Privacy Policy

1. Introduction & scope

This Privacy Policy explains how Driva ("Driva", "we", "us") collects, uses, and shares information through the Driva web application and the Driva Chrome extension (together, the "Service"). It applies to anyone who creates a Driva account or installs the extension.

2. Data we collect

• Account data: your email address and password. Passwords are handled and hashed by our authentication provider, Supabase — we never store passwords in plain text. We also store which organisation/team you belong to.
• Prospect data: names, job titles, companies, and related fields entered in the web app, or read directly from the Orum dialler interface by the Chrome extension while you are on an active call.
• Content data: call script templates and knowledge-base material your organisation uploads.
• Billing data: processed by Stripe. We do not store your card number — we retain a Stripe customer ID, subscription status, and billing currency (GBP).
• Usage/technical data: basic request and error logs used to operate and troubleshoot the Service.

3. How we use data

We use this data to generate cold-call scripts (including pre-generating scripts for your next queued prospect), operate your team's workspace, process billing, and provide support. We do not sell personal data, and we do not use your account or prospect data for advertising.

4. AI processing & subprocessors

To generate scripts, prospect and template data is sent to OpenAI and Anthropic, and web research queries are sent to Tavily. We rely on these providers' API terms, under which data submitted via their APIs is not used to train their general models. Authentication and database hosting are provided by Supabase; payments are processed by Stripe.

5. Chrome extension data handling

The Driva Chrome extension requests the following permissions, used only as described:

• Host access to app.orum.io / *.orum.io: used solely to read the current and next prospect shown on screen in the Orum dialler, so a script can be generated. The extension does not modify Orum, does not capture call audio, and does not run on any other site.
• Side panel: used to display the generated script next to your call. No data is collected beyond what's needed to render it.
• Storage: used to keep your sign-in session and a few local preferences (such as your selected template) in the browser.

The extension sends prospect data only to Driva's own backend, which then calls the AI providers listed above. It does not collect your general browsing history.

6. Legal basis & roles

Where UK/EU data protection law applies: for prospect data you or your organisation upload or capture through the Service, Driva acts as a processor on behalf of your organisation (the controller). For your own account and billing data, Driva acts as the controller. We process data on the basis of our contract with your organisation and our legitimate interests in operating and securing the Service.

7. Data retention & deletion

We retain account, prospect, and script data for as long as your organisation's account is active. On request, or on account closure, we delete or anonymise this data within a reasonable period, except where we're required to retain it for legal or accounting purposes.

8. Security

Data is encrypted in transit. Authentication and session management are handled by Supabase. Access to production data is limited to what's needed to operate the Service.

9. Your rights

You may request access to, correction of, or deletion of your personal data by contacting us below. If you are a prospect whose details were uploaded or captured by a Driva customer, please contact that organisation directly, as they control that data.

10. Children's privacy

The Service is intended for business use and is not directed at, or knowingly used by, children under 18.

11. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the effective date above.

12. Contact

Questions about this policy? Contact us at privacy@driva.com.