Privacy
English | Polski
Version 3, effective 2026-10-18
Draftland is operated by Paweł Józefiak, trading as JOCK Paweł Józefiak, registered in CEIDG (Poland), NIP 6342772453, REGON 384319149. He is the controller responsible for the account and service data described here.
Privacy questions: hello@usedraftland.com. Postal address: ul. Kaliny 95/19, 41-506 Chorzów, Poland. This page is available in English and Polish. You can contact us about your data in either language.
Your browser
You can write without an account. Your private drafts, Notes, wordings, versions and pictures are saved in this browser. With premium, the drafts you keep in your account are also saved on our server, so you can open them on another device, and new drafts you write while signed in are saved there automatically. Signing in alone does not upload your existing browser drafts: you choose which to add, and your browser copies stay. Clearing browser storage can remove work that is not in your account. Export a JSON backup to keep your own copy. To keep owner access to your shared drafts, tick Include sharing keys and keep that file private.
We use browser storage to save work and access keys, and for one flag that lasts only while the tab is open and keeps links between our website pages working as you expect. Draftland does not encrypt this browser storage. We do not use it for advertising or tracking.
Your account
Signing in uses your email address. We email you a sign-in link and a code. They expire after ten minutes and work only with the sign-in request that created them. Keep your inbox and sign-in messages private.
We keep your email address, the drafts, Notes, pictures and versions you keep in your account, invitation details including any complimentary premium, subscription status, session records, and limited security and delivery records.
When you create an account, we may ask where you heard about Draftland. Answering is optional and you pick from a fixed list. We store your answer with your account and use it only in totals, together with whether accounts subscribe, to learn which channels bring authors who stay, relying on our legitimate interest in understanding which channels work. You can ask us to remove it at any time, and it is deleted when your account is deleted.
Readers and guests are always free. They do not need an account. A reader link does not give access to an author's private account content.
Cookies
We use strictly necessary cookies when you request sign-in and while you are signed in. They connect your sign-in request to your browser and keep your session secure. The request cookie, __Host-draftland_login, lasts up to ten minutes. The session cookie, __Host-draftland_session, lasts up to thirty days. The session ends after seven days without use, or when you sign out or revoke it.
Draftland uses no tracking or advertising cookies. No other company collects information about your activity across websites through Draftland's pages, and we don't track you across other websites, so Do Not Track signals don't change anything here. Stripe and Link use their own cookies and technologies on their hosted checkout and account pages. Their Privacy policy explains those uses.
Daily counts
We measure use of Draftland through daily totals of requests to a fixed set of our pages: the homepage, our marketing pages, the app, and our own short channel pages such as usedraftland.com/ph. These are request counts, not counts of people, and can include repeat visits and automated traffic. Our server adds 1 to the day's total for the page requested and keeps no record of the individual request; no IP address, browser details, referrer, account identifier or writing goes into these totals. We also keep daily totals of drafts shared, reader feedback packages received, AI versions prepared, and versions applied after received feedback. We set no analytics cookies, run no counting scripts in your browser and store no analytics identifiers in it. Like any website, our server receives your IP address and request headers to deliver pages and protect the service. To count daily visitors, our server turns your IP address and browser type from a request the app already makes into a code that changes every day, using a key that exists only in memory and is thrown away at midnight. We keep only the day's total number of visitors. The codes are never written to disk and can't be recalculated afterwards, and we don't store your IP address or browser details. We use the totals to understand traffic, entry channels and feature use, relying on our legitimate interest in improving Draftland. Sign-up, payment and cancellation totals come from our own records and Stripe's. After your first sign-in, we may ask once where your sign-in code arrived. Answering is optional. Your answer, or closing the question, only adds to a daily total, split by whether your email address is a Gmail one, and isn't stored with your account. This helps us check that sign-in emails reach your inbox.
Error reports: if the app hits an error, it sends our server a short technical report: the type of error, where in our code it happened (with sharing keys and link parameters removed), the app version, the page and your browser family. It contains no error text, writing, identifiers or cookies. We keep these reports for 14 days to find and fix bugs, relying on our legitimate interest in keeping Draftland working.
Feedback from the app
If you send feedback from the app, we store your message, your email address if you add one, the app version, the screen you were on and your browser and device type on our server in Frankfurt. We copy it to our own computer in Poland to read it, and an AI service in the United States helps us sort it, without your email address. We delete our copies within 12 months of receiving it. Our AI sorting provider's copies follow the retention table. You can always reach a person at hello@usedraftland.com. Sorting only routes messages; it doesn't decide complaints or content restrictions.
Sharing
Sharing sends a copy of the draft to our server, including published text, pictures, the brief and any wordings you make available. We also store feedback, contributor labels, prepared versions and decisions. A reader's picture upload can reach the server before they send their package.
Working reader links give access to the shared draft and permitted feedback. Feedback is not a confidential conversation with the author. Names are labels, not verified identities. Anyone holding an owner link can act as the owner, so keep it private. People you share a reader link with can add the draft to their own Draftland account to come back to it; stopping sharing or replacing the link ends their access.
If you give feedback as a reader, your feedback and the label you choose become part of that shared draft. The author, anyone with the draft's owner link and the author's own connected agent can read all feedback, and the built-in AI can use your feedback to prepare a revision. Other readers can't see your feedback, though a version the author publishes can reflect it. Draftland hosts the room for its author and keeps limited security records. You can send feedback without an account.
If you open a shared draft and choose Add to my Draftland, your account keeps that draft's reader link and the private key that marks your feedback as yours, with its title, the author's label and the last version you saw. That lets you return from any device signed in to your account, see what changed and which of your feedback the author used, and send more. They are stored like the rest of your account content. You can remove a draft from your list at any time. If the author stops sharing it or replaces its link, your access ends and we delete the stored link and key; the draft's title stays in your list, marked as no longer shared, until you remove it. If the author deletes their account without keeping their shared drafts, or asks us to erase their data, the draft disappears from your list. Removing it, or deleting your account, deletes everything stored for it.
Shared data is stored on a DigitalOcean server in Frankfurt, Germany. Connections use HTTPS. Draftland does not encrypt shared-room content at rest. Adding a shared draft to your account does not revoke its existing links.
Shared-room access checks store hashes of sharing keys. Owner links are not copied to your account, and we do not reconstruct them from their hashes.
With premium, your shared drafts are linked to your account automatically, so any device signed in to it can open them as their owner, with their feedback. We tell you when it happens, and you can undo it, or unlink a draft or all of them in your account at any time; drafts you unlink stay unlinked. We never store the owner link: each signed-in device gets its own owner key, and we keep only a hash of it. That key stops working when the device signs out, its session ends or is revoked, you unlink the draft, you delete the shared copy or you delete your account. The reader link and agent link of a linked draft are saved with your account so your other devices can show them. They are stored like the rest of your account content, as described under Premium storage and encryption. Linking doesn't change who can open links you have already shared, and unlinking doesn't revoke them. These keys and links never appear in our logs, error reports or emails.
Page mockups made from a draft, or from a screenshot of a page, include their words, colours, layout choices, pictures and versions, and the feedback people send on them. Until you share a mockup, it stays only in the browser where you made it, even when the draft itself is saved to your account. Once you share it, it's stored on our server with the shared draft and follows that shared draft's sharing, deletion and retention rules. A screenshot used to start a mockup is an unshared AI request: it goes to OpenRouter and a model provider, which can process it outside the European Economic Area as described under Built-in AI, and readers never see it. We delete our copy within 24 hours; backup copies can remain for up to 15 days. Screenshots can show other people's personal information, so include only what the mockup needs.
Slide decks made from a draft are stored with that draft and follow the same storage, sync, deletion and retention rules. Making or updating a deck sends the draft's cited passages and picture descriptions, never picture files or private Notes, through built-in AI. The HTML download is built in your browser.
Premium storage and encryption
Your email address and account drafts are stored on our server in Frankfurt the same way shared drafts are, on storage our hosting provider encrypts at rest. Draftland doesn't add its own encryption yet.
Browser copies and content you publish to shared rooms are not encrypted by Draftland. Encryption does not prevent access through a stolen session or a compromised running server. Export files are made when you download them. We do not keep an export file on the server or attach your writing to an email.
Built-in AI and your agents
Built-in AI sends the draft or passage, relevant feedback and instructions through our server to OpenRouter and a model provider. Versions may be prepared automatically when feedback arrives, or when you use Ask, Rewrite or combine inputs. You can pause a shared draft's built-in preparation.
Private writing, in your browser or your account, leaves Draftland's storage when a built-in AI feature uses it. Notes and anything else you add as context are sent only when you ask for a draft from the items you added. Screenshots attached to selected inputs can be sent as images, with metadata stripped, up to four per preparation. Pictures placed on the page are not sent as image bytes; their descriptions and captions can reach the model as text.
OpenRouter, Inc. and the model provider used for a request can process these inputs outside the European Economic Area, including in the United States. These transfers rely on the Standard Contractual Clauses in OpenRouter's data processing agreement. Our requests restrict provider logging and training. Draftland deletes its own copies of AI requests on unshared drafts within 24 hours. On a shared draft, the request material and any notes sent with it stay with that shared draft until it is deleted. Providers can keep limited data under their own safety and retention terms, listed under Service providers and transfers, and our deletion doesn't reach those.
Start from context: files you add to start a draft are read in your browser; we don't upload or store them. For a link, our server fetches that page once, when you ask, and doesn't save it; our logs keep only the site's address, size and response status. We don't fetch pages whose owners opt out of automated reading. The text taken from your files and links is saved with the draft (in your browser, or in your account if you're signed in) and follows the draft's storage and deletion rules. When you ask for a first draft, that text, any images you added, your notes and your direction go to OpenRouter and a model provider, as described under Built-in AI. Images pass through without being stored on our server. We delete our copy of the rest of that request within 24 hours, except that on a shared draft, the request material and notes stay with that shared draft until it is deleted.
Importing a review: when you import a Word document (.docx) or a PowerPoint presentation (.pptx, including a Google Slides download) with its comments and suggested changes, your browser reads the file; we don't upload or store the file. The comments and suggestions, with the reviewer names shown on them, become review inputs on that draft. They follow the same storage, deletion and built-in AI rules as reader feedback, but unlike other readers' feedback, everyone with the draft's reader link can see them, with the reviewer names. Import only reviews you're allowed to use. If your comments were imported into someone's draft, you can ask us to delete them. We rely on our legitimate interest in providing the review the author asked for.
Your own connected agent can read the shared room, including feedback and owner context such as contributor weights. It cannot read your other drafts or private Notes, in your browser or your account. Its provider's terms also apply. You can revoke its access.
Payments
Draftland purchases use Stripe Managed Payments, shown as Sold through Link. Its affiliate Sold through Link, LLC is the merchant of record and handles payment, receipts, tax invoices and purchase taxes. Stripe and Link process payment and order data as independent controllers for their own payment, tax and fraud purposes. The Link Privacy policy and Stripe Privacy policy explain that processing. We separately keep the account and billing records described on this page.
Checkout asks for payment and billing information. We send Stripe an account reference and the selected plan and price. We do not send your writing, draft titles, pictures or sharing keys. We receive order and subscription information needed to provide access, answer billing questions and keep required records. This can include your billing contact details, transaction references, amount, currency, tax and payment status. We do not store your full card number or security code.
Stripe and Link keep their payment records under their own policies. Deleting a Draftland account does not necessarily delete those records or your Link account. A Link deletion request cancels your subscription and removes related billing records at Stripe. We treat it as a cancellation: your account work stays readable and exportable, and it isn't a request to delete your writing. Our own billing record stays as listed in the table.
Emails we send
We send sign-in and security messages, your contract confirmation, cancellation and withdrawal receipts and confirmations, and deletion notices. For an annual plan we email you 30 days before each renewal. If you have complimentary premium, we email you once before it ends, with the end date and your options. Stripe and Link also send purchase messages and receipts. These service messages are separate from marketing.
