Privacy Policy

DRYFT, INC.

For Dryft, protecting the confidentiality, integrity and availability of the personal data that we collect, process or store on our website (the “Website”) and in connection with the use of the Dryft platform (the “Platform”) is very important. This Privacy Policy explains how Dryft collects and processes personal data when you visit our Website at https://dryft.ai or use the Dryft Platform, in each case only to the extent that Dryft acts as the controller for the relevant processing. It also explains the rights available to you under applicable data-protection laws.

Personal data means information that directly or indirectly relates to an identified or identifiable individual, such as a name, an address, an email address, an online identifier or information about how a person uses our Website or Platform. If you have questions about data protection or data processing at Dryft, you can contact us using the details below.

Controller and Privacy Contact

The controller for the processing operations described in this Privacy Policy within the meaning of Article 4 no. 7 GDPR is:

Dryft, Inc. 876 Chimalus Dr, Palo Alto, CA 94306 United States

Email: contact@dryft.ai

Controller and processor roles for the Dryft Platform

Dryft determines the purposes and means of certain processing activities relating to the Dryft Platform and acts as controller for those activities, including account administration, authentication, security, Platform operation, error analysis, support, communication, contract administration and billing.

Dryft also processes customer content and other personal data submitted to or generated within the Platform on behalf of the relevant customer company. For that processing, Dryft generally acts as a processor. The details of that processing are governed by the applicable data-processing agreement, SaaS agreement and other contractual documentation. The customer company remains responsible for the lawfulness of the processing it instructs Dryft to perform and for providing any notices it is required to provide to the individuals concerned, to the extent required by applicable law. This does not limit Dryft’s own responsibilities for processing for which Dryft determines its own purposes and means.

1. Data collection when visiting our Website

When you visit our Website for information purposes, we temporarily process technical information needed to establish and maintain a secure connection and to operate the Website. This may include your IP address, date and time of access, requested address, HTTP status code, amount of data transferred, referrer, and browser and operating-system information.

The Website is created and hosted with Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam, Netherlands. The underlying infrastructure is operated by Amazon Web Services. Dryft does not operate its own web server for this purpose.

For the Dryft Platform, technical log data may include IP address, date and time, requested address, HTTP status code, amount of data transferred, referrer, and browser and operating-system information. Platform log data is stored in Azure Log Analytics and automatically deleted after 30 days. Network-flow logs, including source and destination IP address and port, are stored for 120 days for security purposes. These data support operational security, attack detection and error analysis.

The legal basis for this processing is Dryft’s legitimate interest in providing, securing and maintaining the Website and Platform and in detecting and investigating attacks, misuse and technical faults, pursuant to Article 6(1)(f) GDPR.

2. Enquiries by email

Contact enquiries reach us by email at contact@dryft.ai. We use Microsoft 365 to receive and respond to email enquiries. When you contact us by email, we process the personal data contained in your message and the associated communication metadata for the purpose of responding to your enquiry.

The legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in responding to enquiries and maintaining business communications. If the enquiry is made in connection with entering into or performing a contract, Article 6(1)(b) GDPR may also apply. If a legal obligation applies, processing may additionally be based on Article 6(1)(c) GDPR.

We delete the data when the purpose of the processing no longer applies, for example after the enquiry has been conclusively answered, unless the data must be retained for the establishment, exercise or defence of legal claims or under statutory retention obligations. If the enquiry leads to a contractual relationship, the data will be deleted or restricted when the applicable statutory retention periods expire.

3. Processing of personal data when registering and using a customer account

User accounts for the Dryft Platform are provided as part of the contract with the relevant customer company and are created by an administrator. Two login options are available: single sign-on using the customer company’s Microsoft Entra ID account, or login using an email address and password. With single sign-on, an account may be created automatically on first login, subject to the email domains and directories approved by the customer company. For account creation and administration, Dryft may process the following data:

email address; name; company affiliation
password hash, for password login only
object identifier of the Microsoft Entra ID account, for single sign-on only
role and functional responsibilities
language, time zone and country
optional signature fields for sending email, such as job title and extension; and company-specific attributes, such as a buyer identifier in an ERP system

Dryft processes this data to create and administer accounts, authenticate users, assign roles and permissions, provide the Platform, maintain security, support users, communicate about the service, perform contractual administration and comply with legal obligations.

Depending on the specific data and purpose, the legal bases are Article 6(1)(b) GDPR for steps necessary to provide the Platform or perform a contract with the customer company, Article 6(1)(f) GDPR for Dryft’s legitimate interests in secure account administration, authentication, support and service operation, and Article 6(1)(c) GDPR where processing is necessary to comply with a legal obligation.

