Privacy Policy

Depending on how personal information is processed, Conic Solutions OÜ may act either as a data controller or as a data processor.

When We Are the Data Controller

We generally act as the data controller when we process personal information relating to:

• Drivian account holders;
• Website visitors;
• Trial and subscription users;
• Billing and payment administration;
• Customer support;
• Security and fraud prevention;
• Analytics;
• Marketing and communications from Drivian; and
• Our own business operations.

In these situations, we determine why and how the personal information is processed.

When We Are the Data Processor

Businesses using Drivian may upload, receive, store, organize, or otherwise process information relating to their own:

• Customers;
• Leads;
• Subscribers;
• Contacts;
• Website visitors;
• Messaging recipients; and
• Other individuals with whom they communicate.

When Drivian processes this information solely on behalf of a customer, the Drivian customer is generally the data controller and Conic Solutions OÜ acts as a data processor.

Our customers are responsible for ensuring that they have an appropriate legal basis for collecting, using, storing, and communicating with those individuals.

The information we collect depends on how you use Drivian.

Account Information

When you create or manage a Drivian account, we may collect:

• Name;
• Email address;
• Phone number;
• Company or organization information;
• Account and workspace information;
• Authentication information;
• Account preferences; and
• Subscription information.

Communication and Messaging Data

When messaging channels are connected to Drivian, we may process information such as:

• Message content;
• Conversation history;
• Contact names and identifiers;
• Phone numbers;
• Email addresses;
• Social or messaging platform identifiers;
• Images, documents, audio, video, and other media;
• Message delivery and status information;
• Timestamps;
• Campaign activity;
• Tags and contact attributes; and
• Other metadata associated with communications.

This may include communications processed through supported services such as WhatsApp, Instagram, Facebook Messenger, Telegram, SMS, website chat, and other connected messaging channels.

Contact and CRM Data

Customers may upload, import, synchronize, or create information about their contacts, including:

• Names;
• Email addresses;
• Phone numbers;
• Custom fields;
• Tags;
• Notes;
• Segments;
• Conversation history;
• Campaign activity; and
• Other information entered by the customer.

Payment and Billing Information

When you purchase a Drivian subscription, payment information is processed by our payment providers, such as Stripe, PayPal, or other supported payment processors.

We generally receive information such as:

• Payment status;
• Transaction identifiers;
• Subscription status;
• Billing country;
• Payment method type; and
• Limited payment-related information.

We do not directly store your complete credit or debit card number.

Technical and Usage Information

When you use Drivian, we may automatically collect information such as:

• IP address;
• Browser type;
• Device type;
• Operating system;
• Pages or features used;
• Login and activity timestamps;
• Session information;
• Referral source;
• Error and performance information; and
• Interactions with the Services.

Support Communications

If you contact us, we may collect the information contained in your support request, including your email address, messages, screenshots, attachments, and other information you choose to provide.

We may use personal information to:

• Create and manage Drivian accounts;
• Provide and operate the Services;
• Authenticate users;
• Provide messaging, inbox, automation, CRM, campaign, and collaboration functionality;
• Process and deliver communications through connected channels;
• Store and organize conversations, contacts, media, and related information;
• Operate automation workflows and Flow Builder functionality;
• Provide AI-assisted features where available;
• Manage subscriptions and billing;
• Provide customer support;
• Send service-related and administrative communications;
• Detect fraud, spam, abuse, and security threats;
• Protect our infrastructure and users;
• Monitor and improve performance and reliability;
• Understand how Drivian is used;
• Improve existing features and develop new features;
• Measure marketing and advertising performance;
• Comply with legal and regulatory obligations; and
• Establish, exercise, or defend legal claims.

We do not use customer messaging data for purposes unrelated to providing, securing, supporting, or maintaining the Services unless otherwise disclosed or legally permitted.

Where the General Data Protection Regulation (“GDPR”) or similar laws apply, we process personal information under one or more of the following legal bases.

Performance of a Contract

We process information where necessary to provide Drivian and fulfill our contractual obligations, including:

• Creating and maintaining your account;
• Providing subscription features;
• Processing billing;
• Providing support; and
• Operating requested integrations.

Legitimate Interests

We may process information where necessary for our legitimate business interests, including:

• Securing our Services;
• Preventing fraud and abuse;
• Improving Drivian;
• Troubleshooting technical issues;
• Understanding service usage; and
• Protecting our legal rights.

