Skip to main content

Legal

Definitions

The defined terms used across the Terms of Service, the Privacy Policy, the Data Processing Agreement and the Acceptable Use Policy.

These definitions are the source of truth for terminology used across the Driftstack legal document set: the Terms of Service, the Privacy Policy, the Data Processing Agreement, and the Acceptable Use Policy. When any of those documents capitalises a term, these definitions control.

If a term needs different meanings in different documents, it is renamed in one of them. We do not redefine.

Parties + entities

“Driftstack”, “we”, “us”, or “our” means Driftstack, a sole proprietorship (eenmanszaak) registered with the Dutch Chamber of Commerce (KvK) under number 42064799.

“Customer” or “you” means the legal entity that has accepted the Terms of Service and on whose behalf the Service is used, together with that entity’s Authorized Users.

“Authorized User” means an individual employee, contractor, or agent of Customer that Customer has granted access to the Service. An Authorized User acts on Customer’s behalf and binds Customer.

“Party” means Driftstack or Customer; “Parties” means both.

Service + product terms

“Service” or “Platform” means the Driftstack iPhone Safari automation platform, including the API, the self-hosted GUI Client, the SDKs published on public package registries (npm, PyPI, Go modules), and the mac mini fleet that hosts the underlying WebKit driver infrastructure.

“API” means the HTTP application programming interface published under the /v1/ path at https://api.driftstack.dev. Its current developer reference is published at https://docs.driftstack.io/api/.

“API Key” means an authentication credential issued to Customer by Driftstack that authorises calls to the API on Customer’s behalf. API Keys are revocable and limited by the scope taxonomy published in the current API reference.

“GUI Client” means the Tauri-based desktop application distributed by Driftstack that connects to Driftstack Cloud or to a compatible self-hosted Driftstack Node selected by Customer.

“SDK” or “SDKs” means the official client libraries published by Driftstack: @driftstack/sdk (TypeScript, npm), driftstack-sdk (Python, PyPI), and the Go SDK at github.com/driftstackdev/driftstack-go.

“Session” means an instance of an iPhone-archetype Safari runtime provisioned on Driftstack’s mac mini fleet under Customer’s account, identified by a ses_<uuid> identifier through the API.

“Recording” means a Customer-controlled desktop-local NDJSON archive of streamed frames captured by the GUI Client during a Session. Recordings exist only when Customer explicitly enables recording and remain on Customer’s device; the recording workflow does not upload them to Driftstack.

“Capture” means a one-shot screenshot, DOM snapshot, or PDF generated by the API’s capture endpoint during a Session, returned inline to Customer and not retained by that endpoint.

“Customer Workflow” means the automation logic, recipes, scripts, or instructions Customer provides to the Service to drive Sessions.

“Subscription” means Customer’s ongoing access to the Service under a Plan and price published on Driftstack’s current pricing page or agreed in an Order Form. The applicable checkout or Order Form is the commercial source of truth for Customer’s price and payment rail.

“Plan” means the combination of Fees, Service limits and included AI Credits that Customer selects: the Trial, Starter, Pro, Team, Scale or Enterprise, as described at https://driftstack.io/pricing/, or as agreed in an Order Form. A Plan that is no longer offered but that Customer still holds is an “Earlier Plan” (Section 8.13 of the Terms of Service).

“Trial” means the free, time-limited Plan described in Section 8.9 of the Terms of Service.

“Profile” means a saved iPhone browser identity in Customer’s Account, including its settings, storage and chosen proxy or VPN connection, from which Customer starts Sessions.

“AI Credit” means the unit in which use of the AI agent on Driftstack’s model access is measured, as described in Section 8.11 of the Terms of Service. One AI Credit is worth one US cent (US$0.01) of that use.

“Order Form” means a commercial order form or schedule signed by both Parties.

Data terms (GDPR-aligned)

“Personal Data” has the meaning in Article 4(1) GDPR: any information relating to an identified or identifiable natural person.

“Special Category Data” has the meaning in Article 9 GDPR: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data uniquely identifying a person, data concerning health, or data concerning a person’s sex life or sexual orientation.

“Data Subject” has the meaning in Article 4(1) GDPR: the identified or identifiable natural person to whom Personal Data relates.

“Processing” has the meaning in Article 4(2) GDPR: any operation performed on Personal Data, including collection, storage, transmission, alteration, retrieval, erasure, or destruction.

“Controller” has the meaning in Article 4(7) GDPR: the natural or legal person that determines the purposes and means of Processing.

“Processor” has the meaning in Article 4(8) GDPR: the natural or legal person that Processes Personal Data on behalf of a Controller.