Email delivery: Resend (United States) sends our emails from the EU (Ireland) and stores message content, attachments and delivery records in the United States, for 30 days (backups up to 7 days longer). Transfers rely on the EU-U.S. Data Privacy Framework, including its UK Extension, and the Standard Contractual Clauses in Resend's data processing agreement. Our emails contain no writing or draft titles, and the sign-in and export links in them expire long before those 30 days. Your own email provider can process messages elsewhere. We keep minimal delivery and failure records. A delivery record shows that a mail server accepted the message, not that you read it.
If paid plans aren't available in your country yet, you can ask us to email you once when they are. We store your email address, the country you chose, your language and the date only for that email, on the basis of your consent. We delete them after sending it, after 12 months if paid plans haven't reached your country, or earlier if you withdraw, which you can do at any time from the email or by writing to hello@usedraftland.com. They are also deleted with your account. We count these requests per country to decide where to offer paid plans next; those counts are totals with no email addresses. We don't use your IP address to work out your country.
Retention and deletion
Shared rooms that are separate from premium storage remain until explicitly deleted; there is no inactivity expiry. Stopping sharing removes reader access but keeps the room and feedback. Account-linked rooms are not silently deleted when premium ends. Account deletion offers a separate choice to delete account-owned shared rooms.
To delete server room content, open Share, expand Shared copy, choose Delete the shared copy and everything received, then confirm Delete permanently. This removes the shared snapshot, received work and room history from the live database and invalidates its links. Your browser draft and copies other people made remain. Daily totals with no personal details, and content-free AI spending records, remain for service accounting.
With premium (paid or complimentary, plus the seven-day grace after a failed payment), new edits save to your account. When premium ends, including after a withdrawal, what's already in your account stays readable and exportable, free, with Export in the app, and new edits stay on your device. If you need help getting it out, email us.
Deleting a draft in the app moves it to Recently deleted, but its saved versions stay on our server. To delete a draft completely, email hello@usedraftland.com from your account's address. We keep private account content until you delete it, delete your account or ask us to delete it. If we ever set a time limit for accounts without premium, we'll email you at least 60 days before it applies. If an export fails or a request to retrieve your content is unresolved, we hold deletion of only the content needed to complete it.
To delete your account, choose Delete my account in Account, or email hello@usedraftland.com from your account's address. We cancel its subscription, revoke sessions and delete private content from live storage within a month, usually sooner, and tell you when it's done. Export first if you want your own copy. Shared rooms, including the server copy that holds review comments you imported from a document, are deleted only if you also ask us to, and their links then stop working. If you keep them, we keep a hash of your email address with those rooms, only so we can find them if you later ask us to delete them, and we delete it together with the rooms. Your browser copies and other people's copies remain.
Deleted content, and records deleted when their period in the table below ends, can remain in backups for up to 15 days after deletion. This limit covers the server's rollback copies, the Amsterdam backups and our nightly copy. If we restore a backup, we reapply deletion records before making the service available.
Unshared AI requests and previews are removed from Draftland's storage within 24 hours. Unused visitor picture uploads become eligible for cleanup after 24 hours, on a later upload. AI providers' own retention is described under Built-in AI.
Retention table
The periods below are for Draftland's own records. Where a provider keeps its own copy longer, its row says so. After ordinary service data is deleted, we keep only the records tax law requires, plus evidence for a dispute that is actually open. We review those holds and delete the data when the reason ends.
