Privacy Policy

Drumbly, Inc. ("Drumbly", "we", "us") runs Drumbly, an AI marketing assistant at https://drumbly.com. This policy explains what personal information we collect, why, who we share it with, and the choices you have. It covers our website, the Drumbly app, and our emails.

If you have a question, write to privacy@drumbly.com.

The short version

• We collect what we need to run Drumbly for you: your account, the website you add, the content we create with you, and the accounts you choose to connect.
• We do not sell personal information, and we do not use it for advertising.
• We do not use your data, or data from your connected Google accounts, to train AI models.
• Nothing is published to your channels unless you approve it or turn on autopublish for that channel.
• You can ask us to export or delete your data at any time.

What we collect

Account information. Your email address and, if you give it, your name. If you sign in with Google, we receive your name, email address and profile picture from Google. We do not use passwords: each sign-in uses a one-time code sent to your email, or Google.

Workspace information. Your workspace name, the people you invite and their roles, your plan, and an audit log of approvals, publishes, plan changes and member changes.

Website and research data. When you add a website, our crawler, DrumblyBot, reads up to 50 public pages of it and a few pages of competitors you name or we find. We store page text, titles and technical signals, and the product facts, strategy documents and brand voice we derive from them, each fact linked to the page it was quoted from.

Content you create with us. Drafts, edits, approvals, dismissals and their reasons, weekly plans, tracked questions, and messages you send to the CMO chat.

Connected accounts. When you connect a service, we store its access tokens encrypted (AES-256-GCM) and use them only for the purpose you connected them for:

• Google Search Console and Google Analytics: read-only access, used only for the properties you choose, to report search queries, pages, clicks, sessions and conversions for your site.
• X, LinkedIn, WordPress, Webflow, Framer, Wix, Sanity and HubSpot: permission to publish the posts and articles you approve. For X, also to search recent public posts to find creators in your market.
• GitHub: permission to open pull requests with recommended site fixes, each on its own branch and only after you approve it. Nothing reaches your main branch unless you merge it.
• Slack, Telegram and WhatsApp: permission to send your daily digest to the channel you pick.

Billing information. Stripe collects and holds your payment details. We receive your plan, billing period and payment status, never your card number.

Technical information. Your IP address and browser user agent, stored with your sign-in session and used for security and rate limiting, and server logs kept for troubleshooting.

Usage and cost records. How many drafts, posts and checks you use each billing period, and the cost of the AI and search calls made for your workspace, so we can enforce plan limits.

How we use it

• To provide Drumbly: read your site, write strategy and drafts, publish what you approve, measure results and send the reports you ask for.
• To keep accounts secure: sign-in codes, sessions, rate limits, and the audit log.
• To bill you and enforce plan limits.
• To send service emails: sign-in codes, the daily digest of drafts waiting for your review, and important notices about your account. We do not send marketing email without your consent.
• To fix problems and improve Drumbly, using aggregate usage and error information.
• To meet legal obligations and to enforce our Terms.

Where the EU or UK GDPR applies, our legal bases are: performing our contract with you; our legitimate interests in securing and improving the service; your consent where we ask for it; and legal obligations.

AI processing

Drumbly uses AI models to write and analyse. The content we send to a model is the minimum needed for the task, and untrusted text such as crawled pages and Reddit posts is marked as data, never followed as instructions. We use AI providers through their business APIs, which do not use your data to train their models, with the exception described next: we only send DeepSeek content that is public or that you created in Drumbly for internal scoring, and never Google user data, credentials or chat messages. Every product claim in a draft must cite a fact from your own site; drafts with unsourced claims cannot publish on their own.

Google user data

Drumbly's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We request read-only access to Search Console and Analytics, and read data only for the properties you select.
• We use this data only to provide and improve the user-facing features of Drumbly: showing your results, planning content, and answering your questions about performance.
• We do not transfer it to others except as needed to provide those features (for example, to Anthropic to write your weekly plan), to comply with law, or as part of a merger or acquisition with notice to you.
• We do not use it for advertising, do not sell it, and do not use it to train or improve generalized AI or machine-learning models.
• People at Drumbly do not read it unless you ask us to, it is needed for security or to comply with law, or it has been aggregated and anonymised.

You can disconnect Google at any time from Connections in the app, or revoke access at myaccount.google.com/permissions. When you disconnect, we delete the stored tokens.

Who we share it with

We share personal information only with the service providers that run parts of Drumbly for us, under contracts that limit their use of it to providing their service. They are:

We also share information when you direct us to: posts you approve are sent to the platform you chose, and the daily digest goes to the Slack, Telegram or WhatsApp channel you picked. Those platforms handle it under their own policies. We may disclose information if the law requires it, to protect people's safety, or as part of a merger or sale of our business, in which case we will tell you first.

International transfers

Drumbly, Inc. is based in the United States, and most processing happens there. DeepSeek processes the limited data described above in the People's Republic of China. Where we transfer personal data from the EU, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses or another lawful transfer mechanism.

How long we keep it

We keep your account and workspace data while your account is open. Sign-in codes expire after 10 minutes and sessions after 30 days of inactivity. Server logs are kept for up to 30 days. When you ask us to delete your account or workspace, by writing to privacy@drumbly.com, we delete its data within 30 days, except billing records we must keep by law, and backups, which roll off within a further 30 days.

Your rights and choices

Depending on where you live, you may have the right to access, correct, export or delete your personal information, to object to or restrict some processing, and to withdraw consent. California residents have the right to know, delete and correct their information, and not to be discriminated against for using these rights; we do not sell or share personal information for cross-context behavioural advertising. To use any of these rights, email privacy@drumbly.com from the address on your account. We will answer within 30 days. You may also complain to your local data protection authority.

If you are a member of someone else's workspace, that workspace's owner controls the content in it; we will pass your request on to them where appropriate.

Cookies

We use only the cookies needed to run Drumbly: a session cookie that keeps you signed in, a cookie that remembers which workspace you had open, and short-lived cookies that protect the flow when you sign in with Google or link an account. Your light or dark theme choice is saved in your browser's local storage. We do not use advertising or third-party analytics cookies. Stripe sets its own cookies on its checkout pages.

Security

Traffic is encrypted in transit with TLS. Connected-account tokens are encrypted at rest and never shown in the app, written to logs or sent to AI models. Access inside a workspace follows roles (owner, admin, editor, viewer), and approvals and publishes are logged. Our crawler refuses private and internal network addresses. No system is perfectly secure; if we learn of a breach affecting your data, we will notify you as the law requires.

Children

Drumbly is a business service for people aged 18 and over. We do not knowingly collect information from children.

Changes

If we change this policy, we will update the date above, and for significant changes we will notify workspace owners by email before they take effect.

Contact

Drumbly, Inc., a Delaware corporation. Privacy questions and requests: privacy@drumbly.com. Everything else: hello@drumbly.com.