Privacy Notice

1. Controller and contacts

Draimo is the platform and Maria is its AI Assistant. Draimo Inc is the controller for Draimo’s own purposes. Postal address and formal legal notices address: 410 Stewart Avenue, Ithaca, New York 14850, United States. Public privacy contact: celestine.kariuki@draimo.com.

2. Data we process

• Account and authentication data, including Firebase identity, email, display name, user ID and session/security data.
• Prompts, responses, conversation metadata, citations, uploaded files, extracted text, images, generated outputs, embeddings and execution events.
• Library, Co-Writer, ExamPredictor, Timetabler, organization, app-consent and agent activity data.
• Data from Google and Microsoft accounts you choose to connect (see section 5), WhatsApp identifiers/messages, payment and credit records, email/push data and support/security logs.
• Device, browser, IP and analytics data where actually collected; browser localStorage and cookies described in the Cookie Policy.

3. Purposes and legal bases

Draimo processes data to provide requested services, authenticate and secure accounts, process payments, run research and AI features, store files and outputs, operate integrations, provide support, prevent fraud, comply with legal obligations, and improve reliability and service quality. For users connecting from Kenya, privacy-minimised PostHog product analytics may be enabled by default on a regional basis to measure service use and improve the platform. This mode does not identify users, create person profiles, capture IP addresses, persist browser identifiers, record sessions or capture typed content. Users can turn this analytics activity off through Privacy settings. Users elsewhere receive the applicable consent or opt-out choice for the relevant technology and jurisdiction. Processing is not based on blanket consent to this notice. The lawful basis depends on the purpose and the user's relationship with Draimo.

Draimo records the text of the questions people ask, in the workspace and on the home page, and a small number of authorised staff may read them to fix problems, improve answers and keep the service safe. Questions asked on the home page are recorded without an account or IP address. The contents of uploaded files are not part of this record.

4. Providers and transfers

We identify service providers by company rather than publishing the names of the AI models they operate. Depending on the feature and your choices, Draimo may use Google (Firebase and Google APIs, including the Google Workspace connections in section 5), Microsoft (the Microsoft 365 connections in section 5), Supabase (database, storage and realtime infrastructure), Paystack (payments), DeepSeek (selected AI and research processing), Alibaba Cloud (selected file and document processing), Cloudflare (browser and web-research infrastructure), Tavily (web search and extraction), TypeSafe (checking that retrieved sources match a question), Resend (transactional email) and OneSignal (push notifications). A provider is involved only when the relevant feature is used or enabled; this list is not a claim that every provider receives data on every request. When a request is sent to an external AI service, the information needed for that request is processed by that company's service to return the result. That is a service-provider disclosure, not a claim that Draimo sells your data or that the provider receives data for unrelated purposes. We do not claim that data never reaches an AI provider. Processing locations, retention, training-use terms, DPAs and transfer safeguards are maintained in our provider register and updated as they are verified.

5. Google and Microsoft accounts you connect

You can connect Google services (Gmail, Calendar, Drive, Docs, Sheets, Slides, Contacts, Tasks) and Microsoft services (Outlook, OneDrive, Teams, To Do, OneNote, SharePoint). Each is connected only when you choose to, through Google's or Microsoft's own sign-in screen, which lists the permissions requested. You can leave any permission unticked, and that service then stays unconnected.

What Draimo does with that access: in Agent Mode, when you ask, Draimo reads the items needed to answer you (for example messages, events, files, notes or tasks) and creates or changes items you ask it to (for example an unsent email, an event, a document or a task). Anything that would reach another person, such as sending or replying to an email, inviting people to an event or posting a Teams message, is shown to you first and happens only after you confirm. Draimo does not read your accounts in the background.

What Draimo stores: your OAuth refresh and access tokens, encrypted with AES-256-GCM; the email address of the connected account; which services are connected; and a record of each action (which service, which action, when, and whether it worked), without the content. Content read from your accounts is used to answer the request it was read for, and is sent to the AI service provider handling that request, as described in section 4. Draimo's answer, which may quote it, is kept in your conversation history like any other answer, and you can delete it. Draimo does not build or keep a copy of your mailbox, calendar, files or notes, and does not sync them in the background; it fetches only what a request needs, when you make it.

Draimo does not sell this data, does not use it for advertising, does not use it to train AI models, and does not let people read it except where you ask for support with a specific item, for security or abuse investigation, or where the law requires it.

Draimo's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

You can disconnect any service at any time from Connected apps in Draimo or from the Apps Hub. Disconnecting deletes the stored tokens. For Google, Draimo also revokes its access with Google. Microsoft offers no way for an app to revoke itself, so to remove Draimo completely, also remove it at https://myaccount.microsoft.com. You can also remove Draimo's access at any time from your Google Account (https://myaccount.google.com/permissions).

6. Rights and requests

Depending on the applicable law, users may request access, correction, deletion, restriction, objection, portability, withdrawal of consent and information about automated decision-making. Requests may be submitted through the Privacy Centre when available or to celestine.kariuki@draimo.com. Identity verification may be required. The target response process is within one month for GDPR requests, subject to lawful extensions and local rules.

7. Retention and deletion

Draimo retains information only for as long as needed for the purpose collected, account operation, security, fraud prevention, legal obligations or dispute handling. Retention varies by data type and provider. Account deletion requests are handled through a controlled workflow, with legally required exceptions documented where applicable. Recorded questions are deleted after 90 days.

8. Children and sensitive data

Draimo's age requirements are stated during registration. Free-form prompts and uploads may contain special-category, education, employment or children’s data. Users should not submit such data unless the processing is lawful and necessary. Contact celestine.kariuki@draimo.com if you believe a child’s data has been submitted improperly.

9. AI and automated decisions

Draimo uses AI to generate responses, research, classifications and workflow assistance. It does not claim that outputs are decisions made by a human or that they are always accurate. High-impact decisions about people require human review and appropriate safeguards. Users may contact the privacy team about a decision or profile involving them.

10. Complaints and changes

Users in Kenya may contact the Office of the Data Protection Commissioner. EU/EEA users may complain to a competent supervisory authority. Contact Draimo at celestine.kariuki@draimo.com. This notice is versioned and changes will identify the affected processing.