Privacy Policy

This Privacy Policy describes how Drift AI (“Drift”, “we”) collects, uses, and shares information when you use the Drift platform. We take privacy seriously and have designed Drift with data minimization, workspace isolation, and encryption in mind.

1. Information We Collect

Information you provide

• Account data: name, email, password hash, company, role.
• Workspace data: agents, scenarios, contacts, messages, conversation transcripts, knowledge base documents, and automations you create.
• Billing data: payment method details processed by our payment processor (Stripe). We never see your full card number.

Information collected automatically

• Usage data: pages visited, features used, timestamps, and referring URLs.
• Device data: IP address, browser type, operating system.
• Error data: we capture application errors via Sentry to diagnose and fix bugs; stack traces may include the page you were on but not the content of your Customer Data.

2. How We Use Information

• To provide, maintain, and improve the Service.
• To authenticate you and secure your account.
• To process payments and send billing notices.
• To send operational emails (security alerts, product updates).
• To detect, prevent, and address fraud, abuse, and security issues.
• To comply with legal obligations.

We do not sell your personal information. We do not use Customer Data to train foundation models without explicit consent.

3. Sharing & Subprocessors

We share limited data with trusted subprocessors that help us operate the Service:

• Supabase — primary database and authentication.
• Vercel — application hosting and edge network.
• Stripe — payment processing.
• Twilio — SMS and voice infrastructure (only for messages/calls you send through the Service).
• ElevenLabs / VAPI / OpenAI / Anthropic — voice synthesis and language model inference for agent responses.
• Sentry — error monitoring.

Each subprocessor is bound by a data processing agreement. A current list of subprocessors is available on request at privacy@driftai.studio.

4. Data Retention

We retain Customer Data for as long as your workspace is active. On cancellation you have 30 days to export your data before it is deleted. Backups are purged within 35 days of deletion. Some records (e.g. billing invoices) are retained longer where required by law.

5. Your Rights

Depending on where you live, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate personal data.
• Deletion — ask us to delete your personal data.
• Portability — request an export of your workspace data in a machine-readable format.
• Objection — object to certain processing activities (e.g. marketing).

To exercise any of these rights, email privacy@driftai.studio.

6. International Transfers

Drift is operated from the United States. If you access the Service from outside the US, your data may be transferred to and processed in the US. We rely on Standard Contractual Clauses with our subprocessors to cover EU/UK data transfers.

7. Children

Drift is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced via email or in-app notification at least 30 days before they take effect.

9. Contact

Questions about this Privacy Policy or your data? Email privacy@driftai.studio.