Privacy Policy

This statement (“Privacy Policy”) describes the types of personal data we may collect and process when you use our Services as defined in our Terms of Services, visit our websites or in other ways communicate with us. This Privacy Policy also describes how you may request additional information and exercise your privacy rights.

"You," "your," and "User" mean each and every person who visit our website or uses our Service. The words "Draum," “us,” and “we” mean Draum AS, Dovresvingen 6b, N-1184 OSLO, Norway.

Draum may update this Privacy Policy from time to time. When we do, we will post an updated version on this page. You will be notified of any material changes to this Privacy Policy via email if your email is available to us.

If you have any further questions after reading this statement, do not hesitate to contact us on the following email: hello@draum.com.

1. Data processed by Draum

Draum is the controller of all of your personal data we collect when you use our Services. Please read this Privacy notice carefully to learn how your personal data is processed by Draum. The Draum Services provides information, answers, and other texts (“Outputs”) to the User’s requests (“Inputs”) by leveraging proprietary and third party’s artificial intelligence based on large language models. The Services adjust and correct the information provided by third party artificial intelligence to provide knowledge-based information, with proper reference work checks.

Personal data means any information relating to an identified or identifiable natural person. Any processing of personal data by Draum is conducted in accordance with the General Data Protection Regulation (“GDPR”). Special categories of data mean data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data and data concerning health or data concerning a natural person’s sex life or sexual orientation.

We process personal data provided by you or automatically collected by cookies, for the purposes of providing our Services and to improve and develop the Service. Providing the Service includes processing the data you provide as Input to generate the Output, collectively referred to as User Content. We process personal data provided as Input based on necessity for the fulfilment of our contractual obligations with you. You should not include special categories of personal data in your input if you do not agree to our processing of such data.

Developing the Service includes using anonymized Input (topics you specify and questions you ask) for training machine learning models. Files you upload will not be used to train machine learning models. Our use of Input to train our models is based on our legitimate interest in developing and improving the Service.

2. The purposes and the legal bases for our processing

To provide the Service in accordance with our contractual obligations, including to communicate with you and provide support, we need to process the following categories of Personal Data:

Account information: name, email, account credentials, billing information;

User Content: topics you specify, questions you ask and files you upload to become part of your knowledge repository;

Log Data: Information that your browser or device automatically sends when you use our Services: IP-address, browser type and settings, device, operating system identifiers and the types of content you view;

Personal Data collected by cookies: We use cookies and similar technologies to operate and administer our Services and improve your experience as described in Section 7 below.

The Personal Data listed above may also be used to fulfil our legal obligations, e.g., to fulfil our bookkeeping and tax obligations and for marketing purposes, based on our legitimate interest in keeping you updated on our Service and our products. Based on your consent we may use activity data collected by cookies to provide direct marketing based on your activity and your preferences.

In accordance with Terms of Service, based on our legitimate interest to improve and develop the Services we may reuse Log Data (as defined above), User Content and data collected by cookies for the training of our models and machine learning purposes.

3. Retention period

Account Data and Input will be deleted upon request from the user or within 90 days after termination of your user account unless we have a legal obligation to retain the data for accounting purposes. Who we share your information with.

We will not share the personal data of our users with any third parties, except when we have legal grounds for sharing the data or it is required under any statutory obligations.

We share your data with our processors who provide large language models artificial intelligence services and process User Content on our behalf. Draum may change such service providers from time to time.

We cooperate with Stripe as a third- party payment service provider. Stripe is the controller of payment details and contact information you provide for billing purposes. We share your email and user-id with Stripe, along with the billable amount for them to conduct payment. Stripe is located in the US. Please review the privacy policy of service provider for additional information. Stripe is covered by the EU-US Privacy Framework Agreement and guarantee that personal data is processed in accordance with GDPR.

4. Data transfers

We may transfer your personal data to recipients outside of the EEA, Switzerland and the UK. Any and all such transfers are made pursuant to applicable data protection legislation - transfers are made pursuant to adequacy decisions made by the European Commission for certain countries and jurisdictions, such as the United States. By using our services, you understand and acknowledge that your personal data will be processed by our service providers located in the United States.

5. Your rights as a data subject

5.1 Your rights

You have the right to request:

  • Access your personal data that is being processed by us. You may request information on the purposes of the processing, the categories of personal data concerned, the envisaged period for which the personal data will be stored, any available information as to the personal data’s source, amongst others. Your right to access may be limited by national law;
  • Rectification of inaccurate personal data concerning you. Considering the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement correction of any errors in the personal data we have stored about you,
  • Deletion of personal data concerning you, unless processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims;
    receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller ('right to data portability');
  • Lodge a complaint with a supervisory authority.

5.2 Exercising your rights

Requests pursuant to the above rights may submitted to: privacy@draum.com. We will respond to your request within 30 days. If you have any concerns about how we process your personal data, you are welcome to file a complaint to the Norwegian Data Protection Authority (Datatilsynet), or to the Data Protection Authority where you live.

6. Use of cookies

Cookies are text files containing small amounts of information which are downloaded to your computer or mobile device and allow us to recognize your device when you visit Draum’s website.

We use cookies that are strictly necessary for the performance of our services and cookies that provides us analytics about the performance of our website If you do not agree with necessary cookies being used, you should leave the website and stop using our services.

You can administrate your consent to our use of performance cookies and the use of cookies for marketing purposes by changing your preferences in the cookie settings.

Based on your consent we use Performance Cookies for the following purposes:

  • Performance analytics review
  • Marketing purposes

6.1 Third party cookies

We use the following cookies:

  • Performance cookies (Analytics): Sentry, PostHog, Squarespace. These cookies allow us to monitor and improve the service and website performance. Personal data collected is IP-address, pages visited, user actions, device and browser info rmation, and errors.
  • Necessary cookies (Security): Stripe. These cookies are for payment processing and fraud detection. Personal data collected is IP-address, pages visited, device and browser information.


Last revised: 2024-04-04.