In the Basis column, contract, legal duty, legitimate interest and consent mean GDPR Article 6(1)(b), (c), (f) and (a).
| Record | How long | Starts | Basis |
|---|---|---|---|
| Browser-only drafts, Notes, pictures and sharing keys | Until you remove them or clear browser storage. No Draftland server copy from browser use alone | Creation in your browser | None: they stay on your device. Anything sent to our server follows its own row |
| Private account content: drafts, Notes, pictures, named versions, decisions, saved conflicts, reader and agent links of drafts you linked | Until you delete it, delete your account or ask us to delete it. The end of premium, also after a withdrawal, doesn't start a deletion period | Saving to your account | Contract |
| Shared drafts you added to your account: reader link, your reader key, title, author's label, last version seen | Until you remove the draft or delete your account. The link and key are deleted when the author stops sharing or replaces the link; the whole entry is deleted when the author deletes their account without keeping their shared drafts, or has their data erased | Adding the draft | Contract |
| Hold to finish a failed export or retrieval request | Only the content needed, until the export works and the notified retrieval time has passed. Reviewed every 7 days | A reported export failure or unresolved retrieval request before deletion | Contract |
| Automatic recovery checkpoints | Up to 30 days | Each checkpoint's creation | Contract |
| Shared rooms: snapshot, feedback, labels, versions, room history | Until the author deletes the room. No inactivity expiry. We handle erasure requests even after the author's account is gone, and review rooms with no remaining purpose once a year | Room creation | Legitimate interest |
| Deleted content and records in our backups: rollback copies, Amsterdam backups, our nightly copy | Up to 15 days | Deletion from the live service | Legitimate interest, with recovery use only |
| Deletion and revocation records: identifiers and timestamps only | 15 days, until every affected backup has expired | Each deletion or revocation | Legal duty and legitimate interest, so deletions stay applied |
| Export files | We don't keep export files: Export in the app builds the file in your browser. If we help you by email, any download link we send works for 7 days | The request | Contract |
| Sign-in challenges | Valid 10 minutes. The record is deleted within 48 hours after use or expiry | Use or expiry | Contract; legitimate interest |
| Sessions, and the hashes of device owner keys for linked drafts | At most 30 days, ending after 7 days without use. Expired or revoked records are removed within 7 days | Expiry or revocation | Contract; legitimate interest |
| Account record: email, invitation (including complimentary months), subscription access, Terms version accepted | While the account exists, then deleted, except the billing fields below. An unused invitation is deleted 90 days after it expires | Account deletion; invitation expiry | Contract; legitimate interest for invitations |
| Answer to "Where did you hear about Draftland?" | While the account exists; deleted with it, or earlier on request. Reports show totals only and hide any group smaller than 5 | Your answer | Legitimate interest |
| Our email records for sign-in and service notices: sent, delivered, failed, scheduled jobs | 90 days. No writing, sign-in secrets or card data | The event | Contract; legitimate interest |
| Requests to hear when paid plans reach your country: email, chosen country, language, date | Until we send that email, at most 12 months, or until you withdraw or delete your account | Your request | Consent |
| Our record of each contract confirmation email: send status and times, the email provider's reference and the Terms version sent. No email text, writing or card data | Until the end of the sixth year after the year the contract was made. A send that failed and is still being investigated is kept until that is resolved | The contract | Legitimate interest in proving we sent the confirmation the law requires and in establishing or defending legal claims (Polish Civil Code Article 118) |
| Resend's copies of our emails: content, attachments, delivery records | 30 days, stored in the United States; backups up to 7 days longer. Everything is deleted within 90 days of our Resend account ending | Sending | Resend processes them for us under its data processing agreement |
| Rate-limit identifiers, including the IP-derived hash | Up to 48 hours after the limit window | End of the window | Legitimate interest |
| Routine security and error logs, with no content | Up to 30 days | The event | Legitimate interest |
| Client error reports: error type, code location, app version, page, browser family. No error text, writing, identifiers or sharing keys | 14 days | The error | Legitimate interest |
| Security audit records: sign-in, session and account changes, with no content | 90 days | The event | Legitimate interest in detecting and investigating misuse |
| Security incident file | While the investigation is open, reviewed every 30 days. Deleted 90 days after closure, unless a legal duty or an open dispute needs part of it | Incident opened; closure | Legitimate interest; legal duty for breach records |
