Privacy Policy

1. Overview

This Privacy Policy explains what data Draft Ally collects, how we use it, and the choices you have. We designed the Service to be privacy-first: we never use your contracts to train third-party models, and product analytics are disabled until you consent.

2. Data we collect

• Account data — name, email, and workspace details you provide at sign-up.
• Content — contracts and documents you upload, and the analysis generated from them.
• Usage data — product analytics (only with your consent) to understand and improve the Service. We do not record the contents of your documents in analytics.

3. How we use data

We use your data to provide and improve the Service, to process analysis, to handle billing, and to communicate with you. Document content is processed by our AI provider solely to generate your analysis and is not used to train their models.

4. Cookies and analytics

We use a privacy-first analytics tool with autocapture and session recording turned off. Analytics cookies are set only after you accept the cookie banner; declining keeps analytics off. Strictly necessary cookies (such as login session) are always used.

5. Sub-processors

We rely on the following service providers to operate the Service. Each processes data on our behalf under appropriate safeguards, only for the purpose listed:

• OpenAI — AI analysis. Document content is sent via the OpenAI API solely to generate your analysis. API data is not used to train OpenAI's models, and requests are not stored beyond OpenAI's short-term abuse-monitoring window.
• Cloudflare R2 — encrypted file storage for uploaded documents and generated PDFs.
• Neon / Railway — database and application hosting.
• Vercel — web application hosting.
• Supabase — authentication only; no document content.
• Resend — transactional email (notifications and reminders, which may quote a clause you are being reminded about).
• Stripe — billing; no document content.
• Sentry — error monitoring, configured to strip request bodies and personal data; no document content.
• PostHog — product analytics, only after you consent via the cookie banner; never document content.

6. Data retention and deletion

We retain your data for as long as your account is active. Deleting a contract removes the document, its uploaded file and every derived artifact (previews, signing copies, analysis, comments, and the collaborative editing state) from our systems. You may request export or deletion of your account data by contacting us.

7. Your rights

Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal data, and to withdraw consent. To exercise these rights, contact us using the details below.

8. Contact

Privacy questions can be sent to privacy@draftally.com.