Privacy Policy

Version: 1.1 · Effective: 2026-07-17

This Privacy Policy describes how Driftstack Processes Personal Data in connection with the Service. Capitalised terms are defined in the Terms of Service.

This Privacy Policy describes Driftstack’s processing as a Controller (account, billing, support correspondence, marketing site analytics where applicable). Driftstack’s processing as a Processor on Customer’s behalf (Customer Data, Session content, Customer-Provided Secrets) is governed by the Data Processing Agreement (DPA), which is incorporated into Customer’s contract by reference.

1. Controller identity

The Controller of Personal Data described in this Privacy Policy is Driftstack B.V., a private limited company organised under the laws of the Netherlands, established in Amsterdam.

For all matters relating to the Processing of Personal Data, including the exercise of Data Subject rights, contact:

• Privacy: [email protected]
• Legal: [email protected]
• Postal correspondence: addressed to Driftstack B.V., the registered office of which is published on the Driftstack website.

Driftstack does not currently have a Data Protection Officer subject to mandatory appointment under Article 37(1)(b) GDPR; the Privacy Contact above is the primary point of contact for Data Subjects, supervisory authorities, and counterparties. Driftstack will appoint a DPO promptly if Driftstack’s Processing activities cross any threshold that triggers a mandatory appointment under applicable law.

2. Scope of this Privacy Policy

This Privacy Policy applies to:

1. Personal Data of Customer’s Authorized Users that Driftstack Processes to provision, bill for, and support the Service.
2. Personal Data of individual contacts (e.g. founders of B2B prospects) that Driftstack collects in pre-sales correspondence.
3. Personal Data collected through any public-facing Driftstack property (the marketing site at driftstack.dev, the API status page, the GitHub repository — to the extent any of these collect Personal Data).

This Privacy Policy does not apply to:

1. Personal Data Customer routes through the Service in the course of its own automated browsing — that data is governed by the DPA, where Customer is the Controller and Driftstack is the Processor.
2. Personal Data Processed by Sub-processors under their own privacy policies (linked in Section 7).
3. Personal Data Processed by Customer-Connected Services (proxies, captcha, email, SMS) under those services’ own policies.

3. Data we collect (and why)

Driftstack collects the following categories of Personal Data, each for the purposes and on the legal bases set out below.

3.1 Account data

What: legal entity name, billing address, VAT/BTW identification number, primary contact name, primary contact email, billing email, optional support contacts, time zone, optional profile avatar (Customer-uploaded image, stored in the Cloudflare R2 sub-processor; see §7 / DPA Annex 3), optional Customer-stated infrastructure region preference (one of “us” / “eu” / “apac”; informational and non-binding because it does not change current data residency — see §6 / §7 for the authoritative routing).

Why: to administer the contractual relationship, generate VAT-compliant invoices, send service notifications, provide support, and render the dashboard / GUI Client identity row.

Legal basis (GDPR Art 6): Article 6(1)(b) — performance of the contract with Customer (where the contact is Customer’s principal or authorised representative). Article 6(1)(f) — Driftstack’s legitimate interest in administering the relationship and complying with its obligations (where the contact is a Customer employee whose contact details are necessary for service operation).

Source: Customer provides directly at signup or via Account configuration through the API or GUI.

3.2 Authentication data

What: API Keys (stored as scrypt-hashed values; the plaintext key is shown to Customer once at issuance and is not recoverable thereafter), session tokens for the GUI Client, key prefixes and last-used-at timestamps. Optional second-factor authentication state when Customer enrolls: a TOTP secret encrypted at rest with AES-256-GCM (only the encrypted ciphertext is stored; the plaintext exists only in memory during signature verification), 10 single-use recovery codes stored as scrypt-hashed values (raw codes shown once at enrollment), and a per-session “MFA-satisfied-at” timestamp used to gate sensitive operations.

Why: to authenticate API requests, scope operations, detect or remediate compromise, and enforce step-up reauthentication on sensitive operations.

Legal basis: Article 6(1)(b) — performance of the contract. Article 6(1)(c) — compliance with legal obligation under Article 32 GDPR (security of processing).

Source: Driftstack generates API Keys + MFA secrets at Customer’s request; Customer stores and manages them.

3.3 Session metadata

What: session id, account id, target URL, archetype identifier, timestamps, duration, success/failure, aggregate operation counts.

Why: to operate the Service (route Sessions to Mac mini fleet nodes, enforce rate limits, generate usage reports), to detect abuse, and to maintain Service capacity planning.

