DraftStack

Privacy Policy

DraftStack, Inc. · Last updated October 15, 2026

This Privacy Policy explains what DraftStack, Inc. ("DraftStack," "we," or "us") collects when you use DraftStack, why we collect it, who we share it with, and what choices you have. It also describes, where applicable, the categories, sources, purposes, and retention criteria required by U.S. state privacy laws. It covers our website, the web application at app.draftstack.io, and the DraftStack add-in for Microsoft Word. It is part of our Terms of Service.

1. The short version

  • The substance of your deal is encrypted in your browser before it reaches us. We store the sealed form.

  • We keep the small amount of information the Service needs to run in the clear. Section 3 lists all of it.

  • We do not sell your information, we do not run advertising, and we do not use analytics or tracking cookies.

  • We use a small number of outside providers to run the Service. Section 5 names each one and says what it sees.

2. What we collect

2.1 Account information. When you create an account: your email address, your name, and your firm.

2.2 Deal Content. Everything you or the people you invite put into a deal: documents, file names, deal names, party names and firms, messages, issues, tasks, questions, prices, and signature records. This is sealed in your browser before upload.

2.3 Information about people on a deal. The email address of each person invited, and a role label such as "Buyer's counsel."

2.4 Signing information. For electronic signing: the one-time codes we email (stored only in a form that cannot be reversed, and short-lived), the public part of each passkey and an identifier for it, and the time and version of each signature. We never receive a biometric, a passkey's private key, or a device PIN.

2.5 Billing information. Payments are handled by Stripe. We receive and store a Stripe customer identifier, a subscription identifier, your plan, and your payment status. We do not receive or store card numbers.

2.6 Technical information. Like any web service, our hosting provider records technical request data, such as IP address, browser type, and the time and address of a request, for security and troubleshooting. These logs do not contain Deal Content.

2.7 Information from your browser. The Service stores a sign-in token and a few small settings in your browser's local storage, and the key for a deal you have opened in your browser's session storage. We do not set cookies and we do not use analytics or advertising trackers. These storage technologies support sign-in and deal functionality and are not used for advertising. If we introduce non-essential cookies or similar tracking technologies, we will update this Policy and obtain consent where required.

2.8 U.S. state privacy notice. We collect the categories described in Sections 2.1–2.7 directly from you or your Subscriber, from people you invite or who participate in a deal, automatically from your browser or device, and from service providers such as hosting, email, and payment providers. We use them for the purposes in Section 4, including providing, securing, supporting, billing for, and maintaining the Service, communicating with you, preventing abuse, and complying with law. The retention criteria for these categories are described in Section 6.

2.9 California and other state-law categories. For purposes of California and similar state laws, the information described above may include identifiers and contact information; professional or employment information; commercial information, including plan, payment status, and deal-related prices; internet or other electronic network activity; and signature-related records. Deal Content may also contain other categories, including sensitive personal information, that you or the Subscriber choose to submit. DraftStack does not derive or use inferences about you from Deal Content.

2.10 Sensitive personal information. We do not intentionally request sensitive personal information for our own purposes. You or a Subscriber may place sensitive personal information in Deal Content, and we process it as a service provider or processor on the Subscriber’s instructions. We do not use sensitive personal information to infer characteristics or for targeted advertising.

3. What is not encrypted, and why

These items are readable by the Service because it cannot work without them. Encryption protects the substance of a deal, not these:

  • email addresses of account holders and of people invited to a deal;

  • the name and firm on an account, and the role label of a person on a deal;

  • the stage, status, and due date of items, and which person an item is assigned to (an identifier, not a name);

  • file sizes and counts, and timestamps, including when someone last opened a deal;

  • plan and payment status.

None of these says what a deal is about.

4. How we use information

We use information to provide and secure the Service; to send invitations, sign-in links, signing codes, reminders, and billing messages; to process payments; to answer support requests; to detect and prevent abuse; and to meet legal obligations. We do not use Deal Content to train machine-learning models, and we do not sell personal information or share it for cross-context behavioral advertising or targeted advertising.

Under our Terms, we do not access Deal Content except when you ask us to for support, when needed to provide a requested feature such as Word-to-PDF conversion, as needed to protect the security or integrity of the Service, or as the law requires. Where a deal uses service custody, the key to it is protected by a key held in AWS KMS; the Terms explain what that does and does not mean.

5. Who we share information with

We use these providers to run the Service. Each sees only what its job requires:

  • Vercel (hosting and the isolated environment used to convert Word to PDF): runs our application. It sees technical request data. Deal Content passes through in sealed form, except that a Word document is read briefly in memory during PDF conversion.

  • Supabase (database, United States): stores our data, including sealed Deal Content and the items listed in section 3.

  • Amazon Web Services (AWS Key Management Service, United States): protects the keys for deals that use service custody. It handles keys, not documents.

  • Resend (email): delivers our emails. It sees recipient and sender addresses and the email text. Our emails do not name your documents.

  • Stripe (payments): processes payments and calculates tax. It sees billing details. We send it nothing from your deals.

  • Cloudflare (domain name service): routes our web addresses.

