We care about your privacy

This privacy policy explains how DrumKit Labs Ltd (“DrumKit”, “we”, “us”) collects, uses and shares personal information when you visit drumkit.design, use the DrumKit design tool and its plugins, or otherwise deal with us. It applies to our website, our desktop and browser apps, our community forum and the emails we send. It does not cover third-party sites we link to, which have policies of their own.

We wrote this document to be read. Where the law lets us choose, we collect less, keep it for less time and explain more. If anything here is unclear, or you think we have fallen short of it, the last section tells you how to reach us. This policy is current as of 20 Jan 2027 and replaces every earlier version.

What information do we collect?

Account details. When you sign up we ask for a name, an email address and a password, or a token from the identity provider you sign in with. If you join a paid plan we also take a billing address and a payment method, which our payment processor stores on our behalf; DrumKit never sees your full card number.

Content and usage. The files you create, the comments you leave, the libraries you publish and the people you share them with are stored so that the tool works and your team sees the same thing you see. Alongside that we record how the product is used: which features are opened, how long a session lasts, what errors occur and which browser, operating system and screen size you are on. This is collected under a pseudonymous identifier and is used in aggregate.

Information from other sources. If your workspace was created by an administrator at your company, they may give us your name and work email to invite you. If you install a community plugin, its author may ask for permissions that we show you before you accept. We do not buy personal information from data brokers and we do not enrich your profile from social networks.

How do we use your information?

To run the service. Signing you in, syncing your files across devices, rendering previews, delivering notifications you have asked for and charging the plan you chose all depend on the information above. This is the core of our contract with you, and most of what we collect goes no further.

To keep it safe and make it better. We look at usage patterns to spot abuse, outages and slow paths, to decide which features to build next and to test changes on a fraction of workspaces before everyone gets them. We may email you about a security incident, a change to these terms or a feature that is directly relevant to how you use DrumKit; you can turn off everything except the security and legal notices in Settings, then Notifications.

With your consent. Anything beyond the two purposes above, such as a case study naming your company, a quote in our marketing or a research interview, happens only if you say yes, and you can withdraw that yes at any time by writing to us. We do not sell personal information and we do not show third-party advertising anywhere in DrumKit.

Do we use cookies and other tracking technologies?

Yes, sparingly. A session cookie keeps you signed in and a preference cookie remembers your theme and language. Our analytics runs on our own domain, sets no cross-site cookies and strips IP addresses before storage. Marketing pages may load an embedded video or a map from a third party; those providers set cookies of their own only after you click to play or interact, and the cookie banner lets you refuse them without losing anything in the tool.

How long do we keep your information?

For as long as your account exists, plus a short tail. Files you delete go to a trash you can empty yourself and are purged 30 days after that. When you close an account we remove personal information within 30 days, keep invoices for the seven years tax law requires and hold anonymised usage statistics indefinitely, because they no longer identify anyone. Backups roll over within 90 days.

How do we keep your information safe?

Data is encrypted in transit and at rest, access inside DrumKit is limited to the engineers who need it for their job and is logged, and every employee completes security training on joining and each year after. We run an external penetration test annually and a public bug bounty all year round. No system is perfect: if we ever learn of a breach that affects you, we will tell you and the relevant regulator without undue delay, and in any case within 72 hours of confirming it.

What are your privacy rights?

Wherever you live, you can ask us for a copy of the personal information we hold about you, have it corrected or deleted, take it with you in a machine-readable format, and object to or restrict how we use it. Most of this you can do yourself from Settings, then My details, where Export data and Delete account are one click each. Residents of the EEA, the United Kingdom, California and other places with data protection law may also complain to their local authority; we would rather you came to us first so we can put things right.

How can you contact us about this policy?

Our data protection officer reads every message sent to privacy@drumkit.design and answers within five working days. You can also write to DrumKit Labs Ltd, 4 Beat Street, Manchester M1 2AB, United Kingdom. When you get in touch, it helps if you:

1. Write from the email address on your DrumKit account, so we can verify it is you.
2. Tell us which right you are exercising and, if it concerns specific files or a specific workspace, name them.
3. Let us know if a deadline applies, for example a legal proceeding, so we can prioritise it.