Who are we?
Drummer is operated by Drummer BV (in formation), Generaal Lemanstraat 33 bus 201, 2018 Antwerpen, Belgium (“Drummer”, “we”, “us”).
Our privacy contact is Tijl Coenen. Siebe Cooreman, CTO and co-founder, is the contact for technical and security questions about personal data. You reach both at privacy@drummerhq.com.
Drummer has not appointed a data protection officer, because the law does not require one for our processing. Every privacy request goes to privacy@drummerhq.com.
What does this policy cover?
This policy explains how we handle personal data in the Drummer web app at app.drummerhq.com, the Drummer phone apps for iOS and Android, our sales and support conversations, and our website at drummerhq.com. The website has its own short section below.
A signed customer agreement and data processing agreement (“DPA”) govern how we process the data in a customer’s workspace. Where they differ from this policy, they prevail.
When are we the controller, and when the processor?
Drummer is the controller for:
- account and sign-in data of the people who use the apps;
- security and sign-in logs we keep to protect the service;
- support requests;
- billing and contract data of our customers;
- sales contacts: demo bookings and email with prospects;
- website visits.
Drummer is the processor for everything in a customer’s workspace: call recordings, transcripts, scores, comments, notes, CRM data and the contacts in it. The customer that uses Drummer is the controller of that data and decides why it is processed. We process it only on the customer’s documented instructions, under the DPA we sign with that customer before any business data is connected.
What data do we process, why, and on what legal basis?
| Purpose | Data | Legal basis |
|---|---|---|
| Give you an account and sign you in | Name, work email address, company, role, profile picture, a hashed one-time sign-in code, your Google account identifier and picture when you sign in with Google, session tokens | Performance of the contract with your organisation, and our legitimate interest in giving its users secure access (GDPR art. 6(1)(b) and (f)) |
| Keep the service secure and traceable | IP address, browser and device data, sign-in attempts, the record of who approved each change Drummer wrote to the CRM, application and database logs | Legitimate interest in protecting the service and our customers’ data (art. 6(1)(f)) |
| Find and fix errors in the apps | The error and where in the app it happened, browser or operating system, app version and device details, your user ID and company ID, IP address and the approximate location derived from it | Legitimate interest in keeping the apps working for our customers (art. 6(1)(f)) |
| Send sign-in codes and system email | Email address, name, the content of the email | Performance of the contract (art. 6(1)(b)) |
| Answer support requests | Your name, email address and what you tell us | Performance of the contract, and legitimate interest in helping our customers’ users (art. 6(1)(b) and (f)) |
| Bill our customers and keep our books | Company details, contact person, invoices and payments | Performance of the contract and legal obligation under Belgian accounting and tax law (art. 6(1)(b) and (c)) |
| Sell Drummer: demo bookings and email | Name, email address, company, the time you book, the answers you give when you book, and what you write to us | Steps you ask for before a contract, and our legitimate interest in answering business enquiries (art. 6(1)(b) and (f)) |
| Understand how the website is used | Cookieless page-view statistics, described in the website section | Legitimate interest in understanding how the website is used (art. 6(1)(f)) |
| Process workspace data for a customer | Recordings, transcripts, scores, comments, CRM data and contacts | The customer’s instructions under the DPA; the customer determines its own legal basis |
We do not sell personal data. We do not use it for advertising.
Were you on a recorded call?
If a Drummer customer recorded a call or meeting you took part in, that customer is the controller of the recording and everything derived from it. It is responsible for informing you before the recording starts and for its own legal basis.
Contact that company first. You can also write to privacy@drummerhq.com: we forward your request to the customer without undue delay and help it answer.
The Drummer meeting bot joins a meeting under a visible name, so every participant sees that it is there. The phone app starts recording when the user taps record; it asks nothing first. The user tells the people in the conversation that it is recorded, and the customer has a legal basis for recording it.
How do scores and AI use your data?
Scores, summaries, follow-up drafts and other AI output support managers and reps in coaching and selling. No decision with legal or similarly significant effect on a person is made solely by automated means in Drummer. A person reviews AI output before it reaches a customer or the CRM.
The employer that uses Drummer informs its staff, and its works council where one exists, before their calls are recorded and scored.
Customer data is never used to train models, ours or a provider’s. The AI models run in the EU.
Who receives your data?
Our team members receive the data they need for their task. The subprocessors below process data on our behalf, each under a written agreement that binds them to the GDPR. The list in a customer’s DPA is the binding one for workspace data.
| Subprocessor | Role | Region |
|---|---|---|
| Amazon Web Services | Hosting, storage, database and backups | EU (Frankfurt, eu-central-1) |
| Amazon Bedrock | AI models | EU |
| Google Cloud Vertex AI | Fallback AI models | EU |
| Soniox | Transcription | EU |
| Recall.ai | Meeting bot that records online meetings | EU (Frankfurt) |
| Postmark | Sign-in codes and system email | United States, under standard contractual clauses |
| Cloudflare | Bot protection on sign-in | Global network, under standard contractual clauses |
| PostHog | Error reports from the apps, and cookieless analytics on the website | EU |
| Google Workspace | Our email and demo bookings | EU and United States, under the EU-US Data Privacy Framework and standard contractual clauses |
We also disclose personal data when the law requires it, to a competent authority or court, or to establish or defend a legal claim. If Drummer or its business is acquired, the personal data we control moves to the acquirer under this policy.
