About this agreement
This Data Processing Agreement ("DPA") is between Drry, Inc., a Delaware corporation ("Drry"), as processor, and the creator ("coach") who runs a community on Drry and has accepted Drry's Terms of Service ("Customer"), as controller or, where Customer processes personal data on behalf of its own clients, as processor. It sets out the terms Article 28 of the GDPR and similar laws require between a controller and its processor.
No signature, no request, no extra charge. This DPA is part of the Terms of Service (the "Agreement"). It applies automatically, between Drry and every coach who accepts the Terms, on every plan, at no extra charge, to the extent Drry processes personal data on Customer's behalf. It takes effect on the date Customer becomes bound by the version of the Terms that incorporates it (the "Effective Date"): for a new customer, when it accepts the Terms by creating an account or using Drry; for an existing customer, on the date that version of the Terms takes effect, which is the "Last updated" date the Terms show (October 30, 2026). Nobody has to sign it or ask for it.
Drry: Drry, Inc., 1522 Western Ave STE 93965, Seattle WA 98101, United States. Data protection contact: hello@drry.com.
Customer: the creator identified by the name and primary email address on the Drry account that accepted the Terms, and the Community it runs. Drry sends notices under this DPA to the primary email address on that account. If Customer's organisation needs a countersigned copy, or needs to use its own form, email hello@drry.com.
In running a Community, Customer collects and uses personal data about its members and others, and Drry processes some of that data for Customer. The parties agree as follows.
1. Definitions
1.1 Terms such as "controller", "processor", "personal data", "processing", "data subject" and "supervisory authority" have the meaning they have in Applicable Data Protection Law.
1.2 In this DPA:
- "Applicable Data Protection Law" means the laws on the protection of personal data that apply to the processing under this DPA, including Regulation (EU) 2016/679 ("GDPR"), the GDPR as it forms part of the law of the United Kingdom ("UK GDPR"), the Swiss Federal Act on Data Protection ("FADP"), and any other law on the protection of personal data that applies to that processing.
- "Community" means the community, website, funnels, events and other spaces Customer runs on Drry, at a drry.com address or at Customer's own custom domain.
- "Customer Personal Data" means personal data that Drry processes on behalf of Customer in providing the Services, as described in Annex I. It includes the content that members, leads, attendees and customers put into the Community.
- "Drry Account Data" means personal data that Drry processes for its own purposes as an independent controller, described in clause 2.3.
- "Member" means a person who has joined, or been added to, a Community.
- "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
- "Services" means the Drry platform and related services Drry provides to Customer under the Agreement.
- "Sub-processor" means a third party engaged by Drry that processes Customer Personal Data.
- "Standard Contractual Clauses" and "UK Addendum" have the meaning given in clause 12.
2. Roles and scope
2.1 Customer is the controller of Customer Personal Data, including the community content of its Members, or, where Customer processes it on behalf of its own clients, a processor of it (SCC Module Two or Module Three applies accordingly). Drry processes Customer Personal Data as Customer's processor, or as its sub-processor in that second case (called a service provider in some laws). This matches the Drry Privacy Policy, which says the coach is the controller of members' community content and that Drry processes it on the coach's behalf.
2.2 Annex I describes the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects.
2.3 Drry is an independent controller, and not Customer's processor, for the personal data it needs to run its own platform and business. This covers sign-in and account records, billing of Customer's own Drry plan, security and abuse prevention (including the platform-wide safety screening described in the Privacy Policy), and compliance with Drry's own legal obligations. Drry's Privacy Policy at drry.com/privacy governs that processing. This DPA does not.
3. Customer instructions
3.1 Drry will process Customer Personal Data only on Customer's documented instructions, unless required to do so by Union or Member State law to which Drry is subject. In that case Drry will inform Customer of that legal requirement before processing, unless that law prohibits it.
3.2 Customer's documented instructions are: (a) the Agreement and this DPA; (b) Customer's use and configuration of the Services, including features it switches on, such as AI moderation, Auto-DM, advertising pixels and server-side conversion events, Google or Instagram connections, and email broadcasts; and (c) further written instructions Customer sends to hello@drry.com that Drry accepts.
3.3 Drry will tell Customer if, in its opinion, an instruction infringes Applicable Data Protection Law. Drry may suspend the affected processing until Customer confirms or changes the instruction.