When the contractual relationship with the customer company ends, Dryft blocks personal data from further operational use and deletes or destroys it after the expiry of applicable statutory retention periods, unless a longer period is required for legal claims or another lawful purpose.

4. Cookies and similar technologies

The Website and Platform may use technically necessary cookies or comparable technologies required for security, authentication, session management and core functionality. You can generally control cookies through your browser settings. Disabling technically necessary technologies may impair the functionality of the Website or Platform.

We do not use marketing pixels, retargeting or cross-context behavioral advertising.

PostHog

Within the registered Dryft Platform, Dryft uses PostHog for product analytics and related product feedback or satisfaction-survey functions, to the extent those functions are enabled. The integration operates through a reverse proxy under Dryft’s own domain. The browser therefore communicates with Dryft’s server rather than directly with PostHog. Based on the configured integration, PostHog does not receive the user’s IP address through forwarding headers and receives the outgoing address of Dryft’s server instead.

The data processed may include a user identifier, email address, name, company affiliation, events relating to use of the Platform, error events, voluntarily submitted feedback and satisfaction-survey data. Dryft uses this data to understand Platform use, identify technical or usability issues, improve the Platform and respond to feedback.

Sentry

Dryft uses Sentry (Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA) for error monitoring and troubleshooting. The data processed may include error messages, technical context data and a user identifier. The frontend may additionally transmit the user’s email address. Sentry may record sessions associated with errors. Text and user inputs are configured to be masked by default. The relevant Sentry environment is configured in the Germany data region.

Dryft uses this data to detect, investigate and resolve errors, improve Platform stability and provide support.

The legal basis for PostHog and Sentry processing is Dryft’s legitimate interest in operating, securing, troubleshooting and improving the Platform pursuant to Article 6(1)(f) GDPR.

5. Duration of storage of personal data

Unless a shorter period is specified in this Privacy Policy, Dryft stores personal data only for as long as necessary for the purposes described in this Privacy Policy, for the provision of the service, or for the contractual relationship. After the purpose no longer applies, Dryft deletes or restricts the data unless statutory retention obligations, the establishment, exercise or defence of legal claims, or another lawful purpose requires continued retention.

6. Recipients

To provide and secure the Website and Platform, Dryft uses selected service providers that process personal data on Dryft’s behalf or provide infrastructure and communications services. These may include:

Framer B.V. and its infrastructure providers for Website hosting;
Microsoft 365 for email communications;
Microsoft Azure, including Azure Log Analytics, for Platform hosting and logging;
PostHog for Platform analytics and feedback functions; and
Sentry for error monitoring and troubleshooting.

Dryft may also disclose personal data to professional advisers, courts, public authorities, law-enforcement bodies and other recipients where required or permitted by law, or where necessary to establish, exercise or defend legal claims. These recipients may receive personal data for legal advice, litigation and claims management, legal compliance, or in response to lawful requests by public authorities, including to meet national security or law-enforcement requirements. The recipients identified above are third-party service providers and infrastructure providers, and their purposes are website hosting; email communications; Platform hosting and logging; Platform analytics and feedback; and error monitoring and troubleshooting.

7. International transfers

Dryft is based in the United States. Personal data may therefore be accessed from or transferred to the United States in connection with Dryft’s own operations, support, security, administration and use of service providers. Dryft uses infrastructure and services located in the European Union or European Economic Area where applicable. When required under the GDPR, Dryft ensures that the conditions for a transfer to a third country under Art. 44 et seq. of the GDPR are met, e.g., by entering into standard contractual clauses.

8. Security

Dryft implements technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure and unauthorized access. These measures may include access controls, authentication, logging, monitoring, secure hosting, data minimization, masking and procedures for handling security incidents. The measures are reviewed and adapted as appropriate to the risks and the state of the art.

9. Your rights as a data subject

Right of access to the personal data we process, the purposes of processing, categories of recipients, the duration of storage or the criteria for determining the storage period, the origin of the data, your rights as a data subject, the existence of automated decision-making including profiling, and the appropriate safeguards for the transfer of data to a third country, as well as the right to receive a copy of your personal data;
Right to rectification of inaccurate or incomplete personal data;
Right to erasure of personal data if the purpose of the processing no longer applies, consent is withdrawn or there is no other legal basis, or the data was processed unlawfully, or you have objected to the processing;
Right to restriction of processing;
Right to data portability if the data processing is based on consent, or on a contract;
Right to object to the processing if the processing is based on legitimate interests.
If you have consented to the processing of personal data, you can withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent up to the withdrawal.

