Draftwell

Legal

Privacy Policy

Effective date: October 11, 2026·Last updated: October 11, 2026

Draftwell AI LLC ("Draftwell," "we," "us," or "our") provides spatial visualization, design, CRM, proposal, takeoff, ERP, and AI assistant software for design and construction teams (the "Services"), including our website at draftwell.ai, our web application, and our iOS application.

This Privacy Policy explains what information we collect, how we use and share it, and the choices you have. It is written to match how Draftwell actually works today—including authentication, optional connectors (Google, Microsoft, Salesforce, LinkedIn, Meta), AI features (OpenAI, Anthropic, xAI, and fal.ai), hosting (Supabase, Vercel, Railway), and payments (Stripe or Elavon when enabled).

By using the Services, you agree to this Privacy Policy. If you do not agree, do not use the Services.

1. Scope and roles

This policy covers personal information we process when you visit our marketing site, create an account, use Draftwell as an individual or organization member, connect third-party accounts, use AI features, sign proposals as a guest signer, or contact support.

For customer organization data you enter into Draftwell (for example CRM contacts, project files, and proposals), Draftwell typically acts as a service provider / processor to the organization that owns the workspace. That organization is responsible for its own privacy notices to its end customers. This policy describes Draftwell’s practices as the provider of the Services.

2. Information we collect

2.1 Account and profile information

When you sign up or complete onboarding, we collect information such as email address, name, display name, phone number, business name, company position, business designation, service location (state/county), preferred theme, unit system, subscription and add-on entitlements, and organization membership.

  • Sign-in methods we support: email (password and/or magic link / OTP), Sign in with Apple, and Google Sign-In (via Supabase Auth).
  • From Apple or Google identity providers we receive identity tokens and basic profile fields those providers share with us for authentication (typically email and name/subject identifiers), as permitted by your provider settings.

2.2 Organization, project, and business content

You and your organization may upload or create content in Draftwell, including but not limited to: LiDAR/RoomPlan scans and derived 3D models; floor plans and takeoff measurements; equipment catalogs and product data; CRM prospects, customer accounts, opportunities, tasks, notes, and files; proposals, document templates, estimates, and e-signature records; ERP vendors, purchase orders, bills, invoices, and schedules; collaboration comments and share links; and AI chat history, Business Brain documents, embeddings, and rendered images.

2.3 Optional connector data (only when you connect an account)

If an organization admin (or permitted user) connects a third-party service, we process the data needed to provide that connector. We store OAuth access/refresh tokens (encrypted at rest when our integration token vault key is configured) and account labels/metadata needed to keep the connection working.

  • Google (Connectors): openid, email, profile, Gmail send, and Google Drive — used to send email on your behalf and access Drive files you use with Draftwell features.
  • Microsoft: Outlook send (Mail.Send, User.Read, offline_access) and OneDrive (Files.ReadWrite, User.Read, offline_access) — used to send email and work with files you authorize.
  • Dropbox: OAuth tokens for file connector features you enable.
  • Salesforce: api and refresh_token — used to sync CRM/catalog or opportunity/quote data you choose to push or pull.
  • LinkedIn: openid, profile, email, and organization/member social scopes — used to publish social posts you explicitly accept.
  • Meta (Facebook Pages / Instagram): pages and Instagram content publish scopes — used to publish posts you explicitly accept to Pages/accounts you select.
  • Pinterest: not currently integrated. If we add a Pinterest connector later, we will update this policy and obtain any required consents before processing Pinterest user data.

2.4 AI feature inputs and outputs

When you use AI assistants, Business Brain, photoreal renders, or automated finish detection, we process prompts, conversation history, documents you index, reference images (including viewport captures and scan keyframes), and model outputs. Those materials may be sent to the AI subprocessors listed in Section 5 to generate a response or asset for you.

2.5 Payment information

If you purchase AI credit packs or other paid offerings through Draftwell, payment card data is collected and processed by our payment processor (Stripe and/or Elavon Converge, depending on configuration). We receive transaction metadata such as email, amount, product/SKU, and organization or user identifiers. We do not store full payment card numbers on Draftwell servers.

2.6 Proposal e-signature information

For guest signing flows we process signer name and email, consent records, optional one-time passcodes, signature images (which may be encrypted at rest), document integrity hashes, and privacy-preserving audit fingerprints derived from request metadata (we hash IP/user-agent; we do not store raw IP or user-agent for that audit trail).

2.7 Device, usage, and technical information

We automatically collect technical information needed to operate the Services, such as authentication session cookies, the active-organization cookie (dw_active_org), the multi-factor remember cookie (dw_mfa_ok, used so authenticator re-checks happen about once a month rather than on every visit), approximate timestamps of requests, security and rate-limit signals (including Redis-backed counters when configured), and mobile permission-related data when you grant access (for example camera, photo library, and world-sensing/LiDAR on iOS for scanning features).