3.4 If a public authority, including a United States authority, demands Customer Personal Data from Drry under other laws, such as legal process, Drry will notify Customer where the law permits, will challenge a demand that is overbroad where it is reasonable to do so, and will disclose only the minimum the demand lawfully requires. This is consistent with Clause 15 of the SCCs, which governs where it applies.
3.5 Some safety processing is Drry's own and Customer cannot switch it off. Examples are the automated screening of photographs sent in direct messages and the background check of published pages and emails for phishing, malware and spam, both described in the Privacy Policy, and Drry's reporting to the National Center for Missing & Exploited Children where United States law requires it. Drry does this to meet its legal duties and to keep the platform safe, as described in clause 2.3.
4. Confidentiality of personnel
4.1 Drry will ensure that the people it authorises to process Customer Personal Data are bound by a duty of confidentiality.
4.2 Access to Customer Personal Data is limited to the people who run Drry, for purposes such as fixing a broken import or investigating a failed payment. Drry does not read a Community's posts or its Members' messages as a matter of course. The Privacy Policy sets out the limited cases in which messages are read (for example, a reported message goes to the coach, and AI moderation reads messages where Customer has switched it on).
5. Security measures
5.1 Drry will implement and maintain technical and organisational measures appropriate to the risk, taking into account the state of the art, the cost, the nature of the processing and the risk to data subjects. The measures in place at the Effective Date are described in Annex II.
5.2 Drry may update its measures from time to time, provided the update does not materially reduce the overall level of protection.
5.3 Customer acknowledges the limits stated in Annex II, Part B, which are the same limits Drry states on its Security page: Drry holds no SOC 2, ISO 27001 or equivalent certification, has had no third-party penetration test, and offers no uptime commitment.
6. Sub-processors
6.1 Customer gives Drry general written authorisation to engage the Sub-processors listed in Annex III. Some of them process Customer Personal Data only if Customer uses the feature they support, as Annex III shows.
6.2 Drry will give Customer notice of a new or replaced Sub-processor at least 30 days before the new Sub-processor processes Customer Personal Data, by email to the primary email address on Customer's Drry account. Drry will also update the Sub-processor list at https://drry.com/security, which shows the date it was last updated.
6.3 Customer may object to a new Sub-processor on reasonable data protection grounds by writing to hello@drry.com within 14 days of the notice. The parties will then discuss the objection in good faith. If Drry cannot reasonably accommodate the objection, Customer may stop using the affected feature or, as a last step, end the Agreement and delete its Community and account under clause 10. That route is Drry's contractual remedy for an unresolved objection, without prejudice to rights that cannot be waived under the GDPR or the SCCs. Drry is not required to refund anything beyond what the Terms of Service provide, and is not required to forgo the new Sub-processor.
6.4 Drry will bind each Sub-processor to data protection obligations that are materially the same as those in this DPA, and remains liable to Customer for the Sub-processor's performance of them.
6.5 A third party that Customer itself connects or directs Drry to send data to is not Drry's Sub-processor. Examples are an advertising network that receives server-side conversion events for Customer's pixel, an AI assistant Customer connects to its Community, and the Stripe account Customer holds in its own name. Customer's own agreement with that third party governs that data.
7. Data subject requests
7.1 Drry provides tools that let Customer and Members act on the data: a Member can erase their own account, Customer can delete a Community, and contacts and members can be exported to CSV. Customer is responsible for answering data subject requests addressed to it, using these tools where it can.
7.2 If Drry receives a request from a data subject that relates to Customer Personal Data and identifies Customer, Drry will, where it can, pass the request to Customer without undue delay and will not answer it itself except to refer the person to Customer, unless the law requires otherwise. This does not affect requests about Drry Account Data, which Drry answers as controller.
7.3 Taking into account the nature of the processing, Drry will give Customer reasonable help, by appropriate technical and organisational measures, in meeting its duty to answer requests to exercise data subject rights. Where Drry carries out a deletion at Customer's request that Customer cannot do itself, such as Instagram data under the deletion request process in the Privacy Policy, Drry will do so after confirming the request with the person who made it.
8. Personal data breach
8.1 Drry will notify Customer of a Personal Data Breach without undue delay after becoming aware of it, if the breach affects Customer Personal Data. Drry will send the notice to the email address on Customer's Drry account.
8.2 The notice will include the information Article 33(3) of the GDPR lists, as far as Drry then has it: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Drry may provide the information in phases and will update it as it learns more.