| App feedback: message, optional email, app version, screen, browser and device type | Our copies, on the server and our own computer, are deleted within 12 months | Submission | Legitimate interest |
| Support email, attachments and mailbox copies, including withdrawal statements that match no subscription | Our copies are deleted within 12 months after the conversation closes. HEY purges deleted mail within up to 90 more days | Conversation closure | Contract for customers; legitimate interest for others |
| AI sorting provider's copies | Until we delete the conversation, then up to 30 days in the provider's systems. Items the provider flags for safety can be kept longer under its terms | Sending; deletion | As for the message it sorts |
| Unshared AI requests, previews and screenshot requests, our copies | Up to 24 hours | Submission | Contract |
| AI request material on a shared draft: source snapshot, selection, guidance and notes sent with it | Until the shared draft is deleted | The request | Contract |
| AI providers' copies: OpenRouter and the model providers used | Depends on the provider; see Service providers and transfers. OpenRouter deletes from its datastores and backups within 30 business days of a request | The provider's own event | Processors for us under OpenRouter's data processing agreement |
| Unused visitor picture uploads | Eligible for cleanup after 24 hours, removed on a later upload | Upload | Legitimate interest |
| Draftland's billing and refund record: Stripe subscription, invoice, charge and refund IDs; date; plan; amount, currency and tax; buyer country; renewal, cancellation, withdrawal and refund events with timestamps. Name and email only where an invoice in Draftland's own name needs them | 5 years from the end of the year in which the income tax on that sale was due (a 2026 sale: to the end of 2032). Kept after account deletion and after a Link deletion request | The sale or refund | Legal duty: Polish Tax Ordinance Articles 70 and 86 |
| Order evidence: the offer and wording version shown, plan, price, interval, Terms version, Stripe references, your request to start premium at once, and the time of the Subscribe click and checkout completion. No writing or card data | Kept with the billing record. For a US billing address, at least 3 years from the purchase or 1 year after the subscription ends, whichever is later, if that runs past the billing record | The purchase | Legal duty. For the longer US period: legitimate interest in meeting US subscription rules |
| Pawel's own tax records: tax book or simplified sales record, payouts, fees, refunds, expenses | Same period as the billing record, longer only if the tax limitation period is suspended or interrupted | End of the tax-due year | Legal duty: Polish Tax Ordinance Articles 70 and 86 |
| Withdrawal or cancellation statement as submitted: the name and emails you typed, any reference, the statement, its submission time and the email delivery status. No IP address | 12 months after it is handled. The dated withdrawal, cancellation and refund events stay in the billing record | Statement handled | Legal duty to confirm receipt, then legitimate interest |
| Evidence for an actual dispute: an open complaint, a disputed charge, a claim made | Only what that dispute needs. Reviewed every 90 days. Deleted when it is resolved and any appeal or enforcement period has passed | The dispute arising | Legitimate interest in establishing or defending a legal claim |
| Daily totals and content-free AI spending totals | Kept as totals. We call them anonymous only where no figure can point to a person. Per-room or per-account spending records follow the room or account row | Aggregation | Legitimate interest for the counting step. Truly anonymous totals are not personal data |
Children
Draftland is not directed to children under 13. If we learn that we collected personal information from a child under 13, we delete that child's information. This covers only the child's information, not other people's work. Contact hello@usedraftland.com if you think this has happened.
Why we process data
We use your account and subscription data to provide the service you request, on the basis of contract. This includes sign-in, private storage, sync, your chosen sharing and AI features, and service emails. Our legitimate interest in keeping Draftland secure and within limits covers access checks, usage counters and limited error records. Private AI limits use a hash derived from the connection's IP address; this is separate from the daily totals, which contain no IP addresses.
When premium ends, including after a withdrawal from the premium contract, your account continues without premium, and we keep your account work under the contract for your account so you can read, export and delete it. We don't use it for AI, marketing or anything else.
We keep the limited billing records our tax obligations require, for the period in the retention table. If a dispute is actually open, we keep the evidence it needs, with a recorded reason and review date. A possible future dispute alone is not a reason to keep your writing or account details after their normal deletion date.
For reader labels and personal information supplied by another person, we rely on our legitimate interest in providing the collaboration the author asked for. We also use limited reader connection and security information to protect the service, based on our legitimate interest. You don't need an account to use your privacy rights.
