Privacy Policy

Driftflow LLC, doing business as Bankdrift

Last updated: June 12, 2026

1. Introduction

Driftflow LLC ("Bankdrift," "we," "us," or "our") provides a service that helps individuals switch their recurring payments and direct deposits from a previous bank account to a new one, offered through partnering financial institutions. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights you have. We are committed to protecting your information in accordance with the Gramm-Leach-Bliley Act (GLBA) and all other applicable federal and state privacy laws. We use your information for one purpose only: completing the payment switch you authorize.

2. Information We Collect

We collect the following categories of information:

Identity information. Your name and email address, which you provide directly. Optionally, your date of birth and home address, which help verify your identity with merchants such as utilities and insurance providers.

Financial account information. Through our data provider Plaid, we access up to 24 months of transaction history from the bank account you connect, which we use to identify your recurring payments. We also collect the routing number and account number of your new bank account so we can update your payment information with merchants.

Authorization records. When you authorize a switch, we record your name, email, the date and time of authorization, and your IP address as evidence of consent.

Usage information. Basic technical information such as device type and browser, used to operate and secure the service.

We never see, receive, or store your online banking username or password. You connect your bank directly through Plaid's secure interface, which handles authentication.

3. How We Use Your Information

We use your information exclusively to detect your recurring payments and deposits, update your payment information with the merchants you select, keep you informed of progress through the switch, verify your identity with merchants when required, and maintain records required for billing, security, and legal compliance. We do not use your information for advertising or marketing. We do not sell your information. We do not share it with anyone except as described in this policy.

4. How We Share Your Information

We share information only in these limited circumstances:

Service providers. We work with a small number of providers who process data strictly on our behalf under contracts that prohibit any other use: Plaid (bank connectivity), Supabase (encrypted data storage on Amazon Web Services in the United States), Vercel (application hosting), Stripe (billing), Resend (email delivery), and, where applicable to your switch, providers that facilitate account updates and payment routing.

Merchants you select. To switch a payment, we provide the relevant merchant with your updated account information and, where needed, identity details to authenticate the change on your behalf.

Your bank. The financial institution offering you this service receives status information about your switch.

Legal requirements. We may disclose information if required by law, subpoena, or to protect the rights, property, or safety of our users or others.

5. Security

We protect your information using industry-standard safeguards: encryption of data in transit using TLS 1.3, encryption of data at rest using AES-256 on Amazon Web Services infrastructure located in the United States, authenticated access with automatic session timeouts, database-level access controls that isolate each institution's data, sanitization of user input to prevent injection attacks, and full audit logging of administrative actions with timestamps. No method of transmission or storage is perfectly secure, but we work continuously to protect your information and to improve our safeguards.

6. Data Retention and Deletion

Optional sensitive information, including your date of birth and home address, is deleted once your switch completes and is never retained permanently. Records of your switch are retained only as long as necessary for billing, security, and legal compliance, after which they are deleted or de-identified. You may request deletion of your information at any time as described below.

7. Your Rights and Choices

You have the right to revoke your switching authorization at any time, request access to the information we hold about you, request correction of inaccurate information, and request deletion of your information. To exercise any of these rights, email us at switch@bankdrift.com. We will respond within the time required by applicable law, generally within 30 days. You may also revoke an in-progress switch directly from your switch status page.

8. Children's Privacy

Our service is intended for adults who hold bank accounts. We do not knowingly collect information from children under 13.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the date at the top and, where appropriate, notify you. Continued use of the service after changes take effect constitutes acceptance of the updated policy.

10. Contact Us

If you have questions about this Privacy Policy or our handling of your information, contact us at switch@bankdrift.com.