“Sub-processor” means a third-party Processor engaged by Driftstack to Process Personal Data on Customer’s behalf in the course of providing the Service. The term also covers a third-party Processor engaged by Driftstack for Processing that Driftstack does as Controller under the Privacy Policy, such as support correspondence. The current Sub-processor list is maintained in the Privacy Policy and the DPA Annex 3.

“Customer-Connected Service” means a third-party service that Customer integrates with the Service using Customer’s own credentials, Customer’s own account, and Customer’s own contractual relationship with that third party. Customer-Connected Services include (without limitation) HTTP/SOCKS5 proxies, captcha-solving services (e.g. 2Captcha, CapSolver), email services accessed by Customer’s IMAP or OAuth credentials, and SMS verification services (e.g. TextVerified, Twilio).

Customer-Connected Services are not Sub-processors. Driftstack does not contract with the third-party provider, does not receive service from them, and does not Process data on Driftstack’s behalf through them. The third-party Processes data on Customer’s instruction via Customer’s credentials. The DPA codifies this distinction.

“Customer Data” means all data, content, and information that Customer or its Authorized Users submit or transmit to the Service, including Customer Workflows, Session inputs, live-session media, Capture requests, and any Personal Data Customer chooses to process through the Service. A Recording that remains solely on Customer’s device is not submitted to Driftstack by the recording workflow.

“Customer-Provided Secrets” means the credentials Customer supplies for use in Sessions, including (without limitation) proxy authentication credentials, captcha-service API keys, email credentials, and SMS-service API keys. Customer-Provided Secrets are a subset of Customer Data with elevated handling obligations documented in the DPA and the Privacy Policy.

“Account Data” means information identifying Customer or its Authorized Users for the purpose of administering the contractual relationship, including legal entity name, billing address, VAT/BTW number, named contacts, billing email, and authentication identifiers.

“Session Metadata” means non-content information about a Session, including session id, customer id, target site identity, timestamps, duration, success/failure, and aggregate counters used for capacity planning.

Compliance + transfer terms

“GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

“AVG” means the Algemene verordening gegevensbescherming, the Dutch implementing instrument of the GDPR. Where this document references the GDPR, equivalent provisions of the AVG apply where Dutch law is the controlling law of the relationship.

“AP” means the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), the supervisory authority of the Netherlands under Article 51 GDPR.

“SCCs” means the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the “2021 SCCs”), incorporated by reference where Personal Data is transferred to a third country lacking an adequacy decision under Article 45 GDPR.

“DPF” means the EU-US Data Privacy Framework adopted by Commission Implementing Decision (EU) 2023/1795 of 10 July 2023, and its self-certification mechanism for US-based recipients of EU Personal Data.

“Adequate Country” means a country, territory, sector, or international organisation that the European Commission has determined provides an adequate level of protection for Personal Data under Article 45 GDPR.

“DPA” in this document set means the Data Processing Agreement published at driftstack.io/legal/dpa/. Where capitalised in a sentence discussing a regulator (e.g. “the Dutch DPA”), DPA refers to the data protection authority and the context disambiguates.

Commercial + financial terms

“Fees” means the charges payable by Customer for the Service under Customer’s Subscription, current checkout, or Order Form, plus applicable taxes. On the Earlier Plans API Builder and API Scale (Section 8.13 of the Terms of Service) and on an Enterprise Account, where not moved to AI Credits, standard bundled-LLM turns post an included-service accounting value against Customer’s enforced budget; that value is not a separately itemised Stripe charge. AI Credits included in a Plan are part of what the Plan’s Fees pay for. They are not separately charged, have no cash value, and are not refunded, transferred or exchanged for money.

“BTW” means Dutch belasting toegevoegde waarde (value-added tax), the Dutch implementation of EU VAT under Directive 2006/112/EC.

“Reverse-Charge VAT” means the EU VAT mechanism under which the Customer (a B2B recipient established in an EU member state other than the Netherlands and holding a valid VAT identification number) accounts for VAT in their own member state, and Driftstack invoices without Dutch BTW. The Customer is responsible for verifying its own VAT status.

“Stripe” means Stripe Payments Europe, Limited (Ireland-incorporated entity with company number 513174) and its affiliates, the payment processor for fiat (card) Subscription Fees from all Customers, wherever they are established; under Stripe’s data processing agreement, payment data is also processed by Stripe, LLC (USA).

“Moneybird” means Moneybird B.V. (Dutch entity, Utrecht), the accounting and invoicing platform used to generate VAT-compliant invoices for Subscription Fees.

