Privacy Policy

1. Information We Collect

Information You Provide Directly

When you create an account, use our tools, or contact us, we may collect:

• Name, email address, and account credentials
• Profile photograph (optional, if uploaded)
• Business and team details (for business accounts)
• The prompts and content you create or upload, including drafts, documents, projects, and images you generate
• Payment and billing information (processed by a third-party payment provider; we do not store full card numbers)
• Communications you send us, including support requests and contact form submissions
• AI tool usage history, including the inputs you provide to our AI tools and the outputs generated (logged for service delivery and account management purposes)

Information Collected Automatically

When you visit or use our platform, we automatically collect certain technical information, including:

• IP address and country of origin (used for access control and security purposes)
• Browser type, operating system, and device information
• Pages visited, features used, and time spent on the platform
• Referring URLs and search terms
• Request metadata logged by our server infrastructure for platform analytics and security monitoring

Information from Third Parties

If you sign in using Google, LinkedIn, GitHub, or Microsoft, we receive basic profile information (such as name, email address, and profile picture) from those providers, in accordance with their own privacy policies and your authorization. The scope of information received from each provider is limited to what you authorize at the time of connection.

We do not collect or process personal data from individuals outside the United States.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve our writing and image-generation tools
• Create and manage your account and process transactions
• Improve and personalize the tools and your workspace
• Send transactional emails, account notifications, and service updates
• Respond to inquiries and provide customer support
• Monitor usage patterns to detect fraud, abuse, or security issues
• Comply with legal obligations and enforce our Terms of Service
• Send marketing communications where you have opted in to receive them

We do not sell your personal data to third parties for their own marketing purposes, as defined by CCPA/CPRA and applicable US state privacy laws.

AI Tool Processing

When you use our AI tools, your inputs (such as the prompts, drafts, and other content you provide) are transmitted to our AI model providers for processing to generate the requested output. This processing is necessary to deliver the Service. For more information, see the Data Sharing section below.

AI Training Data, Opt-In Required

We will not use the content you create or upload to train AI models without your separate, explicit opt-in consent. AI training data use is a separate, optional consent; refusing it does not affect your ability to use the Service. You may manage your AI training data consent at any time through your account privacy settings.

Automated Decision-Making

draft.net does not use your personal information to make automated decisions that produce legal or similarly significant effects about you. Our AI tools generate text and images at your direction; they do not score, rank, or profile you in a way that determines access to any service, benefit, or opportunity.

3. Data Sharing

We may share your information with third parties only in the following limited circumstances:

AI Model Providers (Subprocessors)

The prompts and content you submit to our AI tools are transmitted to third-party AI model providers for processing. Our current primary AI model provider for text generation is Anthropic, PBC, and we use OpenAI for AI image generation. Data transmitted to Anthropic is subject to Anthropic's Privacy Policy and data processing terms. We will update this section if we add or change AI model providers.

Service Providers

We work with trusted vendors who help us operate our platform (e.g., cloud hosting, payment processing, email delivery). These providers are contractually obligated to use your data only as directed by us and to maintain appropriate security measures.

No Sale of Personal Data

We do not sell personal information as defined by CCPA/CPRA or applicable US state privacy laws. We do not share personal information with third parties for cross-context behavioral advertising without your opt-out opportunity.

Business Transfers

If draft.net undergoes a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your data becomes subject to a materially different privacy policy.

Legal Requirements

We may disclose information if required to do so by law, court order, or governmental authority, or to protect the rights, property, or safety of draft.net, our users, or the public.

With Your Consent

We may share information for other purposes when you have given us explicit consent to do so.

4. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate and improve our platform. These include:

Essential cookies: Required for core functionality such as user authentication and session management. These cannot be disabled without affecting platform operation.
Analytics cookies: Help us understand how users interact with the platform so we can improve the experience. May be opted out of via your cookie preferences.
Preference cookies: Remember your settings and preferences between visits (e.g., theme, language selection).

You can manage your cookie preferences through your browser settings or the Cookie Preferences page. Disabling certain cookies may affect the functionality of the platform.

California residents and residents of states with similar opt-out rights may use the Do Not Sell or Share My Personal Information link to opt out of the sharing of personal information collected via analytics technologies.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services to you, subject to the following retention schedule:

Data Type	Retention Period
Account credentials and profile data	Duration of account + 90 days post-deletion
Your content (drafts, documents, generated images)	Duration of account + 90 days post-deletion
AI tool usage history and generated outputs	Duration of account + 90 days post-deletion
Payment and billing records	7 years (financial and tax compliance)
AI usage logs (request metadata)	12 months rolling
Security and audit logs	12 months rolling
Backup copies	30 days after primary deletion

Deletion requests submitted by California residents under CCPA/CPRA, or by residents of any US state with an applicable privacy deletion right, will be processed within 45 days of verification. To submit a deletion request, see the Your Rights section below.

6. Your Privacy Rights

The following rights apply to all users of the Service:

All Users

Right to Know: Request information about the categories and specific pieces of personal information we collect, use, and share.
Right to Correct: Ask us to update or correct inaccurate personal information we hold about you.
Right to Delete: Request that we delete your personal information, subject to applicable legal retention obligations.
Right to Portability: Receive your data in a structured, machine-readable format, including your account data, your drafts and documents, and AI tool history.
Right to Withdraw Consent: Withdraw consent for any processing that relies on your consent (including AI training data use) at any time, without affecting prior processing.
Right to Lodge a Complaint: File a complaint with the Federal Trade Commission or the attorney general of your state if you believe we have violated applicable privacy law.

California Residents (CCPA/CPRA)

California residents have the following additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information (subject to limited exceptions)
• Right to opt out of the sale or sharing of personal information (we do not sell personal data; opt-out for analytics sharing is available via our Cookie Preferences page)
• Right to non-discrimination for exercising your privacy rights
• Right to correct inaccurate personal information
• Right to limit use and disclosure of sensitive personal information

California residents may submit requests via our contact form. We will respond within 45 days (extendable to 90 days with notice).

Other US State Residents

Residents of states with enacted consumer privacy laws (including Virginia, Colorado, Connecticut, Texas, Florida, Iowa, Montana, and others) have the following rights under their applicable state law:

• Right to access, correct, delete, and port personal data
• Right to opt out of the sale of personal data, targeted advertising, and profiling that produces legal or similarly significant effects
• Right to appeal a denial of a privacy rights request

We will respond to verified requests from state residents within the timeframe required by applicable state law (generally 45 days). To submit a request, use our contact form.

To exercise any privacy right:

Submit a request via our contact form. We may need to verify your identity before processing the request.

7. Data Breach Notification

In the event of a personal data breach, we will notify affected users as required by applicable US federal and state law.

• Notification will be provided without unreasonable delay and within any specific timeframes required by your state of residence (e.g., California: most expedient time possible; New York: most expedient time possible; Texas: within 60 days).
• Notifications will describe the nature of the breach, the categories of data affected, the likely consequences, and the measures we have taken or plan to take in response.
• Where required by law, we will notify the Federal Trade Commission and applicable state attorneys general of the breach.

To report a potential security vulnerability or suspected breach, please contact us.