8.3 Drry will take reasonable steps to contain and investigate the breach and to help Customer meet its own duties to notify supervisory authorities and data subjects. Customer decides whether and how to notify them. Drry's notice is not an admission of fault.
9. Assistance with DPIAs and consultation
9.1 Taking into account the nature of the processing and the information available to it, Drry will give Customer reasonable help with data protection impact assessments and with prior consultation of a supervisory authority that relate to Customer's use of the Services. Drry will do this by supplying the information in this DPA, in Annex II and III and in its Security and Privacy pages, and by answering reasonable written questions.
10. Deletion or return of data
10.1 During the term. Customer can export its contacts and members to CSV from the Services, and can delete content, Members' memberships and the whole Community from inside the product. A Member can also erase their own account from inside the product.
10.2 Deletion, return and termination. Customer Personal Data stays in the Services while Customer's account exists. (a) When Customer deletes its account or Community through the in-product deletion mechanism, deletion from Drry's live systems happens then, subject to the exceptions in clause 10.3. (b) When Customer asks Drry by email, from the primary email address on its Drry account, to delete or return its Customer Personal Data, Drry will complete the request within 30 days. Return is through the in-product export where that covers the data, and otherwise in a common format. (c) When the Agreement ends or the Services end, including when Drry terminates Customer's account, Customer has 14 days after the end or termination to elect that Drry return the Customer Personal Data (by export) or delete it. Drry will complete the election, or delete the data if Customer makes no election, within 30 days after the end or termination in all. Anything Drry keeps afterwards is limited to what applicable law requires (clause 10.3), and stays protected under this DPA. (d) Moving to a free plan is not termination, and the data stays. Members' own Drry accounts are Drry Account Data under clause 2.3 and are not deleted by this.
10.3 What may remain. Drry may keep Customer Personal Data only where law applicable to Drry requires it, only to the extent and for the time that law requires, kept apart from any further use and protected under this DPA. The Privacy Policy gives one fixed example: material reported to the National Center for Missing & Exploited Children must be preserved for at least 90 days from the report, and a deletion request does not reach those records until the duty ends. Deletion is also held while Drry has paused a Community to look into a report, until that review ends. The suppression list of email addresses that hard bounced or complained is Drry Account Data under clause 2.3, and the text of direct messages stays as clause 10.4 describes. Backups and logs that Drry controls (PlanetScale backups, and Vercel and Sentry logs) are overwritten or expire no later than 30 days after deletion from the live systems. The email send log is the exception: when a person erases their account the recipient address is removed from its rows, but the rows (subject, time and status) are kept, and one shared copy of a bulk email is kept for its whole audience. For other Sub-processors, Drry will require deletion or expiry in line with their ordinary retention cycles, and makes no fixed-day promise for them.
10.4 How member erasure behaves. When a Member erases their account, their posts and comments are blanked and soft-removed with the author severed (so other people's replies keep their shape), and their likes, progress, notifications, entitlements and memberships are deleted. Direct messages are not removed: the Member's name is detached from them, but the text stays so that the other person's copy of the conversation is not damaged. Photographs and files the Member sent are deleted. When a Member only leaves one Community, the coach's own records, such as receipts and orders, signed agreements, form answers and the contact record with its marketing opt-out, stay with Customer. Customer, as controller, decides whether any of this must be erased further.
10.5 Under the Terms, Drry may optimise uploaded media (for example, compress images or convert video) and may not retain the original full-resolution file. Customer should keep its own copy of anything it needs at original quality.
11. Audits
11.1 Drry will first make available to Customer the information necessary to demonstrate that Drry complies with this DPA, including this DPA, the Security page, the Annexes, and written answers to reasonable questions. Drry holds no SOC 2, ISO 27001 or similar audit report and has had no third-party penetration test, so there is no such report it can hand over.
11.2 Customer may audit Drry's compliance with this DPA, itself or through an independent auditor bound by a duty of confidentiality, on at least 30 days' written notice to hello@drry.com. An audit may take place no more than once a year, unless a supervisory authority requires it or it follows a Personal Data Breach. It will take place during business hours, will be remote or document based first, will be at Customer's cost, and will not give access to other customers' data. The parties will agree its scope, timing and confidentiality terms in advance.
11.3 Nothing in this clause limits the rights of Customer and of supervisory authorities under Clause 8.9 of the SCCs, where they apply.