We consider the impact on your rights and interests before relying on legitimate interests.

Consent

We may rely on your consent where required, including for certain:

• Cookies;
• Analytics technologies;
• Advertising technologies;
• Marketing communications; or
• Optional functionality.

You may withdraw your consent at any time where processing is based on consent.

Legal Obligations

We may process information where necessary to comply with applicable laws, tax requirements, court orders, regulatory obligations, or other lawful requirements.

Drivian is designed to allow businesses to communicate with their own customers, leads, and contacts.

Our customers determine:

• Which contacts are added to Drivian;
• What information is collected about those contacts;
• Which messages are sent;
• Which communication channels are used;
• How contacts are categorized or segmented;
• Which automation workflows are created; and
• How long customer information should be retained within their workspace.

If you receive a communication from a business using Drivian, that business is generally responsible for determining the purpose and legal basis for the communication.

Requests concerning messages sent by a particular Drivian customer should generally be directed to that business first.

Drivian may connect with third-party messaging platforms and communication providers, including services operated by Meta, Telegram, SMS providers, and other supported platforms.

When you connect an external service to Drivian, information may be exchanged between Drivian and that provider as necessary to provide the integration.

For example, this may include:

• Account identifiers;
• Phone numbers;
• Messaging identifiers;
• Message content;
• Media;
• Contact information;
• Delivery status; and
• Authentication or integration credentials.

Those third-party providers process certain information independently under their own privacy policies and terms.

Drivian may provide AI-assisted functionality, such as generating or improving:

• Messages;
• Campaign content;
• Automation content;
• Replies; or
• Other text.

When you use an AI-assisted feature, information you submit to that feature may need to be processed by the technology providers used to deliver the functionality.

We limit the information shared to what is reasonably necessary to provide the requested feature and apply appropriate data protection safeguards where required.

You should avoid submitting sensitive personal information to AI features unless it is necessary and you have an appropriate legal basis to do so.

We do not sell or rent personal information.

We may disclose personal information to the following categories of recipients where necessary.

Service Providers

We use third-party providers to help operate Drivian, including providers of:

• Cloud infrastructure and hosting;
• Content delivery and security services;
• Databases and storage;
• Email delivery;
• Analytics;
• Error monitoring;
• Payment processing;
• Customer communications;
• AI functionality;
• Messaging APIs; and
• Other technical infrastructure.

These may include services such as Cloudflare, Stripe, PayPal, Google Analytics, Mixpanel, Meta services, and other providers used to operate particular Drivian features.

Where required by applicable law, we use contractual and data protection safeguards governing how service providers process personal information.

Connected Services

If you choose to connect Drivian with another platform, we may share information with that service as necessary to perform the integration you requested.

Legal Requirements

We may disclose information where we reasonably believe disclosure is necessary to:

• Comply with applicable law;
• Respond to a valid legal process;
• Comply with a court order or lawful government request;
• Protect our rights or property;
• Protect users or other individuals; or
• Investigate fraud, security incidents, or unlawful activity.

Business Transfers

If Conic Solutions OÜ is involved in a merger, acquisition, financing, restructuring, sale of assets, or similar transaction, information may be transferred as part of that transaction, subject to applicable data protection requirements.

We may use analytics and tracking technologies to understand how visitors and users interact with Drivian.

These may include tools such as:

• Google Analytics;
• Mixpanel;
• Meta/Facebook technologies; and
• Similar analytics or advertising services.

Depending on your location and applicable law, non-essential analytics or advertising technologies may only be activated after you provide consent.

Where consent is required, you may withdraw it at any time by clearing Drivian's cookies in your browser, which also causes the cookie notice to be shown to you again. Our Cookie Policy explains this in more detail.

Drivian uses cookies and similar technologies for purposes such as:

• Maintaining login sessions;
• Authentication and security;
• Remembering preferences;
• Providing functionality;
• Measuring website performance;
• Understanding product usage; and
• Marketing or advertising where permitted.

Some cookies are necessary for the Services to function and cannot reasonably be disabled through our systems.

Other cookies, including certain analytics or advertising cookies, may require your consent.

You can also control cookies through your browser settings, although disabling certain cookies may affect Drivian functionality.

For additional information, please review our Cookie Policy.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including providing the Services, complying with legal obligations, resolving disputes, and enforcing our agreements.