We do not use advertising pixels, remarketing tags, or third-party product analytics vendors (such as Google Analytics, Meta Pixel, PostHog, Segment, or Mixpanel) in the Draftwell web application today. Our iOS Privacy Manifest declares that Draftwell does not engage in tracking as defined by Apple. Marketing pages may embed third-party players (for example YouTube), which can set their own cookies under those providers’ policies.

2.8 Communications

If you contact us or we send transactional messages (invites, magic links, estimate/offer emails, schedule invites, e-sign OTPs, and similar), we process the content of those communications and delivery metadata via our email provider (Resend) and/or Supabase Auth email delivery.

3. How we use information

We use personal information to:

  • Provide, maintain, secure, and improve the Services (accounts, organizations, projects, CRM, proposals, takeoff, ERP, scanning/3D, collaboration).
  • Authenticate users and manage sessions (including Apple and Google sign-in).
  • Operate optional connectors you enable (email send, file access, Salesforce sync, social publish).
  • Provide AI features you request, including chat, embeddings/search over Business Brain content, image rendering, and finish detection.
  • Process payments and credit purchases when enabled.
  • Send transactional and service-related communications.
  • Enforce terms, prevent abuse, debug issues, and comply with law.
  • Support customer requests, including account deletion requests submitted to support.

3.1 What we do not do with your data

  • We do not sell personal information.
  • We do not share personal information for cross-context behavioral advertising.
  • We do not use Google user data (or other restricted connector data) to serve ads, build advertising profiles, or determine creditworthiness.
  • We do not use customer content submitted to AI features to train general-purpose foundation models for unrelated third parties. AI providers process prompts and related content under their API terms to return results for your request. Separately, Draftwell may improve Draftwell-owned finish-detection models using labeled training examples created in our internal ML tooling; that is Draftwell product improvement, not sale of your CRM or connector data to advertisers.

4. Google user data and Limited Use

Draftwell’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, when you connect Google for Sign-In or for Gmail/Drive connectors:

  • We access Google user data only to provide or improve user-facing features that are prominent in Draftwell (authentication; sending email you compose/initiate; accessing Drive files in connection with Draftwell workflows you use).
  • We do not transfer Google user data to third parties except (a) as necessary to provide or improve those user-facing features, (b) for security purposes, (c) to comply with applicable law, or (d) as part of a merger, acquisition, or asset sale with notice where required—and never for advertising or data-broker purposes.
  • We do not use Google user data for serving advertisements.
  • We do not allow humans to read Google user data unless (a) we have your affirmative agreement for specific data, (b) it is necessary for security/abuse investigation, (c) it is necessary to comply with law, or (d) use is limited to aggregated data for internal operations consistent with applicable privacy laws.
  • We do not use Google Workspace data to train generalized AI/ML models in a manner prohibited by Google’s Limited Use rules.

Policy reference

For more detail on Google’s requirements, see the Google API Services User Data Policy at https://developers.google.com/terms/api-services-user-data-policy.

5. Service providers and subprocessors

We share personal information with service providers that process data on our behalf to operate the Services. They are not authorized to use it for their own unrelated marketing. Key categories include:

  • Supabase — authentication, Postgres database, file storage, and realtime features.
  • Vercel — hosting and delivery of the Draftwell web application and server routes.
  • Railway — conversion/worker jobs (for example model conversion, document-to-PDF, finish detection, Business Brain ingest) that may process files and call AI APIs.
  • Redis (when configured) — rate limiting and job queues.
  • OpenAI, Anthropic, and xAI — AI inference for chat and related assistant features; OpenAI may also be used for embeddings and vision-based finish detection.
  • fal.ai — image generation/editing for photoreal renders from prompts and reference images.
  • Resend — transactional email delivery.
  • Stripe and/or Elavon — payment processing for purchases when enabled.
  • Apple, Google, Microsoft, Salesforce, LinkedIn, Meta, and Dropbox — only when you choose those sign-in or connector features; data is exchanged as needed to authenticate or perform the connected action.

