This Privacy Policy explains how Draftiro ("we," "us," or "our") collects, uses and shares information when you use draftiro.com, the Draftiro web app and the Draftiro Word add-in (the "Service"). Draftiro is software for legal professionals; it is not a law firm. Privacy questions: privacy@draftiro.com. Support: support@draftiro.com.
1. Information We Collect
- Account and profile: name; email; password (stored by our authentication provider, Supabase, as a one-way hash); your Google name and photo if you sign in with Google; and optional details such as bar number and state, firm name, default hourly rate, notification email, AI preferences and email signature.
- Firm and team: member names, emails and roles, and invitations you send.
- Matter content: matters, client and opposing-party details, notes, deadlines, tasks, time entries, drafts, uploaded files and the text extracted from them (including by OCR), conflict-check entries, Discovery Review materials (where enabled), documents you work on through the Word add-in, and AI conversations. This content often includes personal information about your clients and other people; we process it on your firm's behalf (Section 6).
- Microsoft 365 (only if you connect it): calendar events (title, time, location, and a short preview of the description); each time you sync your inbox, your 50 most recent inbox messages (sender name and address, subject, a short preview of the body, received time, and read status); files you choose to import from OneDrive or SharePoint; email you choose to send through Draftiro; and encrypted connection tokens.
- Billing: plan and billing status. Stripe processes payments; we receive limited card details (such as brand and last four digits), not full card numbers.
- Communications and feedback: support emails, response ratings, survey answers, and reasons you give for cancelling or deleting.
- Usage, device and security data: IP address and browser type; a log of significant account actions; product events; error reports; and cookieless page-view analytics.
- On your device: your sign-in session, preferences and unsaved draft text are kept in your browser's localStorage. Sign out on shared devices.
2. How We Use Information
- Provide, operate, secure and support the Service.
- Answer AI requests and return drafting and research assistance.
- Sync your connected calendar and inbox, match messages to matters, create calendar events and send email you ask us to send, and import files you select.
- Send transactional emails (sign-in, billing and account messages, support responses).
- Investigate quality problems, errors, abuse and security incidents.
We do not use your matter content to train or improve AI models. If you rate an AI response, we store the rating with that response so we can investigate quality problems. We do not sell personal information or use it for advertising or behavioral profiling.
3. Storage and Security
Your firm's data is stored in a shared database and file storage run by Supabase on Amazon Web Services in the United States (us-east-1). Firm data is separated by row-level security on signed-in requests; some background and administrative processes (such as billing webhooks, scheduled jobs and account administration) run with elevated database access and rely on application checks instead. Vercel delivers the application and does not store your matter content.
We use administrative, technical and physical safeguards designed to protect information, including encryption in transit, encryption at rest by our database and storage provider, role-based access, and firm-scoped access controls. Browser localStorage is not covered by that at-rest encryption. No system is completely secure. If we confirm unauthorized access to your firm's data, we will notify the account owner without undue delay.
4. AI Processing
When you use AI features (chat, drafting, summaries, document review, Discovery Review where enabled, and the Word add-in), Draftiro sends your request and the matter context needed to answer it — case details, document excerpts and recent conversation history — to Google's Gemini API, the AI provider configured for your Draftiro workspace. Uploaded documents are also sent to Gemini for text extraction and search indexing. We use Gemini under Google's paid-service terms: Google does not use this data to improve its products, but may log it for a limited period to detect abuse and for legally required disclosures, and may process it in any country where it operates. Google Search grounding (web search) is off. Before we turn it on, we will update this policy: Google's terms allow it to keep search-grounded requests for up to 30 days to operate and test search grounding.
To find and check case law, Draftiro sends CourtListener, a public legal database run by the nonprofit Free Law Project, short search terms (with party and client names removed) and the case citations it detects in AI answers — not your full message. We do not have a data-processing agreement with CourtListener.
Draftiro does not use your matter content to train AI models. Before we send AI requests to any other AI provider, we will update this policy and our subprocessor list. AI conversation history is stored in Draftiro and may be visible to other members of your firm who can access the matter.
5. Sharing
We share information only with:
- service providers that operate Draftiro for us, listed with what each receives on our subprocessor page;
- CourtListener, as described in Section 4;
- other members of your firm, according to their role — access is generally firm-wide, and Draftiro does not currently offer matter-level ethical walls;
- people you choose to share with;
- authorities or others when required by law or valid legal process, or to protect the rights, safety and security of users, Draftiro or others — and if we receive a demand for your firm's content we will notify you first unless the law forbids it; and
- a successor in a merger, acquisition or sale of assets, subject to this policy.
We do not sell personal information or share it for cross-context behavioral advertising.
6. For Law Firms: Client Confidentiality
Your firm decides what client information to put into Draftiro and remains responsible for its professional obligations, including any client notice or consent. For matter content, Draftiro acts as your firm's service provider and uses it only to provide, secure and support the Service for your firm. Our software processes it automatically to deliver features (for example search indexing, AI answers and inbox-to-matter matching). Draftiro personnel do not view matter content except to provide support you request, to investigate a security, abuse or technical problem, to complete a deletion request, or as required by law.
Using Draftiro does not waive any privilege, and Draftiro claims no ownership of your content. If a client or other person asks us about information your firm stored, we will refer them to your firm.
7. Retention and Deletion
| Data | How long |
|---|---|
| Account, firm and matter content | While your account exists, until a verified deletion request is completed |
| Files you delete in the app | Moved to Trash; kept until restored or until your account is deleted |
| Matters | Can be archived, not deleted, in the app; removed when your account is deleted |
| AI conversations | Until you delete the conversation or your account is deleted |
| Audit log (including IP address and browser) | For the life of the firm account |
| Microsoft 365 copies | Calendar copies and connection tokens are deleted when you disconnect; saved inbox previews are kept until your account is deleted |
| Database backups | Encrypted; expire on our database provider's rolling schedule |
| Error reports and product usage events | Error reports are kept for a limited period set by our error-monitoring provider; product usage events currently have no set expiry |
| Billing records | As long as needed for tax and accounting; Stripe keeps its own records |
| AI and legal-search providers | Google: limited abuse-monitoring logs under its terms. CourtListener: under its own policies |
Account deletion is a reviewed request, not an automatic purge. Request it in Settings → Delete account or by emailing support@draftiro.com. We record the request, verify it against your account, and then a member of our team completes it, deleting or irreversibly anonymizing your firm's data. We aim to complete verified requests within 30 days. Encrypted backups expire on their normal cycle. Export anything you want to keep first.
8. Your Choices and Requests
You can update your profile in Settings, export your firm's records (Settings → Download my data, a JSON file of your firm's records; files and time entries download separately, and some records are not included), delete conversations, disconnect Microsoft 365, unsubscribe from product emails, and request account deletion (Section 7).
To ask what personal information we hold about you, or to correct or delete it, email privacy@draftiro.com. We respond within 30 days and may need to verify your identity. If you are a client or other person whose information a law firm stored in Draftiro, please contact that firm; we will help it respond. Depending on where you live you may have additional rights, and we will honor them as the law requires.
10. International Users and Children
Draftiro is offered to legal professionals in the United States. Data is stored in the United States, and some providers (such as Google) may process it in other countries. Draftiro is for adults using it for professional work. It isn't directed to children, and we don't knowingly collect information from anyone under 18.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email and/or a notice within the Service at least 14 days before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.
12. Contact
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our privacy team at: privacy@draftiro.com