Privacy Policy

Overview

This policy covers drate.app, the Drate dashboard, and the websites creators run on Drate, including sites on a creator’s own domain. It applies alongside our Terms of Service. The data controller is Drate.

On a creator’s site, the creator decides what to publish and sell and is responsible for their relationship with their members. Drate processes member data to operate that site on the creator’s behalf.

What we collect

Information you give us.

• Account details: name, email, password (stored hashed), a phone number if you sign in with one, or your Google or Apple account identity if you sign in that way
• Billing details: handled by Stripe; we never see or store your full card number
• Creator details: payout information collected by Stripe when a creator connects their Stripe account
• Patreon details: if you connect Patreon, your Patreon identity and membership tier, so the right access can be granted
• YouTube and TikTok details: if a creator connects YouTube or TikTok to share their videos, the channel or account name and picture, and encrypted access that lets Drate upload the videos they choose
• Content: sites, pages, posts, media and files creators publish; posts, replies and likes in a community; messages between a creator and their members; and anything you submit through forms such as a contact request
• Orders: if you buy a physical product from a creator’s shop, the shipping details needed to deliver it

Information collected automatically.

• Device data: browser type and operating system, used for compatibility and debugging
• Logs: server logs and error reports, which may include your IP address and the request that failed
• Playback position: where you stopped in audio or video on a creator’s site, so you can pick up where you left off
• Visit statistics: when a page on drate.app or on a creator’s site loads, the page’s address, the site that linked to it, your country and your kind of device (desktop, phone or tablet). On a creator’s site these are recorded without cookies, IP addresses or account details and shown to the creator only as totals
• drate.app visit records: on Drate’s own pages (drate.app, not creator sites) we also record your IP address, the approximate location (city and region) and network it belongs to, and your browser’s user agent. This shows Drate how people find and use drate.app, page by page, and helps us spot abuse. Only Drate staff can see these records. They use no cookies and aren’t linked to your account

Visit statistics and drate.app visit records are kept for three months.

How we use it

• To provide the Service: host creator sites, deliver member content, process memberships and purchases, and grant the access each plan includes
• To keep the Service safe: detect fraud, abuse, and attacks
• To improve the product: understand where things break
• To communicate: transactional email such as sign-in links, receipts and security notices, and messages a creator sends to their own members
• To comply with legal obligations, including tax and accounting requirements

We don’t sell your personal information, and we don’t show third-party advertising.

Who can see what

A creator can see the members of their own site: name, email, membership status and the activity members take on that site, such as community posts and messages to the creator. Creators don’t see members’ passwords or full card details, and they don’t see what you do on other creators’ sites.

AI features and your data

When a feature uses AI to generate a draft, the relevant context (for example a creator’s public brand details and the direction they typed) is sent to our model provider to generate the result. We use providers under terms that prohibit them from training their models on this data. Drate doesn’t use your private content or conversations to train AI models either.

Cookies and sessions

We use a small number of first-party cookies: a session cookie that keeps you signed in, a cookie that remembers you unlocked a password-protected site, and preferences such as light or dark appearance. We don’t use third-party advertising or cross-site tracking cookies. Blocking cookies will break sign-in but leaves public browsing intact.

Creators can embed video from services such as YouTube or Vimeo. When you play an embedded video, that service may set its own cookies under its own privacy policy.

When we share data

We share data only with the providers needed to run the Service:

• Stripe: payment processing and creator payouts
• Cloudflare: hosting, storage, and content delivery; your data is processed on Cloudflare’s network
• Email and text message delivery providers: to send sign-in links, receipts and other transactional messages
• AI model providers: to generate drafts for AI features, as described above
• Fulfillment providers: to print and ship physical products ordered from a creator’s shop

Beyond that, we share data when you direct us to (for example, when you connect Patreon or a booking calendar), with the creator whose site you join as described above, when required by law, or as part of a merger or acquisition, in which case this policy continues to apply to data collected before the change.

YouTube and TikTok

Creators can connect a YouTube channel or a TikTok account to share their own videos from Drate.

• Drate uses YouTube API Services. When you connect YouTube, the Google Privacy Policy also applies, and you agree to the YouTube Terms of Service.
• Drate reads the channel or account name and picture, uploads only the videos you choose to share with the title, description and settings you choose, and reads their processing status to show you progress. It doesn’t read your other videos, comments or analytics.
• Access is encrypted and used only for these uploads. We don’t share it, or anything we receive from YouTube or TikTok, with anyone else.
• Disconnecting in Drate removes Drate’s access and deletes what we stored about the account within seven days. You can also remove Drate’s access in your Google account’s security settings or in TikTok’s app permissions. Videos you’ve already shared stay on YouTube or TikTok until you remove them there.
• Questions go to support@drate.app.

Data retention

We keep your data while your account is active. When you delete your account, we delete or anonymize your personal information within 30 days, except records we’re legally required to keep (such as transaction records for tax purposes) and residual copies in backups, which expire on their normal rotation.

Security

Data is encrypted in transit and at rest. Passwords are hashed, never stored in plain text. Access to production data is restricted. No system is perfectly secure. If we learn of a breach affecting your personal data, we’ll notify you without undue delay.

Found a vulnerability? Report it to support@drate.app.

Your rights

Depending on where you live (including under GDPR and CCPA), you may have the right to:

• Access a copy of the personal data we hold about you
• Correct inaccurate data
• Delete your data
• Export your data in a portable format
• Object to or restrict certain processing

To exercise any of these, email support@drate.app and we’ll respond within 30 days.

Children

Drate is not directed at children under 16, and we don’t knowingly collect their personal information. If you believe a child has created an account, contact us and we’ll delete it.

Changes to this policy

We’ll update this policy as the Service evolves. Material changes get notice by email or in-product before they take effect, and the date at the top always reflects the latest revision.

Contact

Questions about privacy at Drate? Email support@drate.app.