Legal basis: Article 6(1)(b) — performance of the contract. Article 6(1)(f) — legitimate interest in detecting abuse and protecting the Service.

Source: generated by the Service in the course of executing Customer’s instructions.

3.4 Desktop-local recordings and API Capture artifacts

Desktop-local recordings. When Customer enables recording in the GUI Client, the desktop app captures streamed frames and writes the completed recording as local NDJSON files in the app data directory on Customer’s device. Those frames can include Personal Data that Customer’s automated browsing encounters. Customer controls whether to record, export, retain, or delete those device-local files.

The recording workflow does not upload recording files or frames to Driftstack’s API, control plane, or Cloudflare R2. Driftstack has no API recording endpoint and applies no cloud recording-retention window.

API Capture artifacts. An authenticated Customer may request a screenshot, DOM snapshot, or PDF through POST /v1/sessions/:id/capture. Driftstack returns the resulting bytes inline in that response; the Capture endpoint does not retain the artifact. Customer decides whether and where to store it.

Processor role and retention boundary. Driftstack transiently Processes live-session media and API Capture requests as Processor on Customer’s behalf under the DPA, not as Controller. Desktop-local recording files remain on Customer’s device and are not collected or retained by Driftstack. Live-session media is ephemeral: it streams through LiveKit and is dropped on session end. Live-session media is encrypted in transit on each WebRTC connection using DTLS-SRTP. LiveKit receives, processes, and forwards the media as a Sub-processor; Driftstack does not currently provide application-level end-to-end encryption through the SFU. Customer determines the lawful basis for the underlying browsing and any copies Customer stores.

3.5 Customer-Provided Secrets

What: authentication credentials Customer supplies for use in Sessions, including (without limitation) HTTP/SOCKS5 proxy credentials, captcha-service API keys, IMAP / Gmail OAuth tokens, and SMS-service API keys.

Why: to forward to the appropriate Customer-Connected Service on Customer’s instruction during Session execution.

Legal basis: Driftstack Processes Customer-Provided Secrets as Processor on Customer’s behalf under the DPA, not as Controller. Customer holds the underlying relationship with the third-party provider; Driftstack is a transient holder of the credential for the duration of the Session and for the storage retention specified in Section 9.

Storage: encrypted at rest. Used only on Customer’s instruction. Not used for any purpose beyond executing Customer’s Session.

3.6 Billing data

What: transaction identifiers, payment method type (card, SEPA, iDEAL, Bancontact, cryptocurrency), last-four of payment instruments where retained, invoice status, amount, currency, VAT basis. Driftstack does not retain primary account numbers (PANs); these are tokenised by Stripe under PCI-DSS scope.

Cryptocurrency payments (optional, opt-in only). When Customer chooses a crypto asset and network displayed at checkout, Driftstack stores the internal order id, selected tier, fiat price, NowPayments payment id, quoted crypto amount and currency, payment status, and amount/status fields received in signed provider notifications. Driftstack does not persist a Customer wallet address or blockchain transaction hash in the crypto-order record. Public blockchains and NowPayments independently process on-chain sender and transaction data under their respective terms.

Why: to process Subscription Fees, generate invoices, and maintain accounting records.

Legal basis: Article 6(1)(b) — performance of the contract. Article 6(1)(c) — compliance with Dutch tax law (Article 52 of the Dutch Algemene wet inzake rijksbelastingen; 7-year retention).

Source: Stripe returns transaction metadata to Driftstack via webhook. NowPayments returns payment id, quote, amount, currency, and status data via signed webhook when the crypto-payment path is used. Customer provides billing details at signup or via the customer portal.

Renewal-reminder emails. Approximately seven (7) days before each recurring subscription invoice is generated, Stripe fires an invoice.upcoming webhook to Driftstack. We use this signal to send the billing email address one (1) billing-renewal-reminder email per upcoming invoice, summarising the upcoming amount, currency, and renewal date, and linking to the customer billing portal. Customers may opt out of this email at any time via the dashboard’s email preferences page (the underlying contractual notification — actual charge confirmation — is sent by Stripe and is not opt-outable). The complete catalog of emails Driftstack sends — opt-outable vs transactional — is on the public Emails reference page.

3.7 Support correspondence

What: email content, support ticket content, attachments, and metadata associated with Customer’s contact with Driftstack support.

Why: to provide support, document service issues, and improve the Service.