12. International transfers
12.1 Drry, Inc. is established in the United States, and Customer Personal Data is stored and hosted primarily in the United States, with the Sub-processors in Annex III. Cloudflare and Vercel deliver content and real-time traffic through their global edge networks, so data may transit or be briefly cached outside the United States while it is being served. Customer Personal Data is therefore transferred to and processed in the United States. Drry does not state that data is kept in any other region. Customer acknowledges this.
12.2 EU Standard Contractual Clauses. The standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the "SCCs") are incorporated into this DPA by reference. They apply where the processing of Customer Personal Data is subject to the GDPR and that data is transferred to Drry in the United States, or to any other country without an adequacy decision. Module Two (controller to processor) applies. Module Three (processor to processor) applies instead where Customer is itself a processor acting for another controller. The choices the SCCs leave open, and the details for their annexes, are set out in Annex IV. Nothing in this DPA is intended to contradict the SCCs. If there is a conflict, the SCCs prevail.
12.3 UK transfers. Where Customer Personal Data is subject to the UK GDPR and is transferred to Drry in a country without UK adequacy regulations, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner's Office, version B1.0, in force from 21 March 2022 (the "UK Addendum"), is incorporated by reference and completed as set out in Annex IV, Part 3.
12.4 Swiss transfers. Where Customer Personal Data is subject to the FADP, the SCCs apply as modified in Annex IV, Part 4, so that references to the GDPR mean the FADP, references to Member States mean Switzerland, and the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner ("FDPIC").
12.5 Drry does not rely on certification under the EU-US Data Privacy Framework for these transfers, and this DPA does not rely on such a certification.
12.6 Drry will transfer Customer Personal Data onward to a Sub-processor only under the terms of clause 6, and where Applicable Data Protection Law requires a transfer mechanism, only with one in place.
12.7 Clause 14 of the SCCs applies as the SCCs require. On request, Drry will give Customer the information it reasonably needs for Customer's own transfer assessment. The measures in Annex IV, Part 5 are the supplementary measures the parties rely on.
12.8 Electronic acceptance of the Terms, or becoming bound by the version of them that incorporates this DPA, is effective execution of this DPA, of the SCCs and of the UK Addendum where it applies, by both parties, as of the Effective Date. No separate or handwritten signature is needed.
13. Customer's responsibilities
13.1 Customer is responsible for: (a) having a lawful basis for collecting and using Customer Personal Data and for the instructions it gives Drry; (b) giving Members, leads and other data subjects the notices and, where needed, obtaining the consents that Applicable Data Protection Law requires; (c) having and keeping its own privacy policy and terms, which it can publish from the Legal section of its Studio at its own community's /privacy and /terms pages; and (d) having permission to email any contact it imports.
13.2 Advertising pixels. If Customer connects its own Meta, Google or TikTok pixel, or sends server-side conversion events to Meta or TikTok, Customer is the controller of that processing, its own privacy notice governs it, and the advertising network receives the data under Customer's own agreement with it. Customer is responsible for the consents that apply. Drry provides a consent control for visitors in the EU, EEA and UK, but Customer remains responsible for how it uses pixels.
13.3 Auto-DM and AI features. Customer decides whether to connect an Instagram account to Auto-DM and whether to switch on its AI features. Customer is responsible for the lawfulness of the messages it sends and for telling the people who comment or message about how their data is used.
13.4 Special categories. Drry does not intentionally collect special categories of personal data (such as health, religion or biometric data) and does not ask Customer to. Customer should not design forms, courses or features that collect such data from Members, and is responsible for any it does collect.
13.5 Payments. Card details go from the buyer to Stripe and do not reach Drry's servers. Payments are taken on a Stripe account in Customer's own name, and Stripe's own terms govern Customer's relationship with Stripe.
13.6 Customer is responsible for the security of its own account and for the people it gives console access to, and must keep the email address on its Drry account up to date, because that is where Drry sends notices under this DPA.
14. Liability, precedence and term
14.1 Term. This DPA starts on the Effective Date and lasts as long as Drry processes Customer Personal Data on Customer's behalf, including during any period of deletion under clause 10.
14.2 Liability. Each party's liability under this DPA is subject to the limits and exclusions in the section "Disclaimers and liability" of the Terms of Service. The limits in the Terms of Service do not apply to the extent they would conflict with the SCCs (including the liability between the parties under Clause 12 of the SCCs), the UK Addendum, or liability that cannot be limited by law. Nothing in this clause limits a party's liability to data subjects under the SCCs or the UK Addendum.
