children, and we don't knowingly collect personal data from anyone under 18. Younger beekeepers are welcome to use Swarmed through a parent's or guardian's account. If you believe a child has given us personal data, contact us and we will delete it.

17. Third-Party Links

The Service links to websites and services we don't control, including the marketplaces in Section 5.2. This policy doesn't apply to them; please read their privacy notices.

18. Changes to This Policy

We may update this policy. We will change the "Last updated" date above and, for material changes, tell you in advance by email or on the Service. Changes don't reduce your rights over data collected before the change without your consent where the law requires it.

19. Contact Us

For questions, complaints, or requests, email [email protected]. Requests from the EEA, the UK, and Switzerland are handled by our Dutch business through the same address. You can also write to:

• Swarmed LLC, 30 N Gould St, Sheridan, WY 82801, USA.
• Swarmed (Netherlands, KvK 96813733), Louis Couperusplein 2 T, 2514 HP The Hague, the Netherlands.