5.1 Platform-specific notes

  • Apple: We use Sign in with Apple for authentication. We request identity information needed to create and maintain your account. Camera, photos, and world-sensing permissions on iOS are used for scanning and related product features you initiate—not for tracking across apps and websites owned by other companies.
  • Microsoft: Outlook and OneDrive data are used only to send mail or access files for features you enable, consistent with the Microsoft identity permissions you grant.
  • Meta and LinkedIn: We use connected accounts to publish content you explicitly approve. We do not use Meta or LinkedIn APIs to scrape friend/connection graphs for advertising. You can disconnect connectors in Draftwell settings (subject to your role permissions).
  • Salesforce: Connected org data is used for CRM sync and proposal-related workflows you initiate.
  • OpenAI, Anthropic, and xAI: Prompts, tools context, and related content are sent to generate responses for your organization. Do not submit data to AI features that you are not permitted to process.
  • Supabase, Vercel, and Railway: Process infrastructure, application, and storage data as our hosting and data-platform providers.

6. Cookies and similar technologies

We use cookies and similar technologies that are necessary for authentication and core product function (for example Supabase auth session cookies, the dw_active_org organization context cookie, and the dw_mfa_ok authenticator remember cookie). We do not currently deploy advertising or third-party analytics cookies in the authenticated product. Embedded third-party media on marketing pages may set their own cookies.

7. Retention

We retain personal information for as long as your account or organization workspace remains active, and for a reasonable period afterward as needed to provide the Services, resolve disputes, enforce agreements, maintain security backups, and meet legal obligations.

Organization owners may delete an organization (which cascades deletion of org-owned records according to our database rules). Individual account deletion is handled as described in Section 9. Export tools in the product may allow download of certain project files; that is not a complete portable copy of all personal data unless we provide one upon request.

8. Security

We implement administrative, technical, and organizational measures designed to protect personal information, including transport encryption (HTTPS), access controls and row-level security in our database, optional encryption of integration tokens and e-signature images, and least-privilege service roles. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

9. Your choices, access, and deletion

Depending on where you live, you may have rights to access, correct, delete, export, or restrict certain processing of personal information, and to object to certain processing. You may also withdraw consent where processing is based on consent (for example by disconnecting a connector or stopping use of an optional feature).

9.1 How to request deletion of your Draftwell account and data

In-product Settings currently routes account deletion to our support team. To delete your Draftwell account and associated personal data, email hello@draftwell.ai from the email address on your account with the subject line “Account deletion request.” We will verify your identity and process the request, including deletion or anonymization of personal data we control, except where we must retain information for legal, security, or legitimate business recordkeeping reasons (for example payment records or fraud prevention).

Organization-owned business data may require action by an organization owner (including deleting the organization) when that data is shared across members. Guest proposal signers may contact us to request deletion of signer personal data associated with a signing session.

Step-by-step instructions are also posted at https://draftwell.ai/data-deletion for use as our public data-deletion instructions URL (including for Meta App Dashboard configuration).

9.2 Connector disconnection

You (or an org admin, depending on the connector) can disconnect Google, Microsoft, Dropbox, Salesforce, LinkedIn, Meta, and similar integrations in Draftwell. You should also revoke Draftwell’s access in the third-party provider’s security/apps settings if you want to end access at the source.

9.3 Privacy requests

To exercise privacy rights or ask questions, email hello@draftwell.ai. We will respond within the time required by applicable law.

10. Children

The Services are designed for business use and are not directed to children under 13 (and not intended for children under 16 where that is the relevant standard). We do not knowingly collect personal information from children. If you believe a child has provided personal information, contact us and we will take appropriate steps to delete it.

11. International transfers

We and our service providers may process information in the United States and other countries where we or they operate. Those countries may have data-protection laws different from your jurisdiction. Where required, we use appropriate transfer mechanisms and contractual protections with subprocessors.

12. U.S. state privacy disclosures

If you are a resident of California or another U.S. state with consumer privacy laws, you may have rights to know/access, delete, correct, and opt out of “sale” or “sharing” of personal information, and to non-discrimination for exercising those rights.

Draftwell does not sell personal information and does not share personal information for cross-context behavioral advertising as those terms are commonly defined. To submit a request, email hello@draftwell.ai. We may need to verify your identity and authority (including for agent requests).

13. EEA/UK disclosures

Where GDPR/UK GDPR applies, we process personal information under one or more of these bases: contract performance (to provide the Services), legitimate interests (secure and improve the Services, prevent abuse), consent (optional connectors, certain communications, or AI features where consent is the appropriate basis), and legal obligation.

You may have rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with a supervisory authority. Contact hello@draftwell.ai to exercise rights.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated policy at https://draftwell.ai/privacy and revise the “Last updated” date. If we change how we use Google user data or other material practices, we will provide additional notice and obtain consent where required before using data in a new way.

15. Contact us

Draftwell AI LLC

Website: https://draftwell.ai

Privacy and deletion requests: hello@draftwell.ai

For Google API user-data questions, use the same contact and reference “Google user data.”

Questions? Contact hello@draftwell.ai.