Privacy Policy

1. Who we are

Draftedly ("we", "our", "us") is a proposal and payment platform for freelancers and small studios, operated at draftedly.com. This policy explains what personal data we collect, why we collect it, and how we handle it.

If you have questions, email us at hello@draftedly.com.

2. Data we collect

3. How we use your data

We use the data we collect to:

• Provide, maintain, and improve Draftedly
• Authenticate you and keep your account secure
• Send transactional emails: proposal notifications, payment receipts, and magic link logins
• Process payments via Stripe on your behalf
• Generate proposal analytics visible only to you
• Respond to support requests
• Send product updates (you can unsubscribe at any time from any email)

We do not sell your data, use it to train AI models, or share it with advertisers.

4. Google OAuth

When you sign in with Google, we receive your name, email address, and profile photo from Google. We use this information solely to create and identify your Draftedly account. We request only the minimum scopes needed: your basic profile and email address.

We do not access your Google Drive, Gmail, Calendar, or any other Google services. You can revoke Draftedly's access at any time from your Google Account permissions page.

5. Payments and Stripe

All payment processing is handled by Stripe. When you connect your Stripe account, payouts go directly from your clients to your Stripe account. Draftedly never holds, stores, or has access to your bank details or your clients' card numbers.

Stripe's privacy policy applies to payment data: stripe.com/privacy.

6. Data sharing

We share data only with the third-party services that power Draftedly:

• Supabase - database and authentication hosting
• Stripe - payment processing and Connect payouts
• Resend - transactional email delivery
• Vercel - application hosting and edge delivery
• Google - OAuth sign-in (if you choose to use it)

We may disclose data if required by law, court order, or to protect our legal rights.

7. Data retention

We retain your account data for as long as your account is active. Proposal data, signatures, and payment records are kept for the life of your account and for a reasonable period afterward for legal and audit purposes.

If you delete your account, your personal data is removed within 30 days. Aggregated, anonymized data may be retained indefinitely.

8. Your rights

You have the right to:

• Access - request a copy of the data we hold about you
• Correct - update inaccurate information via your account settings
• Delete - request deletion of your account and associated data
• Export - download your proposals and data at any time
• Unsubscribe - opt out of marketing emails via the unsubscribe link in any email

To exercise any of these rights, email hello@draftedly.com. We will respond within 30 days.

9. Cookies

We use cookies strictly for authentication (to keep you logged in) and session management. We do not use advertising or tracking cookies. You can disable cookies in your browser, but doing so will prevent you from staying signed in.

10. Security

All data is encrypted in transit (TLS) and at rest. We use Supabase's row-level security to ensure users can only access their own data. Passwords are never stored - authentication is handled via Google OAuth or email magic links only.

11. Children

Draftedly is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

12. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email or by posting a notice on the site. Continued use of Draftedly after changes take effect constitutes acceptance of the revised policy.

13. Contact

Questions about this policy? Email us at hello@draftedly.com.