Privacy Policy
Last updated: 2026-10-11
1. Controller
druidori s.r.o., IČO 05164940, Kukučínova 799/10, Hulváky, 709 00 Ostrava, Czech Republic, registered in the Commercial Register kept by the Regional Court in Ostrava, Section C, Insert 66451. Contact for privacy matters: support@draftmill.io.
2. Two roles: controller and processor
- For account and billing data (your name, email, password hash, plan and subscription status, technical logs) we act as the data controller.
- For content you put into documents — which may include personal data of third parties — we act as your data processor and process it only on your instructions. The Data Processing Agreement (DPA) is published on our website and forms part of the Terms for business customers.
3. What we process and why
- Account data (name, email, hashed password, language) — to provide the Service; legal basis: contract performance.
- Sign-in with Google (optional) — if you choose “Continue with Google”, Google tells us your name, your email address and that Google has verified it. We keep the identifier of your Google account to recognise you next time, but no Google access tokens and no profile picture. Google handles the sign-in as an independent controller under the Google Privacy Policy. Legal basis: contract performance.
- How you found us — when you create an account with your email address, we record once the domain of the website that referred you (e.g. google.com, not the full address), campaign tags in the link you followed (utm_…), the first page of our site you opened and the page and template you signed up from. For a sign-up with Google we record only the template. We look at this in aggregate to learn which channels and pages work; it is kept with your account and deleted with it. No cookie or browser storage is used for it. Legal basis: legitimate interest.
- Billing data (plan, subscription status, Stripe customer and subscription ids) — to manage your subscription; legal basis: contract performance. Paid plans are sold through Link, a Stripe affiliate acting as merchant of record: Link collects your payment details, billing address and email at checkout, issues receipts and invoices, and processes this data as an independent controller under the Link privacy policy. Card numbers never reach our servers.
- Customer Content (templates, documents, variables, generated exports) — stored and rendered to provide the Service; processed as processor.
- Technical logs (IP address, user agent, timestamps, requested pages) — security, abuse prevention and diagnostics; legal basis: legitimate interest.
- Transactional emails (verification, sign-in links, password reset, invitations) — account lifecycle; legal basis: contract performance. An account created from a template with just an email address has no password: the link we email is how you sign in, and you can add a password at any time.
- Sign-up notifications — when an account is created, we send ourselves an email with its name, email address and how it found us (see above), to spot abuse and help new users get started; legal basis: legitimate interest.
- Support requests (your message and contact details; when you write from the app, also your account and organization, plan, the page you were on and your browser) — to answer you; legal basis: contract performance or legitimate interest.
For product improvement we use privacy-friendly, self-hosted analytics (Umami) on our public pages only — never inside the signed-in app. It sets no cookies, does not track you across sites and shares nothing with third parties. Your IP address is used only while the visit is recorded — to derive an approximate location (such as country and city) and an anonymised visitor identifier — and is not stored. Legal basis: legitimate interest.
Cookies
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
| NEXT_LOCALE | Remembers the language you chose | 1 year | Functional (set only when you pick a language) |
| next-auth.session-token | Keeps you signed in | 24 hours | Strictly necessary |
| next-auth.csrf-token | Protects sign-in against cross-site request forgery | Until you close the browser | Strictly necessary |
| next-auth.callback-url | Returns you to the page you came from after signing in | Until you close the browser | Strictly necessary |
| dm_active_org | Remembers which of your organizations you are working in | 1 year | Strictly necessary (only once you are signed in) |
| dm_signup | During sign-up with Google, remembers the template you chose to start with and the details you typed into it on the page — so your document can be created from them | 15 minutes | Strictly necessary (only when you start from a template and choose Google) |
Over HTTPS the sign-in cookies carry a __Secure- or __Host- prefix. In your browser's local storage the app remembers, per organization, only whether you have hidden the getting-started checklist; it is never sent anywhere. We use no analytics or advertising cookies, which is why we do not ask for cookie consent.
4. Recipients and sub-processors
| Recipient | Location | Purpose |
|---|---|---|
| Hetzner Online GmbH | FI / EU | Hosting & storage (servers, backups) |
| Stripe Payments Europe, Ltd. | IE / EU | Subscription management for paid plans (Stripe Managed Payments) |
| Resend (Plus Five Five, Inc.) | US* | Transactional email delivery |
| Cloudflare, Inc. | US* (data in the EU) | Off-site storage of backups, encrypted before they leave our servers |
| Namecheap, Inc. | US* | Forwarding of email sent to support@draftmill.io to our mailbox |
| WEDOS Internet, a.s. | CZ / EU | Our company mailbox (support email, sign-up notifications) |
* Transfers to the USA rely on the EU-U.S. Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses (SCCs). Email you send us and internal notifications about new sign-ups are kept in our company mailbox.
5. Retention
- Account and content data: for the life of the account; deleted upon account/organization deletion (self-service in the app).
- Generated export files: deleted automatically after 30 days.
- Invitations and emailed links (verification, sign-in, password reset): deleted 30 days after they expire or are accepted.
- Backups: automated nightly backups, encrypted and also kept off-site, are retained for 14 days, so deleted data disappears from them within 14 days.
- Web-server access logs: 14 days. Application logs are size-limited and overwritten continuously.
- Billing data we hold (plan, subscription status, Stripe identifiers): for the life of the organization. Receipts and invoices are issued and retained by Link.
- Support emails and sign-up notifications: as long as needed to handle the request or the account, then deleted.
6. Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection under the GDPR. In the app you can directly download your data (Account → Download my data) and delete your account or organization. For anything else contact support@draftmill.io. You may lodge a complaint with the Czech Office for Personal Data Protection (ÚOOÚ, uoou.gov.cz).
7. Security
TLS in transit, tenant isolation at the application layer, hashed passwords (bcrypt), rate-limited sign-in, least-privilege credentials for the database and storage, databases isolated from the internet behind a default-deny firewall, administrative server access restricted to the operator and possible only with an SSH key (password login is disabled), operating-system security updates installed automatically, and automated nightly backups, encrypted before they leave the server and kept off-site, with the decryption key held offline. No system is perfectly secure; we notify affected users and authorities of breaches as the GDPR requires.
8. Changes
Material changes to this policy are announced by email or in-app at least 14 days in advance.