Legal basis: Article 6(1)(b) — performance of the contract (when support is contractually owed). Article 6(1)(f) — legitimate interest in service improvement (when correspondence reveals patterns of issue beyond the immediate Customer).

Source: Customer’s outbound correspondence to Driftstack support addresses.

3.8 Marketing-site data

What: access logs (IP address, user agent, referrer, request timestamp) for visitors to driftstack.dev (the marketing site). Driftstack does not currently set first-party analytics cookies on the marketing site.

Why: infrastructure operation and abuse detection.

Legal basis: Article 6(1)(f) — legitimate interest in operating the site. Driftstack does not deploy non-essential analytics without first collecting the required consent and updating this Section.

Cookies: Driftstack uses strictly-necessary cookies on the marketing site (session-id for signup flow, CSRF token). Strictly- necessary cookies do not require consent under Article 5(3) of Directive 2002/58/EC (the ePrivacy Directive). Non-essential analytics or marketing cookies remain disabled unless the required consent mechanism and disclosure are active.

3.9 Status-page data

What: access logs (IP address, user agent, referrer, request timestamp) for visitors to status.driftstack.dev (the public Service status page). Driftstack does not set analytics cookies on the status page.

Why: infrastructure operation and abuse detection, and to let Customers and prospects verify Service availability.

Legal basis: Article 6(1)(f) — legitimate interest in operating the status page.

Status-page content: the status page surfaces Service-level health metadata only (incident title, severity, affected components, chronological updates, and resolution time). It does not expose Customer Data, Capture or live-session content, Session payloads, account identifiers, or PII. Driftstack operators or automated health probes generate the data shown.

Probe history: Driftstack records each automated health probe against its own public endpoints (timestamp, success flag, latency, HTTP status, and error message). This internal operational data does not reference a Customer or visitor and is retained for 30 days for diagnostic purposes.

Cookies: none. The status page is served from Cloudflare Pages and reads incident data from https://api.driftstack.dev/v1/status/incidents.

3.10 Status-page email subscriptions

What: the email address submitted through the status-page “Subscribe to incident updates” form, opaque opt-in and unsubscribe tokens generated by Driftstack, and opt-in / unsubscribe timestamps.

Why: to notify Customers and prospects when a public Driftstack Service incident is posted or resolved.

Legal basis (GDPR Art 6): Article 6(1)(a) — explicit, freely-given consent through the double-opt-in flow. The address joins the notification list only after the subscriber opens the confirmation link. Every notification includes one-click unsubscribe.

Source: Customer or prospect voluntarily submits the address at status.driftstack.dev.

Retention: subscription data is retained while subscribed. Unsubscribe creates a tombstone so the address cannot be re-added without a fresh double opt-in; the address is purged from that row 90 days after unsubscribe.

Recipients: Driftstack’s EU-hosted Postgres stores the record; Postmark dispatches notification emails as the Sub-processor listed in Section 7.

Cookies: none.

3.11 Live-session media (optional, opt-in only)

What: real-time WebRTC media streams (rendered browser screen and optional audio) generated only when Customer or authorised Driftstack support explicitly starts a temporary live session. The pipeline can carry rendered frames, screen-coordinate metadata, optional audio (off by default), a LiveKit room id, and connection metadata such as timestamps, ICE candidates, peer ids, and the region selected by LiveKit Cloud.

Why: to enable real-time observation of an in-progress browser session for Customer debugging or authorised support.

Legal basis (GDPR Art 6): Article 6(1)(b) — performance of the contract for Customer-initiated use. A support viewer joins only after Customer authorisation.

Source: Customer starts the live session through the GUI Client or dashboard. Support cannot silently start one.

Retention: live-session media is not stored. Frames pass through LiveKit’s SFU in real time and are dropped on session end. No durable copy lands in Driftstack’s control plane. Driftstack has no cloud recording endpoint or recording-retention window. Customer may instead create a desktop-local recording on Customer’s device or request an inline API Capture artifact that the Capture endpoint does not retain.

Recipients: LiveKit, listed in Section 7, for the SFU; Driftstack support only while an authorised support live session is active.

Cookies: none.

Cryptography: media is encrypted in transit on each WebRTC connection using DTLS-SRTP. LiveKit receives, processes, and forwards the media as a Sub-processor. Driftstack does not currently provide application-level end-to-end encryption through the SFU.

4. Special Category Data

Driftstack does not intentionally collect Special Category Data (Article 9 GDPR — racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data uniquely identifying a person, data concerning health, or data concerning sex life or sexual orientation).

If Customer’s automated browsing causes Special Category Data to pass through live-session media or an API Capture request, that data is Processed by Driftstack only as Processor on Customer’s behalf under the DPA. A desktop-local recording may contain the same data, but that file remains on Customer’s device and is not uploaded or retained by Driftstack. Customer is responsible for ensuring it has a lawful basis under Article 9(2) GDPR for processing such data.

5. Data we do not collect

Driftstack does not:

1. Sell Personal Data to third parties.
2. Use Customer’s Personal Data for behavioural advertising or profiling beyond what is necessary to operate the Service.
3. Combine Customer-Connected Service data with Driftstack-internal profiles or cross-Customer aggregates.
4. Use Customer Data (including Session content, Workflows, live-session media, or Capture content) to train machine-learning models, including the bundled-LLM AI agent feature, without Customer’s separate explicit consent.

6. International transfers

Driftstack is established in the Netherlands. Several Sub-processors are established outside the EEA, in particular in the United States. Where Personal Data is transferred outside the EEA to a country without an adequacy decision under Article 45 GDPR, Driftstack relies on:

1. The EU-US Data Privacy Framework (DPF) for Sub-processors that are self-certified under the DPF and where the data category is within the scope of the recipient’s certification. Counsel review confirms current self-certification status per Sub-processor at the EU-US DPF participants list (https://www.dataprivacyframework.gov/list).
2. The 2021 Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), in the appropriate Module per the Sub-processor’s role, for Sub-processors not (or not currently) DPF-self-certified, or for transfer paths the DPF does not cover.
3. Article 49 GDPR derogations only in genuinely exceptional cases (e.g. one-time transfers in support of a legal claim). Driftstack does not rely on Article 49 derogations as a routine transfer mechanism.

The current applicable mechanism per Sub-processor is documented in the Sub-processor list (Section 7).

7. Sub-processors

Driftstack engages the following Sub-processors to provide the Service. Each Sub-processor is bound by a written agreement imposing obligations consistent with Article 28 GDPR.

The Sub-processor list is subject to change under the notice and objection mechanism in Section 3.4 of the DPA. The current list is published at /trust/sub-processors.

8. Customer-Connected Services (NOT Sub-processors)

The following third-party services are integrated with the Service under Customer’s account, Customer’s credentials, and Customer’s contractual relationship. They are not Sub-processors of Driftstack:

1. HTTP / SOCKS5 proxy providers (e.g. Bright Data, Smartproxy, Customer’s own infrastructure).
2. Captcha-solving services (e.g. 2Captcha, CapSolver, AntiCaptcha).
3. Email services Customer accesses by IMAP, Gmail OAuth, or equivalent.
4. SMS-verification services (e.g. TextVerified, Twilio).

Driftstack does not contract with these providers, does not receive service from them, and does not Process Personal Data on Driftstack’s behalf through them. The third-party Processes data on Customer’s instruction via Customer’s credentials. Each Customer-Connected Service operates under its own privacy policy between Customer and that provider; Driftstack has no visibility into that relationship beyond the credential Customer supplies and the response observed during the Session.

9. Retention

When the retention period for a category expires, Driftstack deletes the Personal Data or anonymises it (rendering it no longer attributable to a Data Subject). Anonymised aggregates may be retained for capacity planning.

10. Data subject rights

Where Driftstack acts as Controller for Personal Data of a Data Subject, the Data Subject has the rights set out in Articles 15–22 GDPR:

• Right of access (Article 15) — confirmation of whether Driftstack Processes the Data Subject’s Personal Data, and a copy of that data.
• Right to rectification (Article 16) — correction of inaccurate or incomplete Personal Data.
• Right to erasure (“right to be forgotten” — Article 17) — deletion in the circumstances set out in Article 17(1), subject to the exceptions in Article 17(3) (notably: legal obligation, the establishment, exercise, or defence of legal claims).
• Right to restriction of processing (Article 18) — Processing on hold pending verification or pending the establishment of a legal claim.
• Right to data portability (Article 20) — Personal Data the Data Subject has provided, in a structured, commonly used, machine-readable format. Driftstack provides a self-service audit export at /v1/account/audit-log/export?format=csv|json (Customer Dashboard → Audit log → Export), capped at 10,000 rows per export; older entries remain available through the paginated read API.
• Right to object (Article 21) — to processing based on Article 6(1)(f) (legitimate interest), where the Data Subject’s interests prevail.
• Rights related to automated individual decision-making, including profiling (Article 22) — Driftstack does not engage in automated decision-making producing legal or similarly significant effects on Data Subjects.

