Privacy policy

Data controller

Data we process

The data processed depends on your relationship with the platform and the features you use.

• User account: first name, last name, work email address, encrypted password, roles and strictly necessary preferences.
• Company workspace: company name, administrative information, members, invitations and organization settings.
• Billing: selected plan, billing email, Stripe customer, subscription, mandate or invoice identifiers. Card and IBAN data is entered and stored by Stripe, not by DriftOps.
• Projects and releases: project names, technical URLs, encrypted Git or hosting connections, tickets, QA approvals, logs and quality check results.
• AI assistants: selected provider, model, execution state, estimated usage and content strictly necessary to process tickets requested by users.
• Contact and support: name, email, company, message, consent, support replies and useful history for request follow-up.
• Security: audit logs, timestamps, hashed IP addresses, user-agent, login attempts and events needed to prevent abuse.

Purposes

• Provide the service: workspace creation, project management, previews, AI tickets, human approvals and authorized deployments.
• Answer contact, assistance, demo and operational support requests.
• Secure the platform, control access, log sensitive actions and prevent abuse.
• Manage plans, subscriptions, invoices, trials, payment-related restrictions and accounting obligations.
• Meet legal, tax, accounting, contractual and security obligations.
• Improve service reliability using internal technical indicators that are not used for advertising.

Legal bases

• Contract performance to create the account, provide requested features, process tickets, manage workspaces and deliver support.
• Legal obligation for billing, accounting, rights management and responses to competent authorities.
• Legitimate interest for security, fraud prevention, audit, technical improvement and evidence of human approvals.
• Consent when you submit a form, ask to be contacted or voluntarily connect a third-party service.

Cookies and trackers on the Front Office

Browsing the public pages of DriftOps does not require any audience measurement, advertising or third-party tracking cookie.

• No Google Analytics, Google Tag Manager, Matomo, Plausible, Hotjar, Microsoft Clarity or equivalent tool is loaded on the Front Office.
• No advertising pixel, marketing retargeting, commercial profiling or ad network sharing is installed.
• No third-party tracking script is added to public pages.
• Any technical cookies are reserved for areas requiring an explicit action, such as sign-in, registration, the back office or form protection.

Recipients and processors

DriftOps does not sell personal data. Data may be accessible to authorized TEAM HELPER staff and strictly necessary providers: hosting, transactional email, Stripe payment, selected Git providers, selected AI providers, technical monitoring and support. Every access is limited to the operational need.

Retention periods

• Account and company workspace: kept while the service is used, then archived or deleted according to applicable obligations.
• Billing and accounting records: kept for the applicable legal retention periods.
• Contact and support messages: kept as long as needed to process the request, then reasonably archived for customer follow-up.
• Security, audit and execution logs: kept for a period proportionate to security, evidence, diagnostic and compliance needs.
• Technical backups: limited rotation, with progressive deletion according to operating cycles.

Your rights

Under the GDPR, you may exercise your rights by contacting us. Proof of identity may be requested when needed to protect your account.

• Right of access to personal data concerning you.
• Right to rectify inaccurate or incomplete data.
• Right to erasure when permitted by law.
• Right to restriction of processing.
• Right to portability of data you provided, where this right applies.
• Right to object to processing based on legitimate interest.
• Right to lodge a complaint with the CNIL if you believe your rights are not respected.

Security

DriftOps applies customer workspace separation, access controls, secret encryption, audit logs, deployment restrictions and mandatory human approval before production. AI agents are not allowed to bypass security controls, billing or QA validation.