Version 2026-10-17. This covers the data your desk is built on. It sits alongside the Terms of Service, the Public Record Terms, and the Content License. Where a signed partner agreement covers your desk, its data terms govern, and this license never narrows them.
Your desk is built on your own data. This agreement says what stays yours, what you let DRM3 do with it in order to run your desk, what DRM3 never does with it, and what applies if you add DRM3's public record beside it.
Every dataset you deliver to a desk, by API, from a bucket, by file drop, SFTP or upload, is yours. DRM3 Labs claims no ownership of it and no right to use it beyond what this agreement allows. It is private by default: it serves only the desks you name. You control access to it from your own account. Access is by named grant, each grant is yours to revoke, and the keys that can reach it are listed on your console.
You grant DRM3 Labs Corp, a Delaware corporation, a limited, non-exclusive, revocable license to store your data, index it, derive signals from it, serve those signals to the readers you invite, and answer the questions your readers ask of it, for the sole purpose of running your desk. That license ends when the desk or the dataset is deleted.
Export at any time. You may export your data at any time, from your own account, with no notice period, no approval and no charge. An export never draws on credits.
Deletion on request. Ask, and within thirty days DRM3 deletes the dataset and every derived index that serves only it, and delivers a written certification of the deletion to you.
At the end. When a desk or its plan ends, DRM3 holds the dataset open for export for thirty days after the last plan on it ends, then deletes it and every derived index that serves only it within thirty days, and certifies the deletion in writing, without your having to ask. Routine backups purge as they roll. Ledger rows and receipts stay as the record of what was served; they carry identifiers only, never your data. Nothing DRM3 owes or claims, including a payment dispute, delays an export or a deletion.
DRM3 protects your data with reasonable care and never less: encryption in transit and at rest, access by named grant and scoped key only, and an audit row on every grant, key, upload, share, export and deletion, readable from your own console. If a security incident touches your data, DRM3 tells you within 72 hours of confirming it: what happened, what was touched and what DRM3 is doing.
You have the right to deliver the data you deliver. Its collection and its supply to DRM3 comply with law. Where a supplier set a term on it, you keep that term. Personal data in it is yours to handle under the law that applies to you. DRM3 processes it as your processor, on your documented instructions; the Privacy Policy says which role is which.
A desk can choose to place DRM3's public record beside your data. That record is DRM3's: its own instruments' readings, the facts it derives from public sources, and the open datasets listed with their licenses in the DRM3 data-license registry. You may build and publish signals from it inside your desk under the Content License. You may not resell or redistribute the record itself. The Public Record Terms say what that record is and is not.
Questions go to support@drm3.io.