Privacy Policy

Driftflow LLC, operating as Bankdrift

Last updated: October 24, 2026

1. Introduction

Driftflow LLC ("Bankdrift," "we," "us," or "our") provides a service that helps individuals switch their recurring payments and direct deposits from a previous bank account to a new one, offered through partnering financial institutions. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights you have. We are committed to protecting your information in accordance with the Gramm-Leach-Bliley Act (GLBA) and all other applicable federal and state privacy laws. We use your information only to help you complete the switch you authorize.

2. Information We Collect

We collect the following categories of information:

Identity information. Your name and email address, which you provide directly.

Financial account information. Through our data provider Plaid, we access up to 24 months of transaction history from the bank account you connect, which we use to identify your recurring payments. We also collect the routing number and account number of your new bank account so we can show them to you in your switching checklist. This information may be retrieved automatically through Plaid's secure interface or entered manually.

Switch progress. The payments you select and your progress through your switching checklist.

Authorization records. When you authorize a switch, we record your name, email, and the date and time of authorization as evidence of consent.

Usage information. Basic technical information such as device type and browser, used to operate and secure the service.

We never see, receive, or store your online banking username or password. You connect your bank directly through Plaid's secure interface, which handles authentication.

3. How We Use Your Information

We use your information only to find your recurring payments and direct deposits, show you a checklist with your new account details and instructions for switching each one, track your progress, email you about your switch, share your switch progress with your bank, and maintain records required for billing, security, and legal compliance. We do not use your information for advertising or marketing. We do not sell your information. We do not share it with anyone except as described in this policy.

4. How We Share Your Information

We share information only in these limited circumstances:

Service providers. We work with a small number of providers who process data strictly on our behalf under contracts that prohibit any other use: Plaid (bank connectivity), Supabase (encrypted data storage on Amazon Web Services in the United States), Vercel (application hosting), Resend (email delivery), Sentry (error monitoring), Upstash (security rate limiting), and Stripe (billing).

Merchants. We do not share your information with merchants. You update your payment information with each merchant yourself.

Your bank. The financial institution offering you this service can see your name, email address, the name of your previous bank, the payments you selected, and your switch progress.

Legal requirements. We may disclose information if required by law, subpoena, or to protect the rights, property, or safety of our users or others.

5. Security

We protect your information using industry-standard safeguards: encryption of data in transit using TLS 1.3, encryption of data at rest using AES-256 on Amazon Web Services infrastructure located in the United States, two-step sign-in and automatic sign-out after inactivity for dashboard access, access controls that limit each institution to its own customers' data, sanitization of user input to prevent injection attacks, and logging of dashboard sign-ins with timestamps and IP addresses. No method of transmission or storage is perfectly secure, but we work continuously to protect your information and to improve our safeguards.

6. Data Retention and Deletion

Records of your switch are retained only as long as necessary for billing, security, and legal compliance, after which they are deleted or de-identified. You may request deletion of your information at any time as described below.

7. Your Rights and Choices

You have the right to revoke your switching authorization at any time, request access to the information we hold about you, request correction of inaccurate information, and request deletion of your information. To exercise any of these rights, email us at switch@bankdrift.com. We will respond within the time required by applicable law, generally within 30 days.

8. Children's Privacy

Our service is intended for adults who hold bank accounts. We do not knowingly collect information from children under 13.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the date at the top and, where appropriate, notify you. Continued use of the service after changes take effect constitutes acceptance of the updated policy.

10. Contact Us

If you have questions about this Privacy Policy or our handling of your information, contact us at switch@bankdrift.com.