Drift

Legal

Data Processing Agreement

Effective Date: October 16, 2026

This Data Processing Agreement (“DPA”) is entered into between the customer (“Controller”) and Ramankind Inc d/b/a Drift (“Processor”). It is incorporated into and forms part of the agreement under which Drift provides its Services to the Controller, and reflects the parties' agreement with respect to the processing of Personal Data under the GDPR, the UK GDPR, the CCPA, and other applicable data protection laws.

  1. 01 /

    Scope and Role of the Parties

    This Data Processing Agreement (DPA) forms part of the agreement between the customer (Controller) and Ramankind Inc d/b/a Drift (Processor) for the provision of the Drift Services. It governs the processing of Personal Data that the Controller submits to the Services or that Drift processes on the Controller's behalf.

    In most Drift use cases, the customer is the Controller of personal data processed through the Services (for example, data about the customer's own end users, teammates, or robotics telemetry). Drift acts as a Processor for that data. For data Drift collects about the customer directly (e.g. account identifiers, billing, support tickets, usage of the godrift.ai marketing site) Drift is the Controller, and the Privacy Policy applies.

  2. 02 /

    Definitions

    • GDPR / UK GDPR / CCPA: Regulation (EU) 2016/679, the United Kingdom General Data Protection Regulation, and the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act), respectively.
    • Personal Data: Any information relating to an identified or identifiable natural person processed by Drift on behalf of the Controller.
    • Controller / Processor / Subprocessor / Data Subject: As defined in GDPR Article 4.
    • Standard Contractual Clauses (SCCs): The clauses adopted by the European Commission in Decision 2021/914 for the transfer of personal data to third countries. The UK Addendum to the SCCs issued by the UK Information Commissioner's Office applies for UK data transfers.

  3. 03 /

    Nature and Purpose of Processing

    • Subject matter: Provision of the Drift Services (robotics simulation engineering agent, CLI, platform, and related support).
    • Duration: For as long as the agreement between the Controller and Drift is in effect, plus any post-termination retention required or permitted by law.
    • Nature of processing: Hosting, storage, transmission, logging, analytics, backup, and support operations necessary to deliver the Services, together with any processing instructed by the Controller through its use of the Services.
    • Purpose: To provide, maintain, secure, and support the Services as described in the underlying agreement.
    • Categories of data subjects: The Controller's authorized users, teammates, applicants, and any other individuals whose personal data the Controller chooses to submit to the Services.
    • Types of Personal Data: Account identifiers (name, email), authentication artifacts, configuration and usage logs, support correspondence, and any additional personal data the Controller submits through the Services. Drift does not require Controllers to submit special categories of data (GDPR Article 9) and discourages doing so.

  4. 04 /

    Processor Obligations

    • Processing on documented instructions: Drift processes Personal Data only on the Controller's documented instructions, including with regard to transfers to third countries, unless required to do so by law (in which case Drift will inform the Controller before processing, unless the law prohibits such notice on important grounds of public interest).
    • Confidentiality: All Drift personnel authorized to process Personal Data are bound by written confidentiality obligations.
    • Security of processing (Art. 32): Drift implements appropriate technical and organizational measures: encryption in transit (TLS 1.2+) and at rest for production datastores, principle-of-least-privilege IAM, secret management with rotation, SSO + mandatory 2FA on all production-affecting accounts, isolated production environments, automated vulnerability scanning on dependencies and infrastructure, and audit logging on administrative actions.
    • Subprocessors:The Controller authorizes Drift to engage the subprocessors listed in the Subprocessor List below. Drift will give the Controller at least 30 days' prior written notice of any intended changes to the Subprocessor List and respect any reasoned objection, subject to the termination rights in the agreement.
    • Assistance to the Controller: Drift will provide reasonable assistance to the Controller to help it respond to Data Subject requests, carry out Data Protection Impact Assessments, consult the supervisory authority, and comply with Articles 32-36 of the GDPR.
    • Data Subject requests: If Drift receives a request directly from a Data Subject related to data processed on the Controller's behalf, Drift will forward it to the Controller without undue delay and will not respond itself except on the Controller's instructions.
    • Personal Data Breach notification: Drift will notify the Controller without undue delay (and in any case within 72 hours) after becoming aware of a Personal Data Breach affecting Personal Data processed on the Controller's behalf, and will provide the information required under GDPR Article 33(3) as it becomes available.
    • Deletion or return at end of Services: On termination of the Services, Drift will, at the Controller's choice, delete or return all Personal Data to the Controller, and delete existing copies, unless law requires further storage.
    • Audits (Art. 28(3)(h)): Drift will make available to the Controller the information necessary to demonstrate compliance with its obligations under this DPA, and will allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller, on reasonable prior notice and subject to appropriate confidentiality undertakings.

