Privacy Policy

Effective date: June 23, 2026  ·  Drift Signal  ·  driftsignal.io

This Privacy Policy describes how Drift Signal ("we", "us", or "our") collects, uses, and shares information when you use the DriftSignal platform.

1. Information We Collect

We collect the following types of information:

• Account information: Name, email address, and organisation name when you sign up
• Billing information: Payment details processed by Stripe — we never store card numbers directly
• API credentials: Credentials you provide for monitoring third-party APIs, stored encrypted using AES-256
• Usage data: API response data, violation reports, and run logs generated by the monitoring service
• Contact and feedback submissions: When you subscribe to our updates list or submit a comment or question through our website, we collect your email address, any message you provide, and the IP address from which it was submitted
• Technical data: IP addresses, browser type, and access logs for security and debugging purposes

2. How We Use Your Information

• To provide, operate, and improve the DriftSignal service
• To send violation alerts and service notifications
• To process billing and manage your subscription
• To respond to support requests, comments, and questions you submit
• To detect and prevent fraud or abuse
• To comply with legal obligations

2a. Testimonials and Promotional Use

If you submit feedback through our website and explicitly opt in by checking the testimonial consent box, you grant us permission to display your feedback publicly for promotional or marketing purposes — for example, as a quotation on our website. In such cases we will identify you using only your first name and last initial (for example, "Jane D."). We will not publish your full name, email address, or any other identifying information without your separate consent. This permission applies only where you have affirmatively opted in; if you do not check the consent box, we will not use your feedback publicly. You may withdraw this consent at any time by emailing support@driftsignal.io, and we will remove the testimonial going forward.

3. Data Sharing

We do not sell your personal data. We share data only with:

• Stripe — payment processing (stripe.com/privacy)
• Clerk — authentication (clerk.com/privacy)
• Resend — transactional email (resend.com/privacy)
• Railway — cloud infrastructure (railway.app/legal/privacy)
• Sentry — error monitoring (sentry.io/privacy)

All third-party providers are bound by data processing agreements and are prohibited from using your data for their own purposes.

4. Data Retention

• Account data is retained while your account is active and for 30 days after deletion
• Violation history is retained according to your plan (7 days for free, 90 days for Team, unlimited for Pro)
• Billing records are retained for 7 years as required by law
• API credentials are deleted immediately upon watch deletion

5. Security

We implement industry-standard security measures including:

• AES-256 encryption for stored API credentials
• TLS encryption for all data in transit
• Hashed API tokens (SHA-256) — we never store tokens in plain text
• Regular security monitoring via Sentry

6. Your Rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your account and associated data
• Export your violation and run history data
• Opt out of marketing emails at any time

To exercise these rights, email support@driftsignal.io.

7. Cookies

We use essential cookies for authentication and session management. We do not use tracking or advertising cookies. Third-party services (Clerk, Stripe) may set their own cookies governed by their respective privacy policies.

8. GDPR and CCPA

If you are located in the European Economic Area, you have additional rights under the GDPR including the right to data portability and the right to lodge a complaint with your local data protection authority. California residents have additional rights under the CCPA. Contact us at support@driftsignal.io to exercise these rights.

9. Children's Privacy

The Service is not directed at children under 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

11. Contact

For privacy-related questions or requests, contact us at support@driftsignal.io.