To exercise any of these rights, contact [email protected]. Driftstack responds within one (1) month of receipt of the request, extendable by two (2) further months for complex or numerous requests with notice to the Data Subject (Article 12(3) GDPR).

Where Driftstack acts as Processor on Customer’s behalf (e.g. for Session content, live-session media, or API Capture requests), Data Subject requests should be directed to the Customer (Controller). Driftstack assists Customer in responding, per DPA Section 3.6.

Right to lodge a complaint with a supervisory authority (Article 77 GDPR): Data Subjects may lodge a complaint with the Autoriteit Persoonsgegevens (Dutch DPA), Postbus 93374, 2509 AJ Den Haag, the Netherlands; or with the supervisory authority of the Data Subject’s habitual residence.

11. Data Protection Officer / Privacy Contact

Driftstack has assessed its DPO obligations under Article 37(1)(b) GDPR and concluded that, at current scale, the threshold for mandatory DPO appointment is not met. Driftstack has documented a threshold-based policy: a DPO will be appointed when:

1. Total monthly active sessions across the Service exceed 1 million; or
2. Any single Customer’s monthly Sessions involve regular and systematic monitoring of more than 5,000 unique Data Subjects; or
3. The Autoriteit Persoonsgegevens issues guidance applying the Article 37(1)(b) threshold to similar services.

Until then, Driftstack designates a Privacy Contact responsible for fielding privacy queries and coordinating Driftstack’s response to Data Subject requests:

• Privacy Contact: [email protected]
• Postal correspondence: addressed to Driftstack B.V., the registered office of which is published on the Driftstack website, attention: Privacy Contact.

The Privacy Contact monitors threshold conditions and triggers DPO appointment when applicable. The threshold policy is reassessed on each annual review of this Privacy Policy.

12. Security

Driftstack implements technical and organisational measures appropriate to the risk under Article 32 GDPR. The measures are documented in detail in the DPA Annex 2. Summarised:

1. Encryption in transit: TLS 1.2+ for all API and Service traffic.
2. Encryption at rest: disk-level encryption on the Postgres primary; application-level encryption for Customer-Provided Secrets.
3. Access control: role-based access to production systems; principle of least privilege; production access logged.
4. API authentication: scrypt-hashed API Keys; revocable; scoped.
5. Audit logging: structured Pino-formatted JSON logs with request id correlation; admin actions audit-logged separately.
6. Backup: Postgres point-in-time recovery; default 30-day retention.
7. Vulnerability management: dependency security scanning; coordinated disclosure mechanism.
8. Incident response: documented runbook; on-call rotation capability scaled to Subscription tier.

13. Breach notification

Where Driftstack identifies a Personal Data breach within the meaning of Article 4(12) GDPR:

1. Notification to the supervisory authority. Driftstack notifies the Autoriteit Persoonsgegevens (or the lead supervisory authority if different) within 72 hours of becoming aware of the breach, where the breach is likely to result in a risk to the rights and freedoms of natural persons. Where notification is not made within 72 hours, the notification is accompanied by reasons for the delay (Article 33(1) GDPR).
2. Notification to Customer (where Driftstack is Processor). Driftstack notifies Customer without undue delay (target: within 48 hours of becoming aware), per the DPA Section 6.1.
3. Notification to Data Subjects (where Driftstack is Controller and Article 34 applies). Driftstack communicates the breach to affected Data Subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms, subject to the exceptions in Article 34(3).

14. Children

The Service is not directed to and is not intended for use by children. Driftstack does not knowingly collect Personal Data of children under 16 (or the equivalent threshold of the Data Subject’s jurisdiction). If Driftstack learns it has collected Personal Data of a child, Driftstack deletes the data without undue delay.

15. Updates to this Privacy Policy

Driftstack may update this Privacy Policy from time to time. Material updates take effect no earlier than 30 days after notification (in-product banner or email to Customer’s billing contact). Customer’s continued use of the Service after the effective date constitutes acceptance. Non-material updates (typo, formatting, clarification) take effect immediately on publication.

The current version is recorded in the document header and tracked in the legal-acceptance machinery.

16. Contact

For all matters relating to this Privacy Policy:

• Privacy: [email protected]
• Legal: [email protected]
• Postal correspondence: addressed to Driftstack B.V., Amsterdam, the Netherlands.

End of Privacy Policy.