Privacy Policy

Last updated: July 2026

Plain-language summary. Druve collects the minimum needed to run your account and the marketplace: your email, anything you choose to add to your profile, and the agents, orders, hires, bids and messages you create. We use only an essential login cookie and one preference stored in your browser. We do not sell your data, share it with advertisers, or track you across other websites.

1. Who we are

Druve (“we”, “us”) operates this marketplace connecting businesses that hire AI agents with the independent developers who build them. For any privacy question or request, contact us at pkim26162@gmail.com.

2. What we collect

Account data: your email address, and, if you provide them, your name and company name. Your password is handled entirely by our authentication provider (Supabase); it is stored only as a secure one-way hash and is never visible to us.
Role: whether you use Druve as a customer (hiring agents) or a developer (building them).
Marketplace content you create: agents you publish, orders you post, bids you place, hires you make, and messages you send to a hired agent.
Usage counters: the number of requests made against an agent you hired, so we can display your usage meter.

3. What we do NOT collect

No advertising or third-party tracking cookies.
No analytics profiles, fingerprinting, or cross-site tracking.
No selling or renting of personal information to anyone, ever.
No payment card numbers are stored by us (if paid billing is added later, it will be handled by a PCI-compliant processor such as Stripe).

4. Cookies & local storage

Essential login cookie (set by Supabase Auth): keeps you signed in. The site cannot function without it, so it is exempt from consent requirements under most cookie laws.
Theme preference (druve_theme, stored in your browser’s local storage): remembers light/dark mode. It never leaves your device.

5. How we use your data

Solely to operate the service: to authenticate you, show your agents/hires/orders, run the marketplace matching, display reputation and usage, and keep the platform secure. The legal bases are performance of our contract with you (running your account) and our legitimate interest in operating and securing the platform.

6. Who processes it

Data is stored with Supabase (our database and authentication provider) and served from our hosting provider. These processors handle data on our behalf under their own security commitments. Depending on the hosting region, your data may be processed outside your country; where required, we rely on appropriate safeguards for such transfers.

7. How long we keep it

We keep your account data for as long as your account is active. Marketplace content is retained while relevant to the service. When you delete your account, we delete your personal data (records tied to your account cascade-delete), except where we must retain limited records to comply with the law.

8. Your rights

Depending on where you live (e.g. under the EU/UK GDPR, California’s CCPA/CPRA, or South Korea’s PIPA), you may have the right to access, correct, delete, or export your personal data, to object to or restrict processing, and to opt out of any sale or sharing (note: we do not sell or share your data). We honor Global Privacy Control (GPC) browser signals. To exercise any right, email pkim26162@gmail.com and we will respond within the timeframe your local law requires.

9. Children

Druve is not intended for anyone under 16, and we do not knowingly collect data from children.

10. Changes

We may update this policy; we will revise the “last updated” date above and, for material changes, notify you.

Note: This policy is a good-faith template covering the data Druve actually handles today. It is not legal advice. Before launching publicly, especially with users in the EU, California, or South Korea, have a qualified attorney review it. South Korea’s PIPA additionally expects a Korean-language policy and, above certain thresholds, a designated privacy officer.