Account Information

Account and subscription information is generally retained while your account remains active and for an appropriate period afterward where necessary for legal, accounting, fraud-prevention, or administrative purposes.

Messages, Contacts, and Customer Data

Messages, conversations, contacts, media, and related information may remain stored in a customer's Drivian workspace for as long as required by that customer or until the information is deleted.

Customers may delete information using available Drivian functionality or request assistance where necessary.

When an account or workspace is deleted, information may not disappear immediately from all technical systems where temporary retention is required for security, backups, fraud prevention, or legal obligations.

We do not intentionally retain personal information indefinitely when there is no continuing business, contractual, security, or legal reason to retain it.

We use reasonable technical and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, loss, or destruction.

Measures may include:

• Encryption in transit using HTTPS/TLS;
• Access controls;
• Authentication controls;
• Network and infrastructure security;
• Monitoring;
• Restricted access to production systems; and
• Other appropriate technical and organizational safeguards.

No internet-based service or storage system can guarantee absolute security.

If you believe your Drivian account or information has been compromised, please contact us promptly at [email protected].

Drivian and our service providers may process personal information in countries other than the country where you are located.

Where personal information protected by the GDPR is transferred outside the European Economic Area (“EEA”) to a country that has not been recognized as providing an adequate level of protection, we use appropriate safeguards where required.

These safeguards may include:

• European Commission Standard Contractual Clauses;
• Applicable adequacy decisions; or
• Other lawful transfer mechanisms permitted under applicable data protection law.

Depending on your location and applicable law, you may have the right to:

• Request access to your personal information;
• Obtain a copy of your personal information;
• Correct inaccurate or incomplete information;
• Request deletion of your information;
• Request restriction of processing;
• Object to certain processing;
• Withdraw consent where processing relies on consent;
• Request portability of certain personal information; and
• Lodge a complaint with a data protection authority.

These rights are subject to exceptions and limitations under applicable law.

To exercise rights relating to information for which Conic Solutions OÜ is the controller, contact us at:

[email protected]

We may need to verify your identity before fulfilling certain requests.

Data Controlled by a Drivian Customer

If your personal information was provided to Drivian by one of our business customers and Drivian processes it solely on that customer's behalf, you should normally submit your request directly to that business.

Where required, we will assist our customers in responding to valid data subject requests.

If you are located in the EEA, you have the right to lodge a complaint with the data protection authority in your country of residence, workplace, or where you believe an infringement occurred.

As Conic Solutions OÜ is established in Estonia, the Estonian supervisory authority is:

Andmekaitse Inspektsioon — Estonian Data Protection Inspectorate

The Inspectorate accepts complaints concerning violations of personal-data rights.

We encourage you to contact us first at [email protected] so that we have an opportunity to address your concern.

We may send you emails relating to:

• Your account;
• Subscription or billing matters;
• Security;
• Product updates;
• Service announcements; and
• Customer support.

Certain communications are necessary for providing the Services and cannot be opted out of while maintaining an active account.

Where permitted, we may also send promotional or marketing communications.

You can unsubscribe from marketing communications using the unsubscribe option provided in the message or by contacting us.

Unsubscribing from marketing emails will not prevent us from sending necessary transactional or service-related communications.

Drivian is intended for businesses and individuals who are legally capable of entering into a contract.

Our Services are not directed to children under 18, and we do not knowingly allow children under 18 to create Drivian accounts.

If we become aware that we have collected personal information directly from a child in circumstances where we should not have done so, we will take appropriate steps to delete it.

Drivian may use automation to perform functions configured by users, such as sending messages, routing conversations, assigning contacts, or triggering workflows.

These automations are generally configured and controlled by the Drivian customer.

Drivian does not ordinarily use personal information to make solely automated decisions on its own behalf that produce legal or similarly significant effects on individuals unless this is specifically disclosed and permitted by applicable law.

We may update this Privacy Policy from time to time to reflect:

• Changes to Drivian;
• New features or integrations;
• Changes to our service providers;
• Changes to our data-processing practices; or
• Legal or regulatory requirements.

The latest version will be available at:

https://drivian.io/page/privacy-policy

The “Last updated” date at the beginning of this Policy will be revised when changes are made.

Where required by law, we will provide additional notice of material changes.

If you have questions, concerns, or requests regarding this Privacy Policy or our processing of personal information, please contact: