Privacy Policy

Last updated: November 2, 2026

Drilld is operated by Drilld Technologies OÜ ("Drilld", "we", "us"), a company registered in Estonia (registry code 17607858), Tartu mnt 67/1-13b, 10115 Tallinn, Estonia. This policy explains how we collect, use, and protect your personal data when you use Drilld.

We are the data controller for personal data processed on the platform. For privacy questions, contact us at hello@drilld.co.

Drilld Technologies OÜ has not appointed a data protection officer. GDPR Article 37 does not require one at our current size and activities. Questions about personal data: hello@drilld.co. The Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) is our supervisory authority.

1. Data we collect

Account data

When you create an account, we collect:

Profile data

If you complete your profile, we may also collect:

Booking and payment data

When you book or sell sessions, we collect:

Usage data

We automatically collect:

Content you create

Posts, comments, reviews, and other content you share on the platform.

2. How we use your data

We process your data to:

When a person at Drilld reads booking thread messages

Booking thread messages are private between the student and the instructor, and nobody at Drilld reads them as part of running the platform. If one of you reports a message in the thread, a member of our team may read that message together with up to three messages sent before it and up to three sent after it, so that the report can be judged in context. That is the normal review window. We keep an internal record of these reviews. We do not open the rest of the conversation unless one of the cases under "Legal disclosure" in section 3 applies.

When you report a post, a comment or a profile

When someone reports a post, a comment, a message in a booking thread or a profile, we save a copy of it as it was at that moment. For a post, a comment or a message, that is the text, links to any photos or video, who wrote it and when. For a profile, that is the name, the profile address, the photo, the tagline and the bio. The copy also holds the reason given for the report. A member of our team who handles reports uses the copy to review the report, even if the content or the profile is changed or deleted afterwards. Only that team can see the copy. The copy may include personal data about people mentioned in it. We limit access to the moderation team. Nobody who is reported is ever told who made the report. We do this under our legitimate interest in keeping people on Drilld safe, and to meet our obligations under the EU Digital Services Act.

Checking a coach's identity

Before someone can sell sessions on Drilld, we check that the person controls the social media account given to us. This can be done in one of two ways: add a Drilld link to the bio of that account, or send a one-time code from that Instagram account to Drilld's Instagram account @drilld.co. For this check we process the username, the code and when it was created, and a person at Drilld reads the message in our Instagram inbox. Instagram is run by Meta Platforms Ireland Limited, which handles the message under its own terms and is an independent controller of that service. We keep a record of the check (the method, the username, the code and the time) as proof of how we decided, for as long as the coach account is active and for 2 years after it closes.

Legal basis for processing

We process your data based on:

If you sell through Drilld: tax reporting (DAC7)

If you sell through Drilld we collect your name, address and date of birth, and after your first sale in a year your tax number (or your place of birth if you have none). For a company or a club we collect its registration number and place of business. We use this to report you to the Estonian Tax and Customs Board under DAC7. The legal basis is a legal obligation. The Board may share it with tax authorities in other EU countries. We keep it for as long as Estonian law requires for that reporting, and no longer than needed for a dispute about the report.

3. Who we share data with

We share data only when necessary:

We do not sell your personal data to third parties.

Legal disclosure

We may disclose data when required by law, court order, or to protect the rights, property, or safety of Drilld, our users, or others.

4. How long we keep data

We keep your data only as long as necessary:

5. Your rights

Under GDPR and similar laws, you have the right to:

To exercise these rights, contact us at hello@drilld.co. We respond within 30 days.

Complaints

If you believe we have mishandled your data, you have the right to file a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) at aki.ee, or with the data protection authority in the EU country where you live or work.

6. Cookies

We use cookies and similar technologies to:

You can manage cookie preferences through the cookie banner shown when you first visit the platform, or via your browser settings.

Cookie categories

7. Data security

We use industry-standard security measures:

No system is fully secure. If we become aware of a data breach affecting your data, we will notify you and relevant authorities as required by law.

8. International transfers

Drilld is based in Estonia (EU/EEA). Some service providers (Stripe, Cloudflare, Supabase, Vercel, Twilio, OpenAI) may process data outside the EU/EEA. We ensure adequate safeguards are in place, including:

9. Children and guardian-managed accounts

You must be at least 13 to create your own Drilld account. If you are between 13 and 18, you must have permission from a parent or legal guardian. We do not knowingly let users under 13 create their own account. If we learn that a child under 13 has created an account without a parent or legal guardian, we will delete that account data promptly.

Profiles of people under 18

If you are under 18, or if we do not have your date of birth, your profile is visible only to people who are logged in to Drilld. People who are not logged in cannot see your profile, your posts or your comments, and search engines are not allowed to index your profile.

From your 18th birthday, your profile, posts and comments become visible to everyone, including people who are not logged in, and search engines can show your profile. We send you a message about seven days before this happens.

Accounts a guardian manages

A parent or legal guardian can create and manage an account for a child under 18. The guardian sets the account up and controls it. The child cannot log in to it.

For that account we collect the child's name, date of birth, and biological sex so the child can be registered for sessions and events with the correct age group and safety rules. The guardian can also add a photo and the sports the child trains. We process this data to provide the service the guardian asked us to provide.

A guardian-managed account is private by default. It is never visible to logged-out visitors and it is never indexed by search engines. The guardian decides whether other logged-in users can see it.

The guardian can use the rights in section 5 for a managed account. After a takeover, the child can use those rights for the account. The guardian's remaining access is only the limited visibility described below, until the child turns 18.

Taking over the account from the age of 13

From the age of 13 a child can take over the account. The guardian starts the takeover. The child then chooses the email address and password for it. After the takeover, the profile is visible to people who are logged in to Drilld. People who are not logged in and search engines will not see it until the child turns 18.

We email the guardian when the child completes the takeover. The guardian can object for a short period after that, or until the child's 18th birthday if that comes first. We tell the guardian the exact deadline in that email.

If a guardian objects, we freeze the account while a person at Drilld reviews the case. The review either lifts the freeze and lets the child keep the account, or reverses the takeover so the account is managed by the guardian again.

What a guardian can see afterwards

After the takeover the guardian no longer controls the account, but keeps limited visibility while the child is still under 18. The guardian can see:

The guardian cannot see posts, comments, messages, followers, or any amounts paid. This visibility ends on the child's 18th birthday.

Turning 18

We email the guardian about six months before, and again about one month before, the child's 18th birthday.

On the 18th birthday the guardian link ends automatically.

If the child has taken over the account, the guardian's visibility stops and the account continues as an ordinary adult account. Its profile, posts and comments then become visible to people who are not logged in, as described in "Profiles of people under 18" above.

If the child never took over the account, it stops being a managed account. The guardian's access ends, and nobody can log in to it.

Accounts that were never taken over

If an account was never taken over, we anonymize it two years after it stops being managed, or earlier if we receive a deletion request (see section 5). We email the person who was the guardian at least 30 days before we anonymize it.

When we anonymize an account we permanently remove the name, date of birth, biological sex, photo, bio, email address, phone number, and location. We keep the booking history, payment references, and the record that a guardian gave consent, as accounting and accountability records (see section 4).

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification. The "Last updated" date at the top reflects the most recent version.

11. Contact

For privacy questions, data subject requests, or complaints, contact us at: