Drivetrain Privacy Notice

Effective Date: April 1, 2023
Last Updated on: July 31, 2026
‍
This privacy notice ("Notice") explains how Drivetrain AI, Inc. and its affiliates or subsidiaries ("Drivetrain", "We", "Us", or "Our") collect, use, disclose, retain, and otherwise process Personal Data. This Notice applies where Drivetrain acts as a Controller in relation to Personal Data collected through its Website(s), marketing activities, billing, recruitment, demo requests, events, support, and other business interactions. Where Drivetrain processes Personal Data contained in Service Data on behalf of a Subscriber or customer through the Service(s), Drivetrain acts as a Processor or service provider, and such processing is governed by the applicable agreement, Terms, and Data Processing Agreement, as applicable.
‍
1. DEFINITIONS
‍
Terms not specifically defined herein shall have the meaning ascribed thereto in the Terms.
‍
1.1. “Controller” means the natural or legal person, public authority, agency, or other body
which alone or jointly with others, determines the purposes and means of the processing of Personal
Data.
‍
1.2. “End-User” means any person or entity with whom the User interacts using the Service(s).
‍
1.3. “Personal Data” means any information relating to an identified or identifiable natural
person; an identifiable natural person is one who can be identified, directly or indirectly, in particular
by reference to an identifier such as a name, an identification number, location data, an online
identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic,
cultural or social identity of that natural person.
‍
1.4. “Processor” means a natural or legal person, public authority, agency, or other body which
processes Personal Data on behalf of the Controller.
‍
1.5. “Service(s)” shall have the meaning ascribed to it in the Terms.
‍
1.6. “Subscriber” means the natural or legal person that has subscribed to the Service(s) by
agreeing to the Terms or signing any other agreement for the subscription and use of the Service(s).
‍
1.7. “Terms” means the Terms of Service at https://www.drivetrain.ai/terms.

1.8. “Website(s)” means the websites owned and operated by Us including https://www.drivetrain.ai/

1.9. “Applicable Privacy Laws” means all applicable privacy, data protection, data security, and consumer privacy laws that apply to Drivetrain’s processing of Personal Data, including, where applicable, the CCPA as amended by the CPRA, U.S. state privacy laws, the GDPR, UK GDPR, Swiss DPA, and related implementing regulations.

1.10. “AI/LLM Provider” means any third-party artificial intelligence, machine learning, or large language model service provider engaged by Drivetrain to support AI-assisted features of the Service(s), including providers used for inference, summarisation, analysis, or generation of requested outputs.
‍
1.11. “AI-Assisted Features” means features of the Service(s) that use artificial intelligence, machine learning, large language models, automation, or predictive analytics to generate summaries, insights, forecasts, recommendations, or other analytical outputs.

1.12. “Customer Inputs” means  prompts, queries, instructions, metadata, contextual information, selected Service Data, or other information submitted or made available by a Subscriber, User, or authorised personnel for use with AI-Assisted Features.

1.13. “Service Data” means all electronic data, text, messages, emails, Personal Data, Customer Inputs, or other materials submitted to or processed through the Service(s) by or on behalf of a Subscriber, User, or End-User.

1.14. “U.S. State Privacy Laws” means applicable U.S. state consumer privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act and similar state privacy laws, as amended or replaced from time to time.
‍
1A. OUR ROLE AS CONTROLLER AND PROCESSOR
Drivetrain acts as a Controller when it determines the purposes and means of processing Personal Data collected through its Website(s), marketing, billing, recruitment, demo requests, events, support interactions, and similar business activities.
Drivetrain acts as a Processor or service provider when it processes Personal Data contained in Service Data on behalf of a Subscriber or customer through the Service(s). In such cases, the Subscriber or customer is responsible for providing applicable notices, obtaining required permissions, and responding to End-User privacy requests, and the processing is governed by the applicable agreement, Terms, and Data Processing Agreement.

2. HOW WE COLLECT, USE AND SHARE YOUR PERSONAL DATA
‍
2.1. PERSONAL DATA THAT YOU PROVIDE US
‍

2.3. If You provide Us with any Personal Data relating to other individuals, You represent that You
have the authority to do so, and where required, have obtained the necessary consent, and
acknowledge that it may be used in accordance with this Privacy Notice.
‍
2.4. In addition to the details provided in the table above, We may also share Your Personal Data with

  a. Our group entities and the companies that We will acquire in the future when they are
made a part of Our group entities to provide and improve Our Services

  b. Third Parties involved in a Corporate Transaction: If We become involved in a merger,
acquisition, or any form of sale of some or all its assets, then, in accordance with
applicable laws, We will use reasonable efforts to notify You of any transfer of Personal
Data to an unaffiliated third party.
‍
  c. Law enforcement authorities, government authorities, courts, dispute resolution bodies,
regulators, auditors, and any party appointed or requested by applicable regulators to
carry out investigations or audits of Our activities.
‍
  d. Professional advisors who advise and assist Us in enforcing Our contracts and policies,
handling Our claims, effective management of Our company and in relation to any
disputes We may become involved in.