  5. 05 /

    International Transfers

    Drift is incorporated in the United States and processes Personal Data in the United States and other countries where its subprocessors operate. Where Personal Data from the EEA, United Kingdom, or Switzerland is transferred to a country without an adequacy decision, the transfer is carried out under:

    • The Standard Contractual Clauses (Module 2: Controller-to-Processor; or Module 3: Processor-to-Processor as applicable), which are hereby incorporated into this DPA by reference and apply to the extent necessary.
    • The UK International Data Transfer Addendum to the SCCs where UK data is involved.
    • The Swiss revFADP addendum where Swiss data is involved.

    Drift carries out transfer impact assessments and implements supplementary measures (encryption, pseudonymization, strict access controls) where required to ensure a level of protection essentially equivalent to that guaranteed within the EEA.

  6. 06 /

    Subprocessor List

    The following subprocessors are currently engaged by Drift to help deliver the Services. We will update this list before adding a new subprocessor, and provide reasonable prior notice as described above.

    SubprocessorService / purposeLocation
    Vercel Inc.Hosting and CDN for the godrift.ai marketing site and the Drift platform web app.United States (global edge network)
    Neon Inc.Managed Postgres for application data (careers portal, blog CMS, admin tooling).United States
    Google LLC (Google Cloud Platform)Cloud Function relay for Google Sheets writes, Workspace SSO for the internal admin portal, and infrastructure services.United States
    Google LLC (Google Workspace / Sheets)Storage of inbound leads from the website contact form; team email and shared drives for internal operations.United States
    Google LLC (Google Analytics 4)Aggregate web analytics for the godrift.ai marketing site. Loaded only with user analytics consent.United States
    Vercel Web AnalyticsFirst-party aggregate web analytics for the godrift.ai marketing site. Loaded only with user analytics consent.United States

    This list reflects the current build and may be updated as the product evolves. Material changes will trigger notice to Controllers as described in the Processor Obligations section above.

  7. 07 /

    Data Protection Officer and Contact

    Drift has designated a Data Protection point of contact responsible for overseeing this DPA, responding to Data Subject requests, and interfacing with supervisory authorities. All data protection and privacy inquiries should be directed to:

    Data Protection Officer (DPO):
    Nikhil Kumar, Co-Founder & CTO, Ramankind Inc
    Email: dpo@godrift.ai
    Postal: 2261 Market Street STE 35848, San Francisco, CA 94114, United States

    For EU/UK-specific inquiries, you may also use this address until an EU/UK representative is appointed; we will update this page if that changes.

  8. 08 /

    Term, Precedence, and Changes

    This DPA takes effect on the Effective Date above and remains in effect for as long as Drift processes Personal Data on the Controller's behalf. In the event of a conflict between this DPA and the underlying agreement, this DPA prevails on data protection matters.

    Material changes to this DPA (including changes to the Subprocessor List) will be posted on this page and, where required, communicated to Controllers in advance. The current version is always available at godrift.ai/dpa.

  9. 09 /

    Signing This DPA

    This DPA is incorporated by reference into Drift's standard customer agreement. If your organization requires a countersigned copy of this DPA or needs to negotiate variations (for example, specific Standard Contractual Clauses modules, named EU Representative, or audit arrangements), email the DPO at the address above and we will provide an executable version.

← Back to home