14.3 Order of precedence. If this DPA and the Terms of Service conflict on the processing of Customer Personal Data, this DPA prevails, except that the Terms of Service prevail on liability, as clause 14.2 says. If the SCCs or the UK Addendum apply and conflict with this DPA or the Terms of Service, they prevail.
15. Governing law
15.1 This DPA is governed by the law that governs the Terms of Service, which is the law of the State of Delaware, and disputes are decided by the courts the Terms of Service state. The SCCs and the UK Addendum, where they apply, are governed by the law stated in clause 12 and Annex IV.
Annex I. Description of the processing
1. Subject matter
Drry's provision of a platform on which Customer runs a membership community, including courses, a community feed, audio, direct messages, funnels and pages, email marketing, live events and webinars, bookings, and payments, together with the hosting, storage, delivery and support that go with it.
2. Duration
For as long as the Agreement is in force, and afterwards until deletion under clause 10. Drry does not publish fixed retention periods. Data stays until Customer or the data subject deletes it through the product, or the Community is deleted.
3. Nature and purpose
Hosting, storing, displaying, delivering, transcoding and backing up Customer Personal Data; authenticating Members; sending email and notifications Customer asks for; processing payment status and entitlements; running live sessions; transcribing published media; and, where Customer switches them on, AI moderation, voice-note transcription, meeting recaps, Auto-DM, advertising conversion events and calendar connections. Drry also gives Customer's console staff reports on how the Community is performing.
4. Categories of data subjects
- Members of the Community, and people who start to join.
- Leads and contacts, including people whose details Customer imports or who fill in a form or opt-in.
- Attendees and viewers of live events, webinars and bookings.
- Customers who buy from Customer.
- People who comment on, or message, a connected Instagram account that uses Auto-DM.
- Customer's own team members who have console access.
5. Categories of personal data
| Category | What it includes |
|---|---|
| Identity and contact | Email address; the community profile (display name, username, bio, avatar, cover photo and any optional profile fields). |
| Community content | Posts, replies and comments; audio; uploaded files and images; media (video and audio) and their transcripts; live chat messages. |
| Direct messages | Messages between Members, attachments, and voice notes. If a Member allows it, the text of a voice note is written out by an AI service. |
| Activity and progress | Course and lesson progress, quiz attempts, audio listens, poll votes, event RSVPs, guide checks, and basic usage data such as last-seen and presence. |
| Live event data | When a person joined and left a session; approximate location (country, region and city, never a precise position) and device, browser and operating system. Drry does not store the IP address for this. |
| Forms and contacts | Form answers; contact and lead records; imported contact lists; marketing opt-out status; a booking's details, including the name of the person who booked. |
| Membership and payment status | Membership and tier, plan, subscription state, orders, receipts, signed agreements, and Stripe identifiers (customer and subscription ids). Card numbers and full payment details go to Stripe only and are not stored by Drry. |
| Email data | Recipient address and message content; delivery, bounce and complaint events; opens and clicks for marketing broadcasts, automation emails and auto-replies where Customer turns tracking on; the suppression list. |
| Instagram (Auto-DM) | Instagram-scoped id, username, the text of a comment or message and a link to anything attached, and a record of what each automation did. |
| Notifications | Push notification tokens and notification records for Members who allow them. |
| Technical evidence | IP address and browser user agent recorded when a buyer signs an agreement or downloads a purchased file, and the typed legal name on an accepted agreement. |
| Moderation records | Reports, AI moderation flags, and what action the coach took. |
| Advertising conversion data | Only where Customer connects Meta or TikTok: a hashed email address, purchase amount and currency, browser type, page address without its query string, and the click identifier. Drry keeps these delivery records for 90 days. |
6. Special categories of data
Drry does not intentionally collect special categories of personal data. Customers and Members may include such data in posts, messages and forms, and Drry cannot control that. Customer is responsible for its lawful basis for any such data and for not requesting it unnecessarily (clause 13.4).
7. Frequency and location
Continuous, for as long as the Services are used. Processing takes place with the Sub-processors listed in Annex III. Customer Personal Data is stored and hosted primarily in the United States. Cloudflare and Vercel deliver content and real-time traffic through their global edge networks, so data may transit or be briefly cached outside the United States while it is being served.