Which integrations can a customer connect?
A customer can connect Google (for sign-in and calendars), Microsoft (for calendars), HubSpot, Salesforce, Microsoft Dynamics 365 and Teamleader. The customer chooses these services and holds its own agreement with them. They are not our subprocessors. When Drummer reads from or writes to them, it does so on the customer’s instruction, and that provider’s own terms and privacy policy apply to the data held there.
Where is your data stored?
Customer workspace data is stored and processed in the EU: on AWS in Frankfurt, with EU transcription, an EU meeting bot and AI models in the EU. Error reports from the apps go to PostHog in the EU.
Sign-in email (Postmark) and bot protection (Cloudflare) run under the European Commission’s standard contractual clauses. Our own email and demo bookings run on Google Workspace; data there can reach the United States under the EU-US Data Privacy Framework and standard contractual clauses.
How long do we keep your data?
| Data | Retention |
|---|---|
| Sales contacts and demo bookings | 24 months after our last contact |
| Support correspondence | 24 months after our last contact |
| Account data | As long as the account exists; then deleted with the workspace data |
| Workspace data (recordings, transcripts, scores, comments, CRM data) | Kept while the customer’s contract runs; deleted within 30 days after it ends, or earlier on the customer’s instruction. A user who deletes a call deletes its recording, transcript, scores and comments with it |
| Database backups | Roll off within a further 35 days |
| Application logs | Deleted within 90 days |
| Error reports from the apps | Deleted within 12 months |
| Database logs | Deleted within 365 days |
| Deleted files in storage | Removed within 60 days |
| Meeting media at the meeting-bot provider | Deleted as soon as we have copied it |
| Invoices and accounting records | As long as Belgian accounting and tax law requires |
What happens on our website?
The website has no forms. To book a demo, you click to open Google Calendar’s booking page; it loads only after that click, and from then on Google’s privacy policy also applies.
On the production website at drummerhq.com we measure visits with PostHog, hosted in the EU, in cookieless mode: it sets no cookies and uses no local or session storage. Your IP address and browser are combined into a hash with a salt that changes daily, and neither is stored. When your browser sends Do Not Track or Global Privacy Control, nothing is measured. We do this out of our legitimate interest in understanding how the website is used.
The website hosts its own fonts and images; it loads nothing from Google Fonts or another font or image service.
Which cookies and storage do we use?
We use only strictly functional cookies and storage. None of them is used for analytics, advertising or profiling, so they need no consent.
| Name | Where | Purpose | Duration |
|---|---|---|---|
drummer_access |
Web app | Keeps you signed in | Until you close the browser; the token inside expires after 15 minutes |
drummer_refresh |
Web app | Renews your session so you do not have to sign in again | 30 days |
| Sign-in tokens (device secure storage) | Phone apps | Keeps you signed in | 30 days, or until you sign out |
| Error reports (device storage) | Phone apps | Holds error reports until they are sent, a random ID for this installation, and your user ID while you are signed in | Reports until sent; your user ID until you sign out; the random ID until you delete the app |
lang |
Website | Remembers English or Dutch | One year |
| Theme (localStorage) | Website | Remembers light or dark mode | Until you clear it |
Do you have to give us your data?
To use Drummer you need an account, and an account needs your name and work email address. Booking a demo or writing to us is voluntary.
Drummer is a business tool. It is not intended for anyone under 16.
What are your rights?
You have the right to access, correct and delete your personal data, to restrict its processing, to receive it in a portable format, to object to processing based on legitimate interest, and to withdraw consent at any time without affecting earlier processing.
Write to privacy@drummerhq.com. We answer within one month. For a complex request we can extend that by two more months, and we tell you so within the first month. We ask for proof of identity only when we cannot otherwise confirm who you are.
For data in a customer’s workspace, the customer is the controller. We forward your request to it and help it answer.
You can complain to the Belgian Data Protection Authority, the Gegevensbeschermingsautoriteit (in French: Autorité de protection des données), at www.gegevensbeschermingsautoriteit.be, or to the supervisory authority where you live or work.
How do we change this policy?
The date at the top of this page changes with every update. The administrators of every customer workspace receive an email 30 days before a material change takes effect.
How can you contact us?
Email privacy@drummerhq.com, or write to Drummer BV (in formation), Generaal Lemanstraat 33 bus 201, 2018 Antwerpen, Belgium. Our security page describes how we protect your data, and our terms of service govern the use of Drummer.
Questions?
Contact your Drummer representative, or email privacy@drummerhq.com. Please do not include sensitive information.