To exercise your rights, contact contact@dryft.ai. We may request additional information where reasonably necessary to verify your identity. Requests are handled in accordance with applicable law. If the relevant data is customer content processed by Dryft as processor, Dryft may refer the request to the relevant customer company or coordinate with that customer as required by the applicable agreement and law.

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. Complaints submitted to Dryft under this Privacy Policy, including complaints under the EU-U.S. DPF, may be submitted to Dryft free of charge.

10. EU-U.S. Data Privacy Framework

Dryft, Inc. complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) as set forth by the U.S. Department of Commerce. Dryft has certified to the U.S. Department of Commerce that it adheres to the Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union. If there is any conflict between the terms in this Privacy Policy and the EU-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program and to view our certification, please visit the official DPF program website: https://www.dataprivacyframework.gov/

Individuals may submit complaints to Dryft concerning Dryft’s handling of personal data received in reliance on the EU-U.S. DPF by contacting contact@dryft.ai. Dryft will provide appropriate recourse free of charge to the affected individual. Individuals may also contact the data protection authority in the EU Member State of their habitual residence, place of work or the place of the alleged infringement. In compliance with the EU-U.S. DPF, Dryft commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF.

Individuals have the right to access personal data received by Dryft from the European Union in reliance on the EU-U.S. DPF. Individuals may request access to, correction, amendment or deletion of inaccurate or incomplete personal data by contacting contact@dryft.ai.

Individuals also have the right to choose whether their personal data is disclosed to a non-agent third party or used for a purpose materially different from the purpose for which it was originally collected or subsequently authorized by the individual. To exercise this choice, contact contact@dryft.ai. To the extent required by the EU-U.S. DPF Principles, Dryft will obtain affirmative express consent before using sensitive personal data for a materially different purpose or disclosing it to a non-agent third party. If Dryft processes the data on behalf of a customer company, Dryft may coordinate the request with that customer as required by the applicable agreement and law.

Dryft is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC) with respect to its compliance with the EU-U.S. DPF Principles.

Under certain conditions, individuals may invoke binding arbitration to address unresolved claims concerning personal data received by Dryft in reliance on the EU-U.S. DPF. Dryft is obligated to arbitrate claims and follow the terms as set forth in Annex I of the EU-U.S. DPF Principles, provided that an individual has invoked binding arbitration by delivering notice to Dryft and following the procedures, and subject to the conditions, set forth in Annex I of the Principles.

Dryft may be required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law-enforcement requirements.

Dryft remains responsible under the EU-U.S. DPF Principles for personal information it receives and subsequently transfers to a third party acting as an agent on its behalf. Dryft remains liable under the EU-U.S. DPF Principles if its agent processes such personal information in a manner inconsistent with the Principles, unless Dryft proves that it is not responsible for the event giving rise to the damage.

11. Provision of personal data

The provision of personal data may be necessary to respond to an enquiry, create or administer a Platform account, authenticate a user, provide requested services, maintain security or comply with legal obligations. If required data is not provided, Dryft may be unable to respond to an enquiry, create an account, provide particular Platform functions or comply with applicable obligations.

12. Children

The Website and Platform are intended for business users and are not directed to children. Dryft does not knowingly collect personal data from children through the Website or Platform.

Country or region-specific information

California privacy rights

The California Consumer Privacy Act of 2018 (“CCPA”), as amended by the California Privacy Rights Act of 2020, provides you with specific rights regarding your personal information. This section describes the rights that California consumers have and explains how to exercise those rights. These rights are granted only to the extent that the CCPA is applicable to Dryft, you are a California consumer and we are acting as a “business” under the CCPA with respect to your personal information.

Dryft does not sell personal information for monetary consideration and does not share personal information for cross-context behavioral advertising. Dryft does not currently engage in targeted advertising or profiling that produces legal or similarly significant effects.