8. Features Customer chooses to switch on
| Feature | Additional processing |
|---|---|
| AI moderation | Text of posts, replies and direct messages in the Community is sent to Groq for screening. A flagged post or reply is held from the Community until the coach reviews it; a flagged direct message is still delivered and goes to the coach's review queue. |
| Meeting notes and recaps | Session audio is transcribed by Cloudflare and the transcript is sent to Groq to write a summary for the host. |
| Voice-note transcription | Only if the Member agrees. Audio is sent to Groq. |
| Auto-DM | Instagram data above. AI matching and AI replies are separate switches: text is sent to Groq, and any AI-written public reply is screened by OpenAI before posting. |
| Google connection | Calendar busy times, calendars selected, and sessions Customer chooses to add to a Google calendar; Google Meet link creation. |
| Advertising pixels and conversion events | Controlled by Customer under clause 13.2. |
| AI assistant (connector) | If Customer connects an AI assistant, what the assistant requests is returned to the company that runs it, under Customer's own agreement with it. The connector does not return the body of posts, direct messages, form submissions or Members' email addresses. |
Annex II. Technical and organisational security measures
This Annex describes the measures that are in place at the Effective Date. It is drawn from Drry's published Security page.
Part A. Measures in place
- No passwords. Sign-in is by a one-time code sent to the person's email address. There is no password hash in Drry's database. Sessions are cookies scoped to the single host the person signed in on, so a session on one community is not a session on another.
- Card data never reaches Drry. Payments are taken by Stripe on a Stripe account in Customer's own name, through Stripe's own hosted checkout. Card details go from the buyer to Stripe and do not touch Drry's servers.
- Encryption. Every connection to Drry, to the video gateway and to Drry's own services is over HTTPS. Drry's database and object storage providers encrypt what they hold at rest. Integration tokens (for example, the tokens Customer gives Drry when it connects Google or Instagram) are encrypted by Drry with AES-256-GCM before they are stored.
- Media is not public. Uploaded video, audio and attachments live in a private bucket. Nothing is served from a guessable address. A video plays through a signed token that expires, an attachment download checks the person's membership first, and the media of a locked lesson is refused by the route and not just hidden in the interface.
- Deletion. A Member can erase their account and a coach can delete a whole Community from inside the product. Both cascade through the data: media objects, and queued mail and stored email bodies addressed only to the person, are deleted, and the recipient address is removed from the email log. The log keeps the message's subject, time and status, and one shared copy of a bulk email is kept for its whole audience. The same mechanism answers a GDPR erasure request.
- Export. Contacts and members export to CSV on every plan, so Customer can take its data with it.
- Access by Drry staff. Support and engineering access is limited to the people who run Drry. The operator console, which can list and suspend communities, is limited to a named list of accounts. Drry does not read a Community's posts or Members' messages as a matter of course.
- Separation between Communities. Customer data is stored with the Community that owns it, and the application reads it scoped to that Community.
- Error monitoring and testing. Failures are reported to an error-monitoring service so Drry can see and fix them. The defences described here are covered by an automated test suite.
- Email. All mail is sent through Drry's mail pipeline with a suppression list for hard bounces and complaints. AI features that Drry or Customer switches on are provided by processors that, as described in the Privacy Policy, do not use what Drry sends them to train their models.
- Reporting a problem. Security issues can be reported to hello@drry.com. Drry does not run a paid bug bounty.
Part B. What Drry does not have
This list is rendered from the same registry as the Security page, so the two cannot differ.
- No SOC 2, ISO 27001 or equivalent certification. We have not been through a formal security audit and do not hold a certificate. If your organisation requires one to buy software, we are not able to meet that today, and we would rather tell you now than at the end of a procurement process.
- No third-party penetration test. Nobody external has been paid to attack Drry. The defences described on this page are real and are covered by an automated test suite, which is a different and lesser thing than an adversary having tried them.
- No published uptime commitment. We do not publish an SLA and do not offer service credits. Drry runs on infrastructure with its own strong availability record, but we are not going to promise a number we have no way to enforce on your behalf.
- No public status page yet. If something is broken, the honest answer today is to email us and we will tell you what we know. A status page worth reading needs monitoring behind it, and we would rather build that first than publish a page that is green during an outage.
Annex IV. International transfer mechanisms
This Annex completes the SCCs, the UK Addendum and the Swiss modifications incorporated by clause 12.
