GDPR Compliance

Last updated: January 20, 2026

Our Commitment to GDPR

DripScribe is committed to compliance with the General Data Protection Regulation (GDPR) and protecting the rights of individuals in the European Economic Area (EEA).

How We Comply with GDPR Principles

1. Lawfulness, Fairness, and Transparency

Clear privacy policy explaining our processing
Lawful basis for all processing activities
Transparent communication about data use

2. Purpose Limitation

Data collected for specified, explicit purposes
Not processed incompatibly with those purposes
Clear documentation of processing purposes

3. Data Minimization

Only collect data necessary for our services
Regular reviews of data collection practices
Options to limit data sharing

4. Accuracy

Users can update their information
Regular data quality checks
Prompt correction of inaccuracies

5. Storage Limitation

Defined retention periods for all data types
Automatic deletion of outdated data
Regular retention policy reviews

6. Integrity and Confidentiality

Encryption at rest and in transit (AES-256, TLS 1.3)
Access controls and authentication
Regular security assessments
Employee confidentiality agreements

7. Accountability

Documented compliance measures
Data Protection Officer (if applicable)
Regular compliance audits
Privacy by design approach

Your Rights Under GDPR

As an EU resident, you have the right to:

Access

Request a copy of your personal data

Rectification

Correct inaccurate data

Erasure

Request deletion ("right to be forgotten")

Portability

Receive data in machine-readable format

Restriction

Limit how we process your data

Object

Object to certain processing activities

Automated Decision Making

Not be subject to automated decisions

To exercise your rights: Email [email protected]

Data Processing Details

Contract: To provide our services
Legitimate Interests: Business operations, security
Consent: Marketing communications
Legal Obligation: Tax and legal requirements

We transfer data internationally using:

Standard Contractual Clauses (SCCs)
Adequacy decisions where applicable
Your explicit consent where required

We use carefully selected sub-processors:

Sub-processor	Purpose	DPA
AWS	Infrastructure	View DPA
OpenAI	AI Processing	View DPA
Anthropic	AI Processing	View DPA
Google	AI Processing	View DPA
Stripe	Payments	View DPA

All sub-processors are bound by Data Processing Agreements.

Security Measures

Technical Measures

End-to-end encryption
Regular penetration testing
Vulnerability scanning
Secure development lifecycle

Organizational Measures

Security training for all employees
Access on need-to-know basis
Incident response procedures
Regular security audits

Data Breach Response

Detection systems in place
72-hour notification to authorities
User notification for high-risk breaches
Documented response procedures

For Controllers (Our Customers)

When you use our service for your contacts:

You are the Controller
We are your Processor
Data Processing Agreement available
We assist with your compliance obligations

Contact Our Privacy Team

Email:
[email protected]

Response Time:
Within 30 days

Supervisory Authority

You have the right to lodge a complaint with your local supervisory authority:

List of EU Supervisory Authorities

Resources

Cookie Policy

Security Overview

Have questions about our policies?

We're here to help clarify any concerns you may have.

Contact Our Team

These policies are regularly reviewed and updated to ensure compliance with applicable laws.