Privacy

Last updated 8 October 2026.

In plain words: we hold your account details and whatever you put in your workspace, because that is the product. There are no third-party analytics, no advertising and no trackers, and the only cookie we set is the one that keeps you signed in. We count visits to our own website as daily totals, with nothing kept about who visited. The one third party you might meet is Supademo, which plays our product tours — on our public pages if you scroll to a demo, and inside the app if you open Help. The tours themselves are recordings and cannot see your workspace. The help centre that lists them is Supademo's own code, loaded only when you open Help, and it is set out in the table below. We do not sell your data or train models on it. A handful of companies help us run the service, each listed below with what they see and why. If you connect Google Calendar, what we do with it is set out in its own section, and you can take the connection away at any time. If you keep contacts in Drafteo, send campaigns, or publish a form, a booking page or a link page, the people on the other end have a section of their own below.

What we collect

Because you gave it to us

Account — your name, email address, and a password stored only as a bcrypt hash. We never see the password itself.
Your content — boards, notes, task lists, tables, habits, calendar events, channel messages, comments, dashboards, email signatures, and any files or images you upload.
Your contacts — the people you import or add to the CRM: names, email addresses, phone numbers, companies, notes, tags, and what you sent them. They are covered in their own section below.
Keys to services you connect — if you connect an account such as Meta Ads, Twilio or Mailchimp, the key you paste is encrypted before it is stored, with a key held on the server and not in the database, and is only ever shown back as its last four characters.
Workspace — who is in it, their roles, and invitations sent.

Because the service is running

A session cookie so you stay signed in. It is HttpOnly, SameSite=Lax, and lasts a week. It is the only cookie we set.
An activity record — who did what in a workspace, so administrators can see their own history.
When you use it — the days you used the app and how many separate visits that was, and when you were last here. We use it only to see how the product is being used overall — how many people come back, which parts get used — and it is kept for as long as your account is.
Rate-limit counters keyed to an IP address, to slow down attacks on sign-in, sign-up and password resets. They are deleted after a day.
Server logs kept briefly by our hosting provider for reliability and security.

Because somebody followed a short link

Drafteo lets a customer make a short link — drafteo.io/l/something — and see how it did. If you follow one, we record the visit: the country and city our hosting provider reports for your connection, whether you are on a phone, a tablet or a desktop, and the name of the site you came from, if any. The customer who made the link can see these as totals.

Some things we deliberately do not do here, because a link-shortener is exactly where they usually happen:

Your IP address is not stored. It is used once, in memory, to work out the country and city, and to make a one-way hash so that one person refreshing a page is one visit rather than four. The hash is salted with a secret that never leaves our server, it includes the minute and the link, and it cannot be reversed or matched to you on any other link or at any other time.
No cookie is set when you follow a short link, and nothing is added to your browser.
You are not followed onwards. We record that the visit happened and send you on; we have no idea what you do at the other end.
The link's own tags travel with you. A customer can attach UTM tags, which are added to the address you land on. Those are read by whatever the destination site uses, which is that site's business and covered by its policy, not ours.

A visit record is deleted after 400 days.

Because you filled in a form, booked a time, or opened a link page

A Drafteo customer can publish three kinds of public page: a form (drafteo.io/f/…), a booking page (drafteo.io/b/…) and a link page (drafteo.io/l/…). If you use one, here is what happens.

A form — what you type is stored and shown to the customer who made the form, and, if they set the form up that way, you are added to their contacts. A file you attach is kept with your answer, where only that customer can open it. They are emailed that an answer came in.
A booking page — your name, email address, phone number if you give one, your time zone and the time you chose are stored. The meeting goes on the customer's calendar, you are added to their contacts, and you are sent a confirmation with links to change or cancel it. If the customer has reminders switched on, you get them by email, and by text if you gave a number.
A link page — we add one to the page's view count, and one to a button's count when it is pressed. Those are totals; nothing about who you are is kept.
No cookie is set on any of these pages. An IP address is used briefly as a counter, deleted after a day, to stop one machine submitting hundreds of times.

What you send through one of these pages belongs to the customer who published it. To have it corrected or deleted, ask them; if you cannot reach them, write to us and we will pass it on.

Because you visited our website

When you open a page on drafteo.io, we add one to that page's total for the day, and — if another site sent you — one to the total for that site, by its name (Google, LinkedIn and so on), or by the campaign name if the link carried one. That is the whole record: counts per day.