We collect Personal Data from different sources; for example, we collect Personal Data directly from you, automatically from your device or browser, and from vendors, service providers, and other third parties. The categories of such information are as follows:

Categories of personal information

Identifiers

Examples: This includes a person’s name, email address, mobile number, online identifier, IP address, or comparable identifiers.
Purposes: To provide and enhance our services.
Disclosed to: Vendors, service providers and other third parties
Sold to: Not “sold”, as defined under the CCPA
Shared with: Not “shared”, as defined under the CCPA

Commercial information

Examples: This includes records of services that have been purchased.
Purposes: To provide you with our services
Disclosed to: Vendors and service providers
Sold to: Not “sold”, as defined under the CCPA
Shared with: Not “shared”, as defined under the CCPA

Professional or employment-related information, including education information

Examples: This includes an employer, employment history, resumes or CVs, education and education history, background checks, and other employment-related information.
Purposes: To manage employees and applicants.
Disclosed to: Vendors and service providers
Sold to: Not “sold”, as defined under the CCPA
Shared with: Not “shared”, as defined under the CCPA

Sensitive personal information

Examples: This includes account login information together with the required password.
Purposes: To provide you with our services.
Disclosed to: Vendors and service providers
Sold to: Not “sold”, as defined under the CCPA
Shared with: Not “shared”, as defined under the CCPA

California consumer rights and requests

right to know and access personal information and information about its collection, use and disclosure;
right to delete personal information, subject to statutory exceptions;
right to correct inaccurate personal information;
right to opt out of the sale or sharing of personal information, if Dryft engages in either activity;
right to limit the use and disclosure of sensitive personal information, where applicable; and
right not to receive discriminatory treatment for exercising applicable rights.

To submit a California privacy request, contact contact@dryft.ai. Dryft may verify the request using information reasonably necessary to confirm the requester’s identity and protect against fraud. An authorized agent may submit a request where permitted by law and may be required to provide evidence of authorization. Dryft will respond within the periods required by applicable law and will provide appeal instructions where required.

Other U.S. state privacy laws

Residents of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia and any other U.S. States with comprehensive consumer privacy laws that apply to Dryft (the “State Laws”) have certain rights with respect to their personal information. The rights available to residents of these States are explained below, and are different based upon the State Laws that are applicable to us and to you.

As of the date of this Privacy Policy, we do not sell your personal information in exchange for monetary consideration and we do not engage in profiling decisions based on your personal information that produce legal or similarly significant effects concerning you.

Categories of personal information

Identifiers

Examples: This includes a person’s name, email address, mobile number, online identifier, IP address, or comparable identifiers.
Purposes: To provide and enhance our services.
Disclosed to: Vendors, service providers and other third parties
Sold to: Not “sold”, as defined under State Laws

Commercial information

Examples: This includes records of services that have been purchased.
Purposes: To provide you with our services
Disclosed to: Vendors and service providers
Sold to: Not “sold”, as defined under State Laws.

Rights to Your Information

The State Laws may provide you with the following rights, subject to applicable exceptions:

You may have the right to know whether we process your personal information and to access this personal information. You may also have the right to request that we disclose certain information to you about our collection, use, or disclosure of your personal information. Delaware, Minnesota, Maryland, and/or Oregon residents may have the right to obtain a list of the third parties and/or the categories of third parties to which we have disclosed personal information.
You may have the right to get a copy of your personal information that you previously provided to us or that we have obtained in a portable and, to the extent technically possible, readily usable format.
You may have the right to delete personal information that you have provided to us or that we have obtained about you.
You may have the right to opt out of the processing of the personal information for purposes of: (i) targeted advertising; (ii) the sale of personal information; or (iii) profiling that produces legal or similarly significant effects concerning you.
You may have the right to correct inaccuracies in your personal information we maintain, taking into account the nature of the personal information and the purposes for which we process it.
You have the right not to be discriminated against by us for exercising your privacy rights.

To exercise any of your State Law privacy rights, or if you have any questions about your privacy rights, you can contact us by email to contact@dryft.ai.

After you send us certain requests, we may take steps to verify your identity so that we can properly respond and/or confirm that your request is legitimate and not fraudulent. We may contact you for additional information as reasonably necessary to authenticate your request. Only you, or an agent authorized to act on your behalf, may make a request related to your personal information. If you are making a request as the authorized agent of a consumer whose personal information is protected under certain State Laws, we may ask you to submit reliable proof that you have been authorized in writing by the consumer to act on such consumer’s behalf, such as a signed document.

If we decide not to act on a request that you have submitted, we will inform you of our reasons for doing so, and, for residents of states where State Laws provide for an appeal process, we will provide instructions for how to appeal the decision. Residents of those states will have the right to appeal within a reasonable time after they have received our decision. We will notify you of any action taken or not taken in response to that appeal, including a written explanation of the reasons for the decisions. If we deny your appeal, we will provide you with a method for contacting your state’s regulatory authority to submit a complaint.