Privacy Policy

Who we are

Drift-CI (drift-ci.com) is operated by John Ennis, a sole trader in Ireland, who is the data controller for account and website data. You can reach us at privacy@drift-ci.com.

What we collect

• Account data from sign-in: your name, email address and profile image, plus basic profile details from GitHub or Google if you use them to sign in.
• Organization and workspace data: organization and project names, members and roles, ingest tokens (stored hashed), and regression issues with their comments and assignments.
• Billing data handled by Stripe. We never see or store full card numbers. We keep Stripe customer and subscription identifiers and your plan status.
• Run data your CI uploads: suite and case identifiers, the provider used, model outputs, scores and thresholds, case status and error messages, evaluator details, latency and token usage. You control what your evals contain. For this data you are the controller, and we process it on your behalf to provide the service.
• Technical logs: IP address, user agent and request metadata, kept for security and reliability.
• Website analytics, only if you accept cookies.

How we use it

We use your data to provide and secure the service, handle billing, respond to support requests and, with your consent, understand how the website is used. Our legal bases are:

• contract, to provide the service you signed up for;
• legitimate interests, for security and abuse prevention;
• legal obligation, for example keeping tax records;
• consent, for analytics cookies.

Service providers

We use the following providers to run Drift-CI:

• Cloudflare: hosting, CDN and email routing.
• Clerk: authentication. Clerk sends account emails through SendGrid.
• Neon: database hosting, in AWS London (eu-west-2).
• Stripe: payments.
• Google Analytics: website analytics on the marketing pages, only with your consent.

We do not sell your data and we do not use it for advertising.

International transfers

Some of our providers process data outside the European Economic Area, for example in the United States or the United Kingdom. Those transfers rely on adequacy decisions or standard contractual clauses.

How long we keep data

• Account and organization data: while your account exists, then deleted within 30 days.
• Run data: until you delete your organization (which removes its projects and runs straight away), or until you ask us to delete a project.
• Billing records: for as long as tax law requires.
• Technical logs: for a short period.

Your rights

You can ask for access to your data, correction, erasure, restriction of processing, portability, or object to processing. You can withdraw consent at any time. Email privacy@drift-ci.com and we will respond. You also have the right to complain to the Irish Data Protection Commission at dataprotection.ie.

Cookies

• Strictly necessary: Clerk's session and authentication cookies, and drift_consent, which remembers your cookie choice for 12 months.
• Analytics: Google Analytics _ga* cookies, set only after you click Accept.

You can change your choice at any time with “Cookie settings” in the footer.

Children

Drift-CI is not directed at anyone under 16.

Changes to this policy

If this policy changes we will update this page and the date above, and email account owners about material changes.