2.5. AI-Assisted Features and Service Data. Certain AI-Assisted Features may involve limited processing of Customer Inputs, prompts, metadata, contextual instructions, or selected inputs by Drivetrain and authorised AI/LLM Providers solely to generate requested analytical outputs, summaries, insights, forecasts, recommendations, or related assistance functionalities.
Drivetrain does not use Service Data, Customer Data, or Customer Inputs to train, fine-tune, or improve generalized artificial intelligence or machine-learning models unless expressly authorised in writing by the applicable Subscriber or customer.
Authorised AI/LLM Providers may retain Customer Inputs or related usage information for limited periods for legal, security, abuse monitoring, compliance, or operational purposes, but such data is not used for generalized model training where prohibited by applicable enterprise/API arrangements.
‍
3. LEGAL BASIS FOR PROCESSING
‍
3.1. Where required by Applicable Privacy Laws, Our legal basis or lawful basis for collecting and using Personal Data will depend on the Personal Data concerned and the context in which it is collected. We may process Personal Data where: (a) it is necessary to perform a contract or provide the Service(s); (b) it is necessary for Our legitimate business interests, provided such interests are not overridden by applicable data protection rights; (c) You have provided consent; or (d) processing is necessary to comply with legal obligations. Where We rely on consent, You may withdraw consent at any time, subject to lawful processing already undertaken before withdrawal.
‍
3.2. If You have questions or need further information concerning the legal basis on which We collect
and use Your Personal Data, please contact Us using the contact details provided under clause 11.

4. INTERNATIONAL TRANSFER
‍
4.1. We mainly process Personal Data in the United States. Personal Data may also be accessed or processed in other jurisdictions where Drivetrain, its affiliates, personnel, service providers, Sub-processors, or AI/LLM Providers operate, for the purposes described in this Notice, the Terms, and any applicable Data Processing Agreement.
‍
4.2. Where required by Applicable Privacy Laws for cross-border transfers, Drivetrain uses appropriate safeguards, which include, as applicable, contractual protections, standard contractual clauses, data processing agreements, technical and organisational measures, and other lawful transfer mechanisms. For customer Service Data processed on behalf of a Subscriber or customer, transfer safeguards are governed by the applicable Data Processing Agreement and any incorporated transfer mechanism.

5. RETENTION OF PERSONAL DATA
‍
5.1. We retain Personal Data for as long as reasonably necessary to fulfil the purposes described in this Notice, provide and secure the Service(s), comply with legal, tax, accounting, security, and compliance obligations, resolve disputes, enforce agreements, and maintain business records. This Section 5.1 applies to Personal Data Drivetrain processes as a Controller. Retention of Personal Data contained in Service Data processed on behalf of a Subscriber or customer is governed by the Terms and applicable Data Processing Agreement.
‍
5.2. When Personal Data is no longer required, We will delete, anonymise, aggregate, or securely isolate it from further processing, unless continued retention is permitted or required by applicable law. Retention and deletion of Service Data processed on behalf of a Subscriber or customer will be governed by the applicable Terms and Data Processing Agreement. Customer Inputs processed by AI/LLM Providers may be retained by such providers for limited periods for legal, security, abuse monitoring, compliance, or operational purposes, subject to applicable enterprise/API terms and data protection commitments.
‍
6. SECURITY OF PERSONAL DATA
‍
We use appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Such measures may include access controls, authentication controls, encryption in transit and at rest, logging and monitoring, vulnerability management, incident response procedures, confidentiality obligations, vendor/sub-processor controls, and other safeguards appropriate to the nature of the processing. No method of transmission or storage is completely secure, and We cannot guarantee absolute security.
‍
7. YOUR RIGHTS
‍
You are entitled to the following rights:

7.1. You can request access from Us and correction of Your Personal Data.

7.2. If We have collected and processed Your Personal Data with Your consent, then You can
withdraw your consent at any time. Withdrawing Your consent will not affect the lawfulness of
any processing We have conducted prior to Your withdrawal, nor will it affect processing of Your
Personal Data conducted in reliance on lawful processing grounds other than consent.

7.3. You have the right to complain to a data protection authority about Our collection and use of
Your Personal Data. For more information, please contact Your local data protection authority.

7.4. You have the right to opt-out of marketing communications We send You at any time. You can
exercise this right by clicking on the “unsubscribe” or “opt-out” link in the marketing emails We
send You. To opt-out of other forms of marketing (such as postal marketing or telemarketing),
please contact Us.

7.5. If You are a resident of the EEA, UK, or Switzerland, You are also entitled to the following
rights:
    a. You can request that We delete or erase of Your Personal Data.

    b. You can object to the processing of Your Personal Data, ask Us to restrict processing of
Your Personal Data or request portability of Your Personal Data.

