Privacy Policy

This Privacy Policy explains, in detail, what personal information SLTR Digital collects in connection with driftlabHQ (the “Service”), why we collect it, the legal bases on which we rely, how long we retain it, with whom it may be shared, and what choices and rights are available to you.

This Policy applies to the driftlabHQ web application at driftlabhq.com, to any associated mobile or desktop client we make available, and to all backend services that support them, including authentication, data storage, connector integrations, and transactional email.

By creating an account, signing in, or otherwise using the Service, you acknowledge that your personal information will be processed as described in this Policy. If you do not agree with this Policy, please do not create an account or use the Service.

The data controller responsible for personal information processed in connection with the Service is SLTR Digital, the operator of driftlabHQ. For any question, request, or concern regarding this Policy or our handling of your personal information, you may contact us at kevin@sltrdigital.com. This is currently our single point of contact for privacy, security, legal, and support matters; we have not stood up separate departmental mailboxes at this time.

We collect only the categories of personal information described below. Categories that depend on optional features (such as connecting Google services) are only collected if you choose to use those features.

We do not collect any category of information beyond what is listed above. In particular, we do not collect payment or card information, advertising identifiers, precise location data, or biometric data. Our use of analytics is described in full in the Analytics, cookies, and local storage section, and our use of artificial intelligence is described in the Drift AI section.

We deliberately limit our collection of personal information. The Service does not collect, and we do not intend to collect:

• Payment card numbers, bank account numbers, or other financial account credentials; the Service does not process payments and holds no card data.
• Advertising identifiers, third-party advertising cookies, or any identifier used for cross-context behavioral advertising. We do use first-party product analytics, described in full in the Analytics and cookies section below.
• Precise device location data, such as GPS coordinates. Our analytics providers derive only a coarse country or region from your IP address.
• Biometric identifiers such as fingerprints or facial geometry.
• Government identification numbers, such as Social Security numbers or passport numbers.

We do not sell personal information, and we do not share personal information with third parties for cross-context behavioral advertising. We have no advertising business and no data broker relationships.

We process personal information only for the following purposes, and we rely on the legal bases indicated for users in jurisdictions (such as the European Economic Area and the United Kingdom) where a legal basis is required:

Where we rely on consent, such as connecting a Google service, you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

driftlabHQ includes an assistant, “Drift AI,” which interprets what you type and acts on your workspace on your behalf. Because this involves sending your information to a third party for processing, we describe it here in unusual detail.

driftlabHQ's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. This section describes our Google data practices explicitly and completely.

1. Scopes and purpose. If you choose to connect Google, we request only the OAuth scopes necessary for the specific, user-initiated features you enable, and no others. Those scopes are, exhaustively:

   Scope	What it permits	Why we request it
   calendar.readonly	Read events on your calendars	To show your events in the Calendar view and to detect when a task you are scheduling conflicts with an existing commitment
   calendar.events	Create and modify calendar events	To mirror a scheduled task onto your calendar with a reminder, to move that event when you reschedule the task, and to remove it when you delete the task
   gmail.send	Send mail as you	To send an email that you have explicitly asked Drift AI to send, and confirmed

   We do not request permission to read your Gmail. Through the Google connection, driftlabHQ cannot read your Gmail inbox, list your Gmail messages, or access your Gmail history. The gmail.send scope permits sending only. We use Google user data solely to provide these user-facing features within driftlabHQ. (Reading email is a separate, optional feature that works only with non-Google mailboxes you connect yourself; see Connected mailboxes.)
2. No human access, except in narrow circumstances. No SLTR Digital personnel read your Gmail or Calendar data in the ordinary course. We may access it only: (a) with your affirmative consent, for example when you contact support about a connector issue and ask us to look; (b) as necessary for security purposes, such as investigating suspected abuse or a security incident; or (c) to comply with applicable law or a valid legal process.
3. Never for advertising. We do not use Google user data, or any information derived from it, to serve advertisements, including retargeted advertising, of any kind.
4. Never sold, and not used to train generalized models. We do not sell Google user data to third parties. We do not use Google user data to train generalized or third-party artificial intelligence or machine learning models.
5. Storage and isolation.Google OAuth tokens are stored in a database table restricted to our backend service role. No client-side code, and no other user, can read another user's connector tokens.
6. Revocation. You may disconnect Gmail and Google Calendar access at any time from within the Service, or directly through Google at myaccount.google.com/permissions. Disconnecting removes our ability to access the connected service going forward and triggers deletion of the stored tokens.

