Privacy Policy

1. Who we are

Draftful ("Draftful", "we", "us") is an AI content platform that analyzes a company's website, plans topics, researches keywords, writes and fact-checks SEO articles, and measures how those articles perform in Google Search and in AI assistants. Draftful is operated by Willy de Camargo Bueno (CNPJ 57.192.787/0001-58), Avenida Salvador Tomás de Farias 18, Centro, Sapopema – PR, CEP 84290-000, Brazil.

For personal data about our own account holders and website visitors, we are the data controller. For personal data that our customers put into their workspaces (for example, names in their own content), we process it on the customer's behalf. Questions about this policy: contact@draftful.app.

2. Data we collect

Account data

• Name, email address and a hashed password, or, if you use "Sign in with Google", your Google account ID, name, email address, profile picture URL and whether Google has verified your email.
• Preferences such as interface language, onboarding progress and when you last used the app.
• Workspace membership, your role and the email addresses of people you invite.

Workspace content

• The website domain you add, public pages we crawl from it, brand details, competitors, personas, topics, keywords, briefs, articles, images and your edits.
• Reference images you upload and webhook endpoints you configure (webhook secrets are stored encrypted).

Google user data

Only when you choose to connect them. See Google user data below for exactly what we access and how we use it.

Billing data

Payments are handled by Stripe. We receive your plan, billing status, billing country, tax ID if you provide one, and the last four digits and brand of your card. We never see or store your full card number.

Technical and usage data

• IP address and browser user agent, stored with your login session.
• Product usage events (for example, "article generated") linked to your user ID, collected with PostHog. We don't send your name or email to PostHog, don't record sessions and honor Do Not Track.
• Error reports collected with Sentry, with personal data and secrets removed before sending.
• If you use our free site analyzer without an account, we store the domain you entered, a one-way hash of your IP address and, optionally, the email address you ask us to send the report to. This is deleted after 7 days.

3. Google user data

Draftful asks for access to Google data in two separate, optional steps. You're never asked for Search Console or Google Analytics access just to sign in.

What we access

Both data scopes are read-only. Draftful can't change anything in your Search Console or Google Analytics accounts. We only request aggregate reports: we don't request data about individual visitors to your website.

How we use it

• Sign-in data is used only to create your account, log you in and show your name and picture in the app.
• Search Console and GA4 data is used only to provide features you see in Draftful: performance dashboards for your site and each article; finding articles that are losing traffic or are close to ranking on page one ("refresh opportunities"); and measuring whether a refreshed article improved.
• When you accept a refresh opportunity, the relevant Search Console figures for that page (clicks, impressions and positions for two comparison periods) are included in the instructions we send to our AI provider to write the refresh brief for that article. They are sent only to produce that brief for you.

What we don't do with it

• We don't sell Google user data.
• We don't use or transfer it for advertising, including retargeting, personalized or interest-based ads.
• We don't use it to develop, improve or train generalized or non-personalized AI or machine-learning models, and we don't allow our AI providers to do so.
• We don't use it to determine creditworthiness or for lending.
• We don't share it with data brokers or information resellers.
• Our staff don't read it, except with your explicit permission (for example, when you ask us to investigate a support issue), when needed for security (such as investigating abuse), to comply with the law, or in aggregated, anonymized form for internal operations.

Sharing

Google user data is shared only with the service providers that run Draftful on our behalf (our hosting provider and, for refresh briefs, the AI provider described above), under contracts that restrict them to processing it for us. It is visible to members of the workspace the connection belongs to. We don't transfer it to anyone else, except as required by law or as part of a merger or acquisition, where the recipient would be bound by this policy.

Storage and protection

The Google refresh token that lets us keep your data up to date is encrypted at rest and never returned by our API. Access tokens are short-lived and kept only in our server cache. All data travels over HTTPS. Access within Draftful is limited to your workspace, and only workspace owners and admins can connect or disconnect Google accounts.

Retention and deletion

• Synced Search Console and GA4 data is kept while the connection is active, so dashboards and trend comparisons keep working.
• When you disconnect Search Console or GA4 in Settings → Integrations, we immediately delete the stored token and all data synced from that service for the workspace.
• When your account or workspace is deleted, all associated Google data is deleted with it (see Deleting your data).

