Privacy Policy

Last updated: September 28, 2026

DraftBay (“DraftBay”, “we”, “us”) runs the web app at draftbay.ai. It helps teams plan website structure (sitemaps), manage website copy, run review and approval workflows, collaborate, and get help from an AI assistant.

This policy explains, in plain language, how we handle personal information. If anything here is unclear, email us at info@draftbay.ai.

Want the one-page summary first? Your data covers hosting, workspace separation, backups, staff access, AI, payments and deleting your data.

The short version

• You own your content. We use it only to run DraftBay for you.
• We don’t sell personal data, and we don’t use advertising trackers.
• Each customer workspace is kept separate from every other workspace at the database level.
• We never see your password or your card number — our login and payment providers handle those.
• You can ask us to see, correct, export, or delete your data at any time.

What we collect

Information you give us

• Account details: your name and work email. Your password is handled by our authentication provider — we never see or store it in plain text.
• Workspace details: your workspace or company name.
• Team members: the names and email addresses of people you invite to your workspace.
• Your content: anything you put into DraftBay — site structure, page names and URLs, copy titles, comments, links to documents stored elsewhere (such as SharePoint or Google Drive), and files or attachments you upload.
• Contact-form messages: what you send us through our contact form.

Information created as you use DraftBay

• Activity logs: who changed or approved what, and when. This powers your workspace’s history and approval trail.
• Email records: the emails we send you or your team, and basic delivery logs (for example, whether an email was delivered).
• Billing status: whether your workspace is on a trial or a paid plan, and your subscription status. We do not store card numbers — our payment provider, Stripe, does.
• Standard server and log data: things like IP address, browser type, and the time of requests, which our hosting and database providers record to keep the service running and secure.

How we use it

We use your information only to:

• Provide, maintain, and improve DraftBay.
• Create and secure your account and workspace.
• Send the emails the product needs to work (invites, assignments, reminders, billing notices).
• Run the AI assistant when you choose to use it.
• Handle billing and subscriptions.
• Answer your questions and support requests.
• Prevent abuse, fix problems, and keep the service secure.
• Meet legal, tax, and accounting obligations.

We do not sell personal data, and we do not share it with advertisers.

Your content is yours

You and your organization own the content you put into DraftBay. We use it only to provide the service to you. Each customer workspace is isolated from other workspaces at the database level, so one customer can’t see another customer’s data.

Inside your workspace, people see what their role allows. Workspace owners and admins decide who is invited and what they can do.

When DraftBay staff can see your workspace

• DraftBay staff can open your workspace only to give support you ask for, fix a problem, keep the service secure (for example, investigating abuse), handle billing, or meet a legal obligation. We don’t browse your content for any other reason, and we never use it for anything other than running DraftBay for you.
• Only a small number of DraftBay staff have this access.
• Every time staff open your workspace, use the assistant in it, or change anything in it, it’s recorded in a log that staff can’t edit or delete. Your workspace’s owners and admins can see it any time under Settings → “DraftBay support visits”.
• Anything staff change shows as “DraftBay support”, so it’s never mistaken for one of your team.

The AI assistant

DraftBay includes an optional AI assistant powered by Anthropic. When you ask the assistant a question, the relevant information from your workspace (for example, page names, copy titles, or comments related to your question) is sent to Anthropic’s API so it can generate an answer.

• We use Anthropic only to provide the assistant feature.
• We do not use your content to train AI models.
• Once a day, DraftBay’s Board also reviews each active project automatically: page names, copy status, Board items and answers, and team notes are sent to Anthropic to suggest tasks and questions. Nothing else is sent unless someone uses the assistant.

Service providers we use

We rely on a small number of trusted companies to run DraftBay. They process data on our behalf, only to provide their service to us:

• Supabase — database, user login (authentication), file storage, and serverless functions.
• Netlify — website hosting.
• Stripe — payments, subscriptions, invoices, and tax. Stripe handles your card details directly.
• Resend — sending product emails from noreply@draftbay.ai.
• Google Workspace — our info@draftbay.ai inbox, where your emails to us arrive.
• Anthropic — the AI assistant (see above).
• GoDaddy — our domain name and DNS.

We may also share information if the law requires it, to protect people’s safety or our rights, or as part of a merger or sale of the business (in which case this policy would continue to apply to your data).

Emails we send

We send emails that the product needs in order to work — for example, workspace invitations, task assignments, review reminders, and billing notices. These come from noreply@draftbay.ai.

We don’t send marketing newsletters unless you choose to sign up for them, and you can unsubscribe from those at any time.

Cookies, analytics and tracking

We use only what’s needed to keep you signed in and make the app work. We don’t use advertising trackers.

In the future we may use privacy-friendly website analytics that only look at overall, aggregate usage (not individual people). If we do, we’ll update this policy.

Security

We take reasonable steps to protect your information, including:

• Encryption in transit — everything is sent over HTTPS.
• Access controls, so only authorized people and systems can reach data.
• Role-based permissions inside each workspace.
• Separation of each customer workspace at the database level.

No system is 100% secure, so we can’t guarantee absolute security. If we become aware of a breach that affects your personal information, we’ll notify you and the appropriate authorities as the law requires.

How long we keep data

We keep your information for as long as your account or workspace is active, or as long as we need it to provide the service.

You can ask us to delete your account or workspace at any time by emailing info@draftbay.ai. We’ll delete or anonymize your data within a reasonable period, except for records we must keep by law (for example, billing and tax records).

Your rights

You can ask us to:

• Access the personal information we hold about you.
• Correct anything that’s wrong.
• Delete your information.
• Export your information in a usable format.

To make a request, email info@draftbay.ai. We may need to confirm your identity first. If you were invited to a workspace by someone else, we may also involve the workspace owner, since they control that workspace’s content.

DraftBay is based in Canada, and we handle personal information in line with Canadian privacy law, including the Personal Information Protection and Electronic Documents Act (PIPEDA). If you are in the European Union, the United Kingdom, or California, you may have additional rights under your local laws — contact us and we’ll help you exercise them. You also have the right to complain to your local privacy regulator.

Where data is stored

Our service providers may store and process data in Canada, the United States, or other countries. When your information is handled outside your country, it may be subject to the laws of that country. We choose providers that protect data with appropriate safeguards.

Children

DraftBay is a business tool and isn’t meant for children. We don’t knowingly collect personal information from anyone under 16.

Changes to this policy

We may update this policy from time to time. When we do, we’ll change the “Last updated” date above. If a change is significant, we’ll let account owners know by email or in the app before it takes effect.

Contact us

Questions, requests, or concerns about privacy? Email info@draftbay.ai and a real person will get back to you.

See also our Terms of Service.