Separately from Google, you may connect a mailbox from another provider (currently Yahoo Mail, Zoho Mail, iCloud Mail, Fastmail, or a generic IMAP server) so that driftlabHQ can show your inbox inside the app, turn messages into tasks, and let Drift AI brief and triage your mail. Unlike the Google connection, this feature does read your email. This section describes exactly how.

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These measures include, specifically:

1. Encryption of data at rest using AES-256, applied to our Supabase Postgres database.
2. Encryption of data in transit using TLS for all connections between your device, our servers, and our database provider.
3. Row-level security policies enforced at the database level, so that every row of user content is scoped to its owning account and cannot be read or modified by other users.
4. Service-role isolation of connector tokens: Google OAuth tokens are stored in a database table that only our backend, using a privileged service-role credential, can read. No client application and no ordinary user session can access this table.
5. No storage of your task, note, or connector content on your local device; the only information we persist on-device is a session authentication token and a one-time onboarding-completion flag, neither of which contains your workspace content.
6. Passwordless authentication using one-time codes sent by email, which eliminates the risk of password reuse, credential stuffing against driftlabHQ, and password database compromise, because we do not store passwords at all.

No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. We continue to evaluate and improve our security practices as the Service evolves.

We use a limited set of subprocessors and service providers to operate the Service. We do not disclose personal information to any party beyond those listed here, except as required by law.

Beyond the subprocessors above, we disclose personal information only where compelled by law, such as in response to a valid subpoena, court order, or other lawful legal process, or where necessary to protect the rights, property, or safety of SLTR Digital, our users, or the public. We do not otherwise share, rent, or sell personal information to third parties.

SLTR Digital hosts the Service on Amazon Web Services in the us-west-2 (Oregon, United States) region, and uses Supabase and Amazon SES as described above. If you access the Service from outside the United States, your personal information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those of your home jurisdiction.

Where such a transfer requires a safeguard under applicable law, such as the transfer of personal information from the European Economic Area, the United Kingdom, or Switzerland, we rely on the contractual and organizational safeguards made available by our subprocessors, and we will take reasonable steps to ensure your personal information continues to receive an adequate level of protection.

We retain personal information for as long as your account remains open, and for as long as necessary to provide the Service, unless a longer retention period is required or permitted by law.

When you delete your account through the in-app account deletion function, all associated tables, including your user content, connector tokens, and connector action log, are deleted immediately and in the same operation. The only data that may persist afterward is contained within provider backup snapshots taken before deletion, which age out according to Supabase's standard backup rotation schedule, not a schedule we control separately.

driftlabHQ provides an in-app account deletion function. When you initiate account deletion, the deletion cascades across all tables associated with your account immediately, including your account record, user content, Google connector tokens, and connector action log. There is no separate, delayed purge step within our own systems; deletion is immediate at the moment you confirm it in-app.

As described in the Retention section above, provider backups maintained by Supabase on its own rotation schedule may retain a copy of your data for a limited period after deletion, until that backup ages out of rotation. We do not use backup data for any purpose other than disaster recovery.

The Service is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. driftlabHQ is a personal scheduling workspace intended for general adult use, consistent with the Children's Online Privacy Protection Act (COPPA).

If you believe a child under 13 has provided us with personal information, please contact kevin@sltrdigital.com, and we will investigate and delete such information promptly.

If we become aware of a security incident involving unauthorized access to, or disclosure of, your personal information that creates a reasonable risk of harm, we will notify you and, where required, the relevant supervisory authorities or state regulators, without undue delay and in accordance with applicable law. Notification will describe, to the extent then known, the nature of the incident, the categories of information involved, and the steps we have taken or recommend you take in response.

driftlabHQ does not use advertising cookies and does not participate in cross-site or cross-context behavioral advertising. We do use analytics to understand how the Service is used, so that we can fix what is broken and decide what to build next. Both providers are described below in full.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. When we make changes, we will revise the “Last updated” date at the top of this page. If a change is material, we will provide additional notice where appropriate, such as by email or an in-app notice. Your continued use of the Service after a revised Policy takes effect constitutes acceptance of the changes.

SLTR Digital
Operator of driftlabHQ
Email: kevin@sltrdigital.com
Web: https://driftlabhq.com/privacy