Some providers listed above process personal information as our service providers or subprocessors; others, such as payment or email providers, may process information under their own terms as independent controllers for their services. We require providers that process information on our behalf to use it only for contracted purposes, protect it, and assist with applicable privacy obligations. We may add or replace providers as the Service changes and will update this section when appropriate.

We may also disclose information when the law requires it, to protect rights, safety, or the Service, or in connection with a merger, financing, or sale of our business. In a business transaction, where reasonably practicable, we will require the recipient to protect information consistent with this Policy. Because Deal Content is sealed, what we could hand over in response to legal process is limited to sealed data and the items in Section 3, plus whatever the law requires us to do. We will tell you about a request for your information when we are permitted to.

People on the same deal see what the deal shows them, according to the access rules the Subscriber sets. That is sharing among deal participants, not by us.

6. How long we keep information

We keep Deal Content until a Subscriber deletes the deal or the account ends and is deleted under our Terms. Deleting a deal is permanent. We retain account and contact information while needed to provide the Service, and afterward as reasonably necessary for legal, tax, accounting, fraud-prevention, dispute-resolution, and enforcement purposes. We retain billing records as required by law, and providers may retain information under their own policies. Technical logs and sign-in or security records are kept only as reasonably necessary for security, troubleshooting, and legal obligations. Sealed copies may remain in backups until ordinary backup cycles or other safeguards remove them. These are our retention criteria rather than fixed periods because retention depends on the nature of the information, the Service, legal requirements, and the Subscriber’s instructions.

7. Security

We use administrative, technical, and organizational safeguards designed to protect personal information. Deal substance is encrypted in your browser before upload and stored in sealed form; where service custody is used, deal keys are protected by AWS KMS as described in the Terms. We also use encryption in transit and at rest through our providers and limit access. These measures do not make any system perfectly secure and do not mean DraftStack can never access information: Word-to-PDF conversion and support, security, or legal processes may require limited access as described in this Policy and the Terms. If we determine that a security incident has affected personal information, we will provide notices required by law; for Deal Content, we will notify the Subscriber as required by our Terms and applicable law.

8. Your choices and rights

You can ask us to access or know what personal information we hold about you, correct it, receive a portable copy of it, or delete it by writing to privacy@draftstack.io. Depending on where you live—including California, Florida, and other states with privacy laws, the European Economic Area, or the United Kingdom—you may have additional rights, including to object to or restrict certain processing, opt out of sale, targeted advertising, or certain profiling, and limit use or disclosure of sensitive personal information. We do not sell personal information or share it for cross-context behavioral advertising, so those opt-outs generally do not require a separate preference tool. We may verify your request as permitted by law, will respond within applicable deadlines, and will not discriminate against you for exercising a privacy right.

An authorized agent may submit a request on your behalf where permitted by law. We may require evidence of the agent’s authority and may verify your identity directly before fulfilling the request.

If we deny a request, we will explain the reason and, where required by law, provide a process to appeal. You may submit an appeal to privacy@draftstack.io, and we will respond within the time required by applicable law. If an appeal is denied, we will provide any further instructions required by law.

For Deal Content, DraftStack generally acts as a processor or service provider on behalf of the Subscriber that opened or controls the deal. The Subscriber determines the purposes and means of processing, and DraftStack processes Deal Content only to provide, secure, support, and maintain the Service and as otherwise permitted by the Terms or applicable data-processing terms. If you are a Guest, direct a request about Deal Content first to the Subscriber; if you contact us, we will assist as appropriate. For account, billing, website, support, and security information that DraftStack determines how to use, DraftStack acts as a controller under GDPR or UK GDPR and as the business responsible under applicable U.S. state privacy laws.

9. International use

9.1 International transfers. We operate in the United States and store data there. If you use the Service from another country, your information may be transferred to and processed in the United States and other locations where our providers operate. Those locations may have different data-protection rules.

9.2 European roles. For account, billing, website, security, and other information DraftStack uses for its own purposes, DraftStack is generally the controller. For Deal Content, DraftStack generally acts as the Subscriber’s processor or service provider, as described in Section 8 above.

9.3 European legal bases. When DraftStack is the controller, we rely on performance of a contract, legitimate interests such as security, support, fraud prevention, and business administration, legal obligations, and consent where required and obtained. When DraftStack is a processor, the Subscriber determines the purposes and legal basis and is responsible for providing required notices and instructions.

9.4 Transfer safeguards and representatives. Where required, we use an adequacy decision, Standard Contractual Clauses, the UK Addendum, or another lawful transfer mechanism, together with any supplementary measures required by law. If GDPR or UK GDPR requires DraftStack to appoint a data protection officer or an EU or UK representative, we will do so and publish the applicable contact details; otherwise, contact privacy@draftstack.io.

10. Children

The Service is for business use and is not directed to anyone under 18. We do not knowingly collect personal information directly from children under 13, and we ask that no one under 18 use the Service. If we learn that we have collected personal information from a child in violation of law, we will take reasonable steps to delete it.

11. Changes to this policy

We may update this policy. For material changes we will give notice by email or in the Service before they take effect. The date at the top shows the latest version.

12. Contact

Questions or rights requests about privacy: privacy@draftstack.io. Questions about our Terms or contractual/data-processing terms: legal@draftstack.io. If a request concerns Deal Content, we may refer it to the relevant Subscriber as described in Section 8.