An email address and verified sign-in are needed for an account. Billing details are needed for checkout. Without them we cannot provide those features. You can still use the free browser features and join as a reader without an account. Optional marketing, support email details and including sharing keys remain your choice.
Service providers and transfers
Support email passes through Forward Email to our mailbox at HEY, both in the United States, so it can be processed outside the European Economic Area, and an AI service in the United States helps us sort it. Please don't put draft content or sensitive details in support messages unless they're needed.
DigitalOcean hosts and backs up data for us. Resend sends our emails. Forward Email forwards support email to our HEY mailbox. OpenRouter and the model providers we enable process the inputs used by built-in AI. These providers process data on our instructions under their data processing agreements. Stripe and Link are separate controllers for payments. People who receive shared links, and your own agent providers, also receive the data you make available to them.
EU hosting doesn't mean every provider operation stays in the EU. Email delivery, support email, AI, payments and some provider administration involve processing outside the EEA, mainly in the United States. DigitalOcean, LLC and Resend (Plus Five Five, Inc.) are certified under the EU-U.S. Data Privacy Framework, and we rely on it for them; their agreements also include Standard Contractual Clauses. Transfers to OpenRouter and HEY rely on the Standard Contractual Clauses in their data processing agreements. Forward Email's standard data processing agreement forms part of its service terms. It provides for Standard Contractual Clauses for transfers from the EEA to outside the EEA where the GDPR applies and no adequacy decision covers the transfer. Stripe and Link handle their own transfers under Stripe's Data Transfer Addendum. Email hello@usedraftland.com for a copy of the safeguards that apply to your data.
| Provider | What it does for us | Where | Transfer safeguard |
|---|---|---|---|
| DigitalOcean, LLC | Hosts Draftland and stores backups | Frankfurt, Germany; backups in Amsterdam, the Netherlands | EU-U.S. Data Privacy Framework, plus Standard Contractual Clauses |
| Resend (Plus Five Five, Inc.) | Sends our emails | Sent from Ireland, stored in the United States | EU-U.S. Data Privacy Framework, plus Standard Contractual Clauses |
| Forward Email | Forwards support email to our mailbox | United States | Standard Contractual Clauses |
| HEY (37signals) | Our support mailbox | United States | Standard Contractual Clauses |
| OpenRouter, Inc. | Routes built-in AI requests | Outside the EEA, including the United States | Standard Contractual Clauses |
| The provider serving our AI model (currently OpenAI's models), selected by OpenRouter | Prepares built-in AI output. Our requests allow only providers that don't collect the data for their own use; any short-term retention follows their terms | United States and other countries outside the EEA | Standard Contractual Clauses, through OpenRouter's agreement |
| Anthropic (Claude), through Anthropic Ireland, Limited | Helps us sort feedback and support messages, under Anthropic's own terms. Use of our messages for model training is off | Ireland, with processing in the United States | Anthropic's Standard Contractual Clauses |
| Stripe and Sold through Link, LLC | Payments, receipts and purchase taxes, as separate controllers | See their privacy policies | Stripe's Data Transfer Addendum |
Your rights
Contact us to request access, correction, deletion, restriction, objection or portability where applicable. You can withdraw consent without affecting earlier lawful processing. We may need information to locate your data and confirm your authority. Do not email an owner key. You can also complain to Poland's data protection authority or the competent authority where you live or work in the EEA. If you are in the UK, you can also complain to the Information Commissioner's Office at ico.org.uk. To complain to us about your personal data, email hello@usedraftland.com. We acknowledge it within 30 days, look into it, keep you updated and tell you the outcome without undue delay.
Automatic checks can temporarily limit repeated requests or pause built-in AI when its daily budget is reached. Where the affected feature allows it, you can keep writing. A person reviews any proposed final restriction that would end your paid access or stop your export, and can change it. Contact hello@usedraftland.com to explain your situation or challenge a restriction.
Changes to this page
When we change this page, we post the new version here with a new effective date. For a material change, we tell you in Draftland and, if you have an account, by email before it applies. Where the law needs your consent to a new use, we ask for it first.