Drippa Privacy Policy
Last updated: 8 October 2026
This policy explains how Drippa, Inc. handles personal data about people who visit our website, sign up, or use Drippa. Data inside a customer's workspace is handled differently: there, the customer decides how it is used, and we process it for them under our Data Processing Agreement.
1. Who we are
Drippa, Inc. is a Delaware corporation at 1111B S Governors Ave #95589, Dover, DE 19904, USA. For questions about this policy or your data, email privacy@drippa.ai.
2. Our two roles
- Controller: for data about website visitors, account holders, billing contacts and people we talk to about Drippa. This policy covers that data.
- Processor: for data in our customers' workspaces, such as content from connected tools, source code and recordings of their test environments. Our customer is the controller and the DPA governs it. If you have a question about that data, contact the organization that uses Drippa. We will help them answer.
3. What we collect and why
| Data | Examples | Why we use it | Legal basis (GDPR) |
|---|---|---|---|
| Account data | Name, work email, company, role, login details | To create your account, sign you in and provide the service | Contract |
| Billing data | Billing contact, company name and address, VAT or org number, payment status | To invoice and collect payment. Card details are handled by Stripe, not stored by us | Contract and legal obligation |
| Usage data | IP address, browser, pages visited, features used, error logs | To keep the service secure, fix problems and improve it | Legitimate interests |
| Communications | Emails, support requests, Slack Connect messages, call notes | To answer you, give support and follow up on sales conversations | Legitimate interests |
| Website and waitlist | Email you give us to join the waitlist, cookieless page analytics | To tell you about Drippa and understand how the site is used | Consent for marketing emails where required, otherwise legitimate interests |
We do not ask for special categories of personal data, such as health data, and we do not sell personal data.
4. How we use AI
Drippa uses AI models to create reviews, summaries and other outputs. We send these models only what a task needs. When we receive data from GitHub, we replace identity fields such as logins, avatars and emails with opaque IDs. Free text, such as pull request descriptions, tickets and Slack threads, is not scrubbed and may contain names.
Our AI providers are bound by contract not to train their models on this data. We do not train AI models on customer data either. We do not use AI to make decisions that have legal or similarly significant effects on people.
5. Who we share data with
- Service providers (sub-processors) that help us run Drippa, listed in the DPA and on our Trust Center.
- Professional advisors, such as lawyers, accountants and auditors, under confidentiality duties.
- Authorities, when the law requires it.
- A buyer or successor, if Drippa is part of a merger or sale. We will tell you before your data falls under a different privacy policy.
We do not sell personal data or share it for cross-context behavioral advertising.
6. Where data is stored and international transfers
We host the app and its database in the EU, in Stockholm, Sweden (Vercel and Supabase). Some of our providers are in the United States, including Anthropic, TypeSafe AI, Stripe and Google. When personal data leaves the EEA, UK or Switzerland, we rely on the EU Standard Contractual Clauses, the UK Addendum, and the EU-US Data Privacy Framework where a provider is certified.
7. How long we keep data
| Data | How long |
|---|---|
| Account data | While your account is active, then deleted within 90 days after it closes |
| Workspace data (processed for customers) | While the account is active, then deleted within 30 days after it ends, as set out in the DPA |
| Invoices, contracts and billing records | 7 years, for tax and legal reasons |
| Support and sales communications | Up to 3 years |
| Operational logs | Up to 30 days |
| Security audit logs | Up to 400 days. In-app audit history is kept for the life of the account |
| Waitlist and marketing emails | Until you unsubscribe, or 2 years without contact |
| Backups | Rolling cycle of up to 30 days |
8. Security
We encrypt data in transit (TLS 1.2 or higher) and at rest (AES-256), require multi-factor authentication for access to our systems, log access to production, test our security with an external penetration test every year, and follow written policies for incident response, access control and vendor risk. Drippa is in its SOC 2 Type II audit period. Details are on our Trust Center.
9. Your rights
Depending on where you live, you can ask us to:
- give you a copy of your personal data;
- correct it;
- delete it;
- restrict or object to how we use it;
- send it to you or another company in a portable format;
- stop sending you marketing emails, at any time.
Where we rely on consent, you can withdraw it at any time. Residents of California and other US states have similar rights to know, correct and delete their data, and will not be treated differently for using them.
Email privacy@drippa.ai to make a request. We reply within 30 days. If your request is about data in a customer's workspace, we will pass it to that customer and help them respond.
In the EEA you can also complain to your local data protection authority. In Norway this is Datatilsynet.
10. Cookies
Our website uses Vercel Analytics, which measures visits without cookies. The Drippa app uses only essential cookies to keep you signed in. We do not use advertising cookies.
11. Children
Drippa is for businesses and is not meant for anyone under 18.
12. Changes to this policy
If we make material changes, we will update the date at the top and tell account holders by email or in the app before the changes take effect.
13. Contact
Drippa, Inc., 1111B S Governors Ave #95589, Dover, DE 19904, USA. Email: privacy@drippa.ai.