Revoking access

You can revoke Draftful's access at any time from your Google account at myaccount.google.com/permissions. After you revoke it, we can no longer read new data; disconnect in Draftful as well to delete the data already synced.

Limited Use

Draftful's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use your data

We don't sell your personal data and we don't use your workspace content or Google user data to train AI models.

5. AI processing

To generate and check content, Draftful sends workspace content (for example, your site's public pages, brand details, keywords and drafts) to AI model providers through their APIs. We use providers whose API terms don't permit them to train their models on the data we send, and they keep it only as long as their abuse-monitoring policies require.

AI Visibility monitoring sends questions about your market (for example, "best tools for X") to AI assistants and checks whether your brand and competitors are mentioned. These questions don't include your personal data.

6. Service providers we share data with

We use the following service providers (sub-processors). Each gets only the data it needs for its task.

We also share data when you tell us to (for example, sending an article to a webhook you configured), when required by law, to protect our rights and users, or with a successor in a merger or acquisition, which would remain bound by this policy.

7. Cookies and local storage

• Strictly necessary: a session cookie and a CSRF cookie that keep you logged in and protect forms, and a local-storage entry that remembers your language.
• Analytics: PostHog stores an identifier in a cookie and local storage to count product usage. Where the law requires consent (for example, in the UK and the EU), we only set it after you agree, and you can withdraw consent at any time.
• Security: Cloudflare Turnstile may set a cookie when you use the free analyzer, to tell people apart from bots.

We don't use advertising cookies, and we don't run Google Analytics on the Draftful website.

8. How long we keep data

• Account and workspace data: for as long as your account is active.
• Search Console and GA4 data: while the connection is active, as described above.
• Free analyzer results: 7 days.
• Server logs and failed-job records: about 7 days.
• Billing records: as long as tax and accounting law requires, typically up to 7 years.

9. Deleting your data

You can disconnect Google services, remove team members and export your articles (Markdown or HTML) at any time from inside Draftful.

To delete your account or a workspace and all data associated with it, including any Google user data, email contact@draftful.app from the email address on your account. We'll confirm the request and complete the deletion within 30 days. Cancel any paid subscription first so you aren't billed again. Copies in backups, if any, are overwritten in the normal backup cycle. We keep only what we must keep by law, such as invoices.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. Email contact@draftful.app and we'll respond within 30 days (or sooner where the law requires it). We may need to verify your identity first.

UK and European Union (including Spain)

You may also complain to your data protection authority, for example the UK Information Commissioner's Office (ico.org.uk) or Spain's Agencia Española de Protección de Datos (aepd.es).

United States, including California

We collect the categories of data described in Data we collect for the purposes in How we use your data. We don't sell personal information or share it for cross-context behavioral advertising, and we don't use sensitive personal information to infer characteristics about you. You have the right to know, correct and delete your personal information, and we won't discriminate against you for using these rights. You can use an authorized agent to make a request.

11. International transfers

Our service providers operate in several countries, including the United States. When we transfer personal data from the UK or the EU to countries without an adequacy decision, we rely on safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.

12. Security

We use HTTPS for all traffic, hash passwords, encrypt OAuth refresh tokens and webhook secrets at rest, limit each workspace's data to its members, and restrict staff access to production systems. No system is perfectly secure; if a breach affects your personal data, we'll notify you and the authorities as the law requires.

13. Children

Draftful is a business tool and isn't meant for anyone under 16. We don't knowingly collect data from children. If you think a child has given us personal data, email contact@draftful.app and we'll delete it.

14. Changes to this policy

We'll post any changes on this page and update the effective date. If a change materially affects how we use your data, including Google user data, we'll tell you by email or in the app before it takes effect and, where required, ask for your consent again.

15. Contact

Willy de Camargo Bueno (CNPJ 57.192.787/0001-58), Avenida Salvador Tomás de Farias 18, Centro, Sapopema – PR, CEP 84290-000, Brazil. Email: contact@draftful.app.