“MacStadium” means MacStadium, Inc. (Delaware, USA), a data center operator for Driftstack’s hosted Mac fleet.

“Hetzner” means Hetzner Online GmbH (Gunzenhausen, Germany), the provider of the Cloud VM hosting Driftstack’s control plane, admin panel, and onboarding API surface.

“Neon” means the managed Postgres service that holds Driftstack’s control-plane database: the Neon service of Databricks, Inc. (USA), the parent company of Neon, LLC. Data residency is the EU Frankfurt region.

“Cloudflare” means Cloudflare, Inc. (Delaware, USA), the provider of DNS, CDN, edge routing (driftstack.io and subdomains), Pages hosting, and R2 object storage for customer-uploaded profile avatars, encrypted profile blobs, and public status-page snapshots. That R2 storage uses Cloudflare’s default jurisdiction and may replicate data in the EU and United States under the transfer mechanisms in the DPA. Cloudflare also provides Email Routing and Email Workers, which receive every message sent to a Driftstack address and pass it to the support inbox; an R2 bucket with EU jurisdiction that holds raw support email; and Turnstile (a bot check on our sign-up, sign-in and account-security pages and the visitor support chat).

“Postmark” means the transactional email service operated by AC PM LLC (USA), an ActiveCampaign company, used by Driftstack for signup verification, password reset, billing receipts, and support correspondence.

“Amazon Web Services” means the cloud service operated by Amazon Web Services EMEA SARL (Luxembourg), whose S3 object storage holds Driftstack’s encrypted database backups in the EU Frankfurt region.

“Sentry” means the error tracking and performance monitoring service operated by Functional Software, Inc. (Delaware, USA), used by Driftstack for diagnostics on the API server, the GUI Client, and the marketing site. EU region selected on Driftstack’s Sentry account.

“Anthropic” means Anthropic, PBC (Delaware, USA), the provider of the Claude models the AI agent uses when it runs on AI Credits (Terms Section 10.4). Anthropic is a Sub-processor listed in the Privacy Policy and DPA Annex 3. When the AI agent runs on Customer’s own key, that provider is not Driftstack’s Sub-processor. Driftstack also uses Anthropic’s models, as Controller, to sort support correspondence and to draft replies that a person approves before they are sent (Privacy Policy Sections 3.7 and 7).

Documents + acceptance

“Terms of Service” or “ToS” means the Terms of Service published at driftstack.io/legal/terms/.

“Privacy Policy” means the Privacy Policy published at driftstack.io/legal/privacy/.

“AUP” or “Acceptable Use Policy” means the Acceptable Use Policy published at driftstack.io/legal/aup/.

“Effective Date” means the day a version of a document takes effect. For a given Customer, the Effective Date with respect to that Customer is the later of (a) that day or (b) the timestamp of Customer’s most recent recorded acceptance of that document version.

“Launch” means the day on which Driftstack publishes, on this Definitions page, a notice, dated that day, that the Service is generally available. Before that day it is “before Launch”; from that day on it is “after Launch”.

“Acceptance” means a Customer-attributed event recorded by the API endpoint POST /v1/legal/accept carrying account_id, document_key, version, content_hash, and accepted_at. A Major version bump requires a new Acceptance: until Customer records one, the Service shows the new version for review in the dashboard and does not issue new API Keys to Customer, while Customer’s existing API Keys and Sessions keep working. Customer’s continued use of the Service after the new version’s Effective Date constitutes Acceptance of the new version (Section 15.2 of the Terms of Service); after Launch, a Customer that does not accept it may terminate the Subscription as Section 15.3 of the Terms of Service provides.

“Material Change” means a change to a Document that materially alters Customer’s rights, obligations, or fees, or changes the Service’s offered jurisdictions. Adding, replacing or removing a Sub-processor is not a Material Change: it follows the notice and objection mechanism in Section 3.4 of the DPA. After Launch, Material Changes are released as Major version bumps and require a new Acceptance.

Default conventions

When a document references a duration without specifying a basis, the duration runs from the event being referenced (e.g. “14 days” in the context of a sub-processor objection runs from the date Driftstack notifies Customer of the new sub-processor).

When a document references “written notice”, written includes electronic notice (email, in-product banner, API response surface) and notice posted at the public URL of the document. Postal mail is sufficient but not required.

When a document is silent on an obligation, the GDPR / AVG / Dutch Civil Code default applies to the Driftstack-Customer relationship.

When a Customer’s national law mandates a more protective regime than this document set provides, the more protective regime controls for that Customer.