This Data Processing Addendum ("DPA") forms part of the Terms of Service between Drumbly, Inc. ("Drumbly", the processor) and the customer that uses Drumbly (the "Customer", the controller). It applies when Drumbly processes personal data on the Customer's behalf and the EU GDPR, UK GDPR, Swiss data protection law, or US state privacy laws such as the CCPA apply. If you need a countersigned copy, email privacy@drumbly.com.
1. Scope and roles
The Customer is the controller of personal data in its workspace content, and Drumbly processes it as a processor (or "service provider") only to provide Drumbly. For account, billing and security data about the Customer's own users, Drumbly acts as a controller under its Privacy Policy.
2. Details of processing
- Subject matter and duration: providing Drumbly for as long as the Customer's subscription lasts, plus the deletion period below.
- Nature and purpose: crawling and analysing the Customer's website, generating strategy and content, publishing approved content, measuring results and sending reports.
- Personal data: names, email addresses and roles of workspace members; personal data that appears in the Customer's website content, drafts, chat messages or connected-account data (for example, names in testimonials or aggregate analytics tied to accounts).
- Data subjects: the Customer's workspace members, and people whose data appears in the Customer's content.
- Special categories: none intended. The Customer should not submit them.
3. Drumbly's obligations
Drumbly will:
- process personal data only on the Customer's documented instructions, which are these terms and the Customer's use of Drumbly's features, unless the law requires otherwise (in which case Drumbly will inform the Customer unless the law forbids it);
- not sell or share the personal data, or use it for any purpose other than providing Drumbly, including training AI models;
- ensure that people authorised to process it are bound by confidentiality;
- implement the security measures in section 5;
- help the Customer answer data subject requests and meet its obligations on security, breach notification, impact assessments and consultation with authorities, taking into account the nature of processing;
- notify the Customer without undue delay, and in any case within 72 hours of becoming aware, of a personal data breach affecting the Customer's data;
- make available the information needed to demonstrate compliance, and allow audits by answering reasonable written questions and, where required by law, by allowing an inspection with at least 30 days' notice, no more than once a year, at the Customer's cost.
4. Subprocessors
The Customer authorises Drumbly to use the subprocessors below. Drumbly binds each to data protection terms at least as protective as this DPA and remains responsible for them. Drumbly will announce new subprocessors on this page and email workspace owners at least 30 days before they start. The Customer may object on reasonable data protection grounds; if we cannot resolve the objection, the Customer may end the affected service and receive a pro-rata refund of prepaid fees.
| Provider | What it does for us | Data it receives | Where |
|---|---|---|---|
| Railway Corporation | Hosting the app | All service data | United States |
| Neon, Inc. | Hosting the database | All service data | United States |
| Anthropic, PBC | AI models for strategy, drafts, planning, chat and claim checks | Website content (yours and competitors'), strategy, drafts, product facts, chat messages, tracked questions, public Reddit posts, Search Console and Analytics results you connect | United States |
| DeepSeek | AI models for internal scoring and analysis: ranking Reddit threads, content ideas without Google data, brand-voice rules, and checking how DeepSeek answers your tracked questions | Public website content, your strategy documents and product facts, your rules for Drumbly, titles of open content ideas, public Reddit posts, your draft edits (before and after), tracked questions. Never Google user data, credentials or chat messages | People's Republic of China |
| OpenAI, L.L.C. | Checking how ChatGPT answers your tracked questions; text embeddings | Tracked questions; public website content | United States |
| Perplexity AI, Inc. | Checking how Perplexity answers your tracked questions | Tracked questions | United States |
| DataForSEO OÜ | Search results, keyword data and Google AI Overview checks | Your domain, competitor domains, keywords and tracked questions | European Union |
| Google LLC | Sign in with Google; PageSpeed Insights; Search Console and Analytics when you connect them | Your Google sign-in; page URLs; the Search Console and Analytics properties you choose | United States |
| fal and ElevenLabs | Rendering video scripts into clips, when switched on | Video scripts and storyboards | United States |
| Inngest, Inc. | Running background jobs | Job names, identifiers and the intermediate results needed to resume a job | United States |
| Resend | Sign-in codes and the daily digest email | Email address, sign-in codes, draft titles and excerpts in the digest | United States |
| Stripe, Inc. | Payments and subscriptions | Billing name, email and payment details (held by Stripe, never by us) | United States |
5. Security measures
- Encryption in transit (TLS) for all traffic; connected-account tokens encrypted at rest with AES-256-GCM and never exposed to AI models or logs.
- Role-based access in every workspace (owner, admin, editor, viewer) and an audit log of approvals, publishes, plan and member changes.
- Passwordless sign-in with single-use codes, 30-day sessions and rate limits on sign-in.
- Tenant isolation checked on every request; outbound fetches refuse private and internal network addresses.
- Content from websites and third-party platforms treated as data, never as instructions to the AI.
- Access to production limited to authorised personnel who need it.
6. International transfers
Where personal data is transferred outside the EEA, UK or Switzerland to a country without an adequacy decision, the European Commission's Standard Contractual Clauses (Module 2, controller to processor, and Module 3 for onward transfers), with the UK Addendum where relevant, are incorporated into this DPA by reference. DeepSeek processes limited data in the People's Republic of China as described in section 4.
7. Deletion and return
When the subscription ends, the Customer may ask for an export of its data for 30 days. Drumbly then deletes the Customer's personal data within 30 days, and backups roll off within a further 30 days, unless the law requires Drumbly to keep it.
8. Precedence
If this DPA conflicts with the Terms of Service, this DPA prevails for the processing of personal data. If the Standard Contractual Clauses apply and conflict with this DPA, the Clauses prevail.
Contact
Drumbly, Inc., a Delaware corporation. Data protection questions: privacy@drumbly.com.