Nothing about you is kept. No IP address, no cookie, nothing stored in your browser, no identifier of any kind. The counts cannot be traced back to a visit, let alone a person.
You are not counted at all if your browser sends Do Not Track or Global Privacy Control, or if you are signed in to Drafteo.
It is ours. We count it ourselves; no analytics company sees it.

What we do not collect

No third-party analytics, no advertising identifiers, no session recording, no fingerprinting, no third-party cookies. We do not track you across other websites or from one visit to the next. The short-link records above are counts for the customer who made the link, and are not joined to anything else.

The people in your contacts

When you keep contacts in Drafteo and write to them, you decide who is in the list and what they are sent. In the language of privacy law you are the controller of that information and we are your processor: we store it and send what you tell us to, and we use it for nothing else.

We do not contact your contacts for ourselves, sell them, or share them with other customers. Two workspaces holding the same person know nothing of each other.
Campaigns and reminders go out through the sending accounts you connect — Twilio for text messages, Resend for email. They receive the address or number and the message, because that is what sending is.
Opt-outs are kept. Somebody who replies STOP to a text, follows the unsubscribe link in an email, or whose address bounces or reports spam, is marked so and left out of later campaigns. That mark stays for as long as the contact does.
Sending contacts elsewhere — if you send a list to Mailchimp, Instantly, SlickText or Lemlist, or let Typeform, Jotform or Zapier add contacts, that happens only when you set it up, and those companies' own terms then apply to their copy.

If you are one of those contacts and want to know what is held or have it removed, the business that wrote to you is the one to ask. We will help them answer you.

AI assistants you connect

You can let an outside assistant — Claude, ChatGPT, Grok, or anything that speaks the same protocol — work in Drafteo for you. Nothing is connected unless you do it, and you choose whether it may only read, may also change things, or may delete.

It acts as you. It reaches what you can reach and nothing more.
What it reads leaves Drafteo. Whatever the assistant asks for is sent to the company that runs it, and is then covered by your agreement with that company, not by this notice.
We keep a log of which action it took, when, and whether it worked — not the content. You can see it under Settings.
Keys are stored as a one-way hash, so we cannot show one to you again, and switching a connection off stops it at once.

Why we hold it

To run the service and show you your work — this is us performing the contract you signed up for.
To keep accounts secure and stop abuse — our legitimate interest, and yours.
To take payment and keep the records tax law requires.
To send service email you asked for: reminders, mentions, invitations, password resets. We do not send marketing email of our own.
To send what you tell us to, to the people you choose: campaigns, appointment confirmations and reminders.

Who else sees it

Who	What they see	Why
Netlify	Requests to the site, and server logs	Hosting
Neon	Everything in the database, stored in the United States (AWS, us-east-2)	The database
Anthropic	Only what you type to the assistant, and the parts of your workspace it reads to answer	The assistant. Nothing is sent unless you use it.
Resend	The email address and the message being sent — yours for service email, your contacts' for campaigns, confirmations and reminders	Sending email
Twilio	The phone number and the text being sent, and replies such as STOP	Text messages, and only if you switch them on
Services you connect	Meta Ads, Google Analytics, Mercury, Whop, Lemlist, Netlify and the like are asked for your figures with the key you gave; Mailchimp, Instantly, SlickText and Lemlist receive the contacts you choose to send them	Dashboards and integrations, and only the ones you set up
An AI assistant you connect	Whatever it asks for from your workspace, within the limit you set	Working in Drafteo for you, and only if you connect one
Miro	Only the board you choose to import	Import, and only if you use it
Whop	Your email address, and your card details, which go to them and never to us	Taking payment
Google	Only the calendar you connect, and only if you connect one	Calendar sync, and only if you use it
Supademo	That you opened a tour, and how far through it you got. The tours are recordings played in their own frame, which cannot see the page around them. The help centre in the app is Supademo's own script: it is loaded only when you open Help, and like any script on a page it could in principle read what is on screen while it is open. We do not send it your content, and its job is to list and play tours.	The demos on the home page and the tour page, the quick start shown on your first visit, and the help centre — each only when you open it

That is the whole list. Images you put on a link page or in an email signature are served from a public address, because the people you send them to have to be able to see them. We do not sell personal data, we do not share it for advertising, and none of these companies is permitted to use your content for their own purposes. Your content is not used to train machine-learning models, by us or by them.

We would also disclose data if the law genuinely required it, and if a court order allowed us to tell you, we would.

Connecting Google Calendar

You can connect a Google account so that meetings made in one place show up in the other. Nothing here happens unless you connect it yourself, and disconnecting stops all of it.