7.6. If You seek to exercise Your rights under this clause, please contact Us at the details provided in
clause 11. We will verify any requests before acting on the request and respond to all requests We
receive from individuals wishing to exercise their data protection rights within a reasonable
timeframe in accordance with applicable data protection laws.
‍
7.7. If You are a resident of a jurisdiction that provides additional privacy rights under applicable U.S. state privacy laws, You may have rights to request access to, correction of, deletion of, or portability of certain Personal Data, and to opt out of certain processing activities where applicable. We will process such requests in accordance with Applicable Privacy Laws and may verify Your identity before acting on a request.
‍
7.8. Drivetrain does not sell Personal Data in the ordinary meaning of that term. Where Applicable Privacy Laws define “sale,” “sharing,” or targeted advertising broadly, We will provide applicable choices or opt-out mechanisms where required by law.
‍
8. COOKIE POLICY
‍
  8.1. Cookies are text files that are placed on Your computer to collect standard internet log
information and visitor behaviour information by Us. When You visit the Website(s), We may collect
Personal Data automatically from You through cookies or similar technology. We also set cookies to
collect information that is used either in aggregate form to help Us understand how Our Website(s) is
being used or how effective Our marketing campaigns are, to help customise the Website(s) for You
or to make advertising messages more relevant to You.

  8.2. Essential Cookies: We set essential cookies that enable core functionality such as security,
network management, and accessibility. You may not opt-out of these cookies. However, You may
disable these by changing Your browser settings, but this may affect how the Website(s) functions.

  8.3. Analytics, Customisation and Advertising Cookies: We set these cookies to help Us improve
Our Website(s) by collecting and reporting information on how You use it. The cookies collect
information in a way that does not directly identify anyone.
‍
  8.4. When You visit the Website(s), a cookie banner or preference mechanism may be displayed providing additional information about cookies and options to manage or opt out of non-essential cookies as required by Applicable Privacy Laws. You may also adjust browser settings; however, disabling certain cookies may affect Website functionality.
‍
9. PRIVACY OF CHILDREN
‍
  9.1. We recognize the importance of children's safety and privacy. Our Website and Services are not directed to children. We do not knowingly collect Personal Data from children where prohibited by Applicable Privacy Laws including children under 13 where applicable law uses a lower threshold. If a parent or guardian becomes aware that his or her child has provided Us with Personal Data, they should write to us at the email address provided in clause 11.
‍
10. NOTICE TO CUSTOMER AND OTHER EXCLUSIONS
‍
 10.1. Other than Personal Data collected for the purposes set forth in Clause 2 for which Drivetrain acts as a Controller, Drivetrain  acts as a Processor or service provider for Personal Data contained in Service Data collected from, transmitted by, or processed on behalf of a Subscriber or customer through the Service(s). Such processing is governed by the applicable agreement with the Subscriber or customer, including the Terms and any applicable Data Processing Agreement. Where the Service(s) are made available to an End-User through a Subscriber or customer, that Subscriber or customer is the Controller or business responsible for the End-User’s Personal Data. End-Users should direct privacy questions or requests relating to Service Data to the relevant Subscriber or customer. Drivetrain is not responsible for Subscribers’ or customers’ privacy or security practices, notices, or legal obligations, which may differ from this Notice.
‍
  10.2. Our Website(s) contain links to other websites. Our Notice applies only to our Website(s), so
if You click on a link to another website, You should read their privacy notice. We encourage You to
review the privacy statements of any such other websites to understand their Personal Data practices.
‍
11. CONTACT INFORMATION
‍
You may contact Our privacy officer if You have any enquiries or feedback on Our personal data
protection policies and procedures, or if You wish to make any request, in the following manner:

Kind Attention: Chief Information Security Officer
‍
Email Address: privacy@drivetrain.ai

Address: 131 Continental Drive Suite 301 Newark, Delaware 19713, USA

12. CHANGES TO THE NOTICE
‍
We keep this Notice under regular review and may update this webpage at any time. This Notice may
be amended at any time and You shall be notified only if there are material changes to this Notice.

13. AI-ASSISTED FEATURES

13.1. Drivetrain’s Service(s) may include AI-Assisted Features designed to support financial planning, forecasting, reporting, summaries, insights, analytics, and related assistance functionalities. Outputs generated through AI-Assisted Features are provided for decision-support purposes and should be reviewed by the Subscriber, customer, or authorised User before reliance or implementation.
13.2. Drivetrain may use authorised AI/LLM Providers, including OpenAI, Anthropic, and Google, to support AI-Assisted Features. Such providers are used under enterprise/API arrangements that restrict or prohibit use of Service Data and Customer Inputs for generalized model training purposes.
13.3. Customer Inputs, prompts, metadata, contextual instructions, selected Service Data or selected inputs may be transmitted to authorised AI/LLM Providers solely to generate requested outputs. Such providers may retain prompts or related usage information for limited periods for legal, security, abuse monitoring, compliance, or operational purposes, but such data is not used for generalized model training where prohibited under the applicable enterprise/API arrangements.
13.4. Drivetrain does not use Service Data or Customer Inputs to train, fine-tune, or improve generalized artificial intelligence or machine-learning models unless expressly authorised in writing by the applicable Subscriber or customer.