Part 1. Choices in the EU SCCs
| SCC provision | Choice |
|---|---|
| Modules | Module Two (controller to processor) where Customer is a controller. Module Three (processor to processor) where Customer processes on behalf of its own clients. Modules One and Four do not apply. |
| Clause 7 (docking clause) | Included. An entity that is not a party may accede to the SCCs with the agreement of both parties. |
| Clause 9(a) (sub-processors) | Option 2, general written authorisation. The list is Annex III of this DPA. Notice of changes is given as clause 6.2 of this DPA says: by email to Customer, and by updating the public list, at least 30 days in advance. |
| Clause 11(a) (redress) | The optional language about an independent dispute resolution body is not included. |
| Clause 13 (supervision) | The supervisory authority is set out in Part 2. |
| Clause 17 (governing law) | Option 1. The SCCs are governed by the law of the EU Member State in which the data exporter is established. Where that law does not allow third-party beneficiary rights, the law of Ireland. |
| Clause 18(b) (forum) | The courts of the EU Member State in which the data exporter is established. Where that law does not allow third-party beneficiary rights, the courts of Ireland. |
Part 2. Annexes to the SCCs
| SCC annex | Where it is completed |
|---|---|
| Annex I.A (list of parties) | Data exporter: Customer, the creator identified by the name and primary email address on the Drry account that accepted the Terms, and the Community it runs, acting as controller (or as processor where Module Three applies). Data importer: Drry, Inc., 1522 Western Ave STE 93965, Seattle WA 98101, United States, data protection contact hello@drry.com, acting as processor. Electronic acceptance of the Terms is effective execution of the SCCs by both parties (clause 12.8). |
| Annex I.B (description of transfer) | Annex I of this DPA, which sets out the categories of data subjects, the categories of personal data, the special categories (none intentionally collected), the frequency (continuous), the nature, the purpose, the duration and the sub-processor processing. |
| Annex I.C (competent supervisory authority) | The competent supervisory authority is determined under Clause 13(a) of the SCCs. |
| Annex II (technical and organisational measures) | Annex II of this DPA. |
| Annex III (list of sub-processors) | Annex III of this DPA. |
Part 3. UK Addendum (version B1.0)
| Addendum item | Completed as |
|---|---|
| Table 1 (parties) | Start date: the Effective Date. Exporter: Customer, as in Annex I.A above. Importer: Drry, Inc., 1522 Western Ave STE 93965, Seattle WA 98101, United States, hello@drry.com. Electronic acceptance of the Terms counts as signature by both parties. |
| Table 2 (selected SCCs, modules and clauses) | The version of the EU SCCs described in Part 1, with the modules, docking clause, Clause 9(a) option and Clause 11 choice stated there. |
| Table 3 (appendix information) | Annex I.A: About this agreement section. Annex I.B: Annex I of this DPA. Annex II: Annex II of this DPA. Annex III: Annex III of this DPA. |
| Table 4 (ending the Addendum when the approved Addendum changes) | Neither party may end the Addendum on that ground. |
| Governing law and forum | The law of England and Wales, and the courts of England and Wales. |
Part 4. Swiss modifications
- The FDPIC is the competent supervisory authority under Clause 13 and Annex I.C, to the extent the transfer is governed by the FADP.
- The law of Switzerland is the governing law under Clause 17 for transfers governed exclusively by the FADP. Disputes under Clause 18(b) for such transfers go to the courts of Switzerland.
- References to "Regulation (EU) 2016/679", to the GDPR and to its articles mean the FADP and its corresponding provisions.
- References to "Member State" and to "the EU" are not to be read so as to stop data subjects in Switzerland from bringing claims for their habitual residence (Switzerland) under Clause 18(c).
Part 5. Supplementary measures
- Customer Personal Data is stored and hosted primarily in the United States, with the Sub-processors in Annex III. Cloudflare and Vercel deliver content and real-time traffic through their global edge networks, so data may transit or be briefly cached outside the United States while it is being served.
- The measures in Annex II apply, including encryption in transit and by providers at rest, application-level encryption of integration tokens, private media storage, and limited staff access.
- Clause 15 of the SCCs governs requests from public authorities for Customer Personal Data. In addition, Drry will tell Customer promptly if it receives such a legally binding request, unless the law forbids it, and will disclose only the minimum the request lawfully requires.
- Drry does not rely on a Data Privacy Framework certification.
- Limits Customer should weigh: Drry holds no SOC 2, ISO 27001 or similar certification, has had no third-party penetration test, and publishes no uptime commitment (Annex II, Part B).