What we ask Google for, and why

Permission	What we do with it
`calendar.events` See and change events on your calendars	Read your meetings so they appear in Drafteo's calendar, and write an event to Google when you make one in Drafteo. Both directions are the feature; read alone would be half of it.
`calendar.readonly` See your calendars	List which calendars you have, so we can read all of them rather than guessing at your main one. Most people keep work, personal and a couple of shared calendars, and reading only the primary one silently loses most of the day.
`userinfo.email` Your email address	Shown in the app so you can tell which Google account is connected, and so a second account replaces the first rather than sitting alongside it.

What we do with what comes back

Events are read when you look at the calendar, and not stored. They are fetched, merged with your Drafteo events, drawn, and discarded. There is no copy of your Google calendar in our database.
We only read the window you are looking at — the month or week on screen, not your history.
We write to Google only when you act. While a Google account is connected, making, changing or deleting an event in Drafteo sends that one event to your Google calendar, so the meeting exists in both places. Nothing is written on a schedule and nothing is written in the background.
Calendars you have hidden in Google stay hidden here. Unticking one there is a decision, and we treat it as one.

What we do not do with it

Your Google data is used only to provide the calendar feature you asked for, and it is used for nothing else. We do not transfer it to anyone, we do not use it for advertising, we do not sell it, we do not read it to build a profile of you, and no human at Drafteo reads it except in the narrow case where you ask us to look at something and we cannot help otherwise. It is never used to train, improve or evaluate any machine-learning model, ours or anybody else's. In particular, it is not sent to the assistant.

Drafteo's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

The keys, and taking it back

Connecting stores two tokens that let us act on your behalf. They are encrypted before they reach the database, with a key held on the server and not in it, so a copy of the database is not a set of keys to anybody's calendar. The connection belongs to you, not to your workspace: nobody else in it can see or use your calendar, and two people connect their own accounts separately.

Disconnect from the Google button at the top of the Calendar in Drafteo. That does two things rather than one: it deletes our copy of the tokens, and it tells Google to revoke them, so no live grant is left sitting on your Google account that you can no longer see from inside this app. You can also revoke it yourself at myaccount.google.com/permissions, and if you do, we notice and forget the connection rather than retrying it. Anything you already copied into Drafteo stays in Drafteo, and is yours to delete there.

Where it lives

Data is stored in the United States. If you are in the UK, the EU or elsewhere, that means your data is transferred outside your country; where those transfers need a legal basis, they rely on the standard contractual clauses our providers offer.

How long we keep it

While your account is open — as long as you keep it there.
Deleted boards — recoverable from the trash for 30 days, then permanently removed.
A closed account — removed from live systems within 30 days, and from backups as those age out.
A locked or unpaid workspace — kept, not deleted. We will not delete it without warning you first and giving you a chance to export.
Rate-limit counters — a day. Unused invitations — 30 days.
Google Calendar events — not kept at all. They are read when you look at the calendar and discarded. The connection's tokens are deleted the moment you disconnect.
Short-link visits — 400 days, so a campaign can be compared with the same campaign a year before, and then deleted.
Link-page counts — totals only, kept while the page exists.
Contacts, form answers and bookings — as long as the workspace keeps them. Deleting a form removes its answers; the contacts it created stay until the workspace deletes them.
Billing records — as long as tax law requires.

Keeping it safe

Everything travels over HTTPS, and the database connection is encrypted.
Passwords are hashed with bcrypt and never stored or logged in the clear.
Sessions live in an HttpOnly cookie, so a script on a page cannot read them.
Every request is scoped to your workspace at the database level, not just in the interface.
Signing out everywhere invalidates existing sessions.

No system is perfect. If a breach affects you, we will tell you and the relevant regulator as quickly as we reasonably can.

What you can ask for

Depending on where you live you may have the right to see the data we hold, correct it, delete it, take a copy elsewhere, object to a use, or complain to a regulator. In the UK that is the ICO; in the EU, your national authority; in Quebec, the Commission d'accès à l'information.

Ask by writing to hello@drafteo.io. We will answer within 30 days, and we will not charge you or treat you differently for asking.

If your account belongs to somebody else's workspace, they control that workspace's content — we may need to point your request at them.

Children

Drafteo is for work and is not directed at children under 16. We do not knowingly collect their data; if we learn we have, we will delete it.

Changes

If we change this notice in a way that matters, we will tell you by email or in the app before it takes effect. The date at the top says when this version was written.

Getting in touch

Write to hello@drafteo.io.