Data processing agreement

In short

When you put personal data into Draaftly, you decide what happens to it and we carry out your instructions. This page sets out the terms we process it on. A signed copy, with the Standard Contractual Clauses attached, is available on request from hello@draaftly.com.

1. Roles

You are the controller of the personal data you or your users put into the Draaftly platform or into Hisaab.Resolva Insights Private Limited is the processor. Where you are yourself a processor for someone else — a consulting firm acting for its client, for instance — we are a sub-processor, and these terms apply down the chain.

For data where we decide the purpose ourselves — your account and billing details, our website — we are the controller and the privacy notice applies instead.

2. What is processed

3. Our instructions

We process personal data only on your documented instructions, which include your use of the product’s features, unless the law requires otherwise — in which case we will tell you first unless that law forbids it. If we think an instruction breaks data protection law, we will tell you.

Draaftly never uses your data to train AI models. Our AI providers, Anthropic and Google Cloud, do not use customer data from their commercial services to train their models by default. We do not use your personal data for our own purposes, for other customers, or in benchmarks, templates or examples.

4. Confidentiality

Everyone we let near customer data is bound by confidentiality obligations and is trained on handling it. Access is limited to the people who need it for the task in front of them.

5. Security

We apply appropriate technical and organisational measures, described on our trust page: encryption in transit and at rest, separation between customers in the database, file storage and AI retrieval, multi-factor authentication, role-based access, audit logging, managed secrets, malware scanning on upload, expiring download links, and encrypted backups with point-in-time recovery. The platform is in early access and these measures are being completed as it is built; we will not describe a control here as in place before it is.

6. Sub-processors

You give us general authorisation to use sub-processors. The current list, with what each does and where, is atdraaftly.com/trust#subprocessors. We will tell you before a new one starts processing your data, so you have time to object. If you object on reasonable data protection grounds and we cannot offer an alternative, you may end the affected part of the service.

We impose on each sub-processor obligations no less protective than these, and we remain responsible to you for what they do.

7. Helping you

• Data subject requests. The product lets you find, export, correct and delete material yourself. Where you still need help, we will give it, taking into account the nature of the processing.
• Assessments. We will give you the information you reasonably need for a data protection impact assessment or a consultation with a regulator.
• Audits. We will make available what is needed to show compliance, and will answer security questionnaires. Once we have an independent report, it will stand in for an on-site audit; while we do not have one, we will agree a reasonable alternative with you.

8. Personal data breaches

If we become aware of a personal data breach affecting your data, we will tell you without undue delay, with what we know, what we are doing and who to speak to. We will not delay telling you in order to have a complete picture first, and we will help you meet your own notification duties, including GDPR and DPDP Act timelines.

9. Deletion and return

You can export your data at any time. When the agreement ends you have a reasonable period to export it, after which we delete it from live systems, with backups ageing out on their normal cycle. We will delete sooner on your written request, unless the law requires us to keep something.

10. International transfers

Where personal data protected by the GDPR or UK GDPR is transferred outside that protection, the European Commission’s Standard Contractual Clauses apply, with Module Two (controller to processor) or Module Three (processor to processor) as appropriate, and the UK International Data Transfer Addendum where the UK GDPR applies. These are attached to the signed version of this agreement. For data governed by India’s DPDP Act, transfers are made only to countries that are not restricted by the Indian government.

11. Precedence

This agreement forms part of our terms of service. Where the two conflict on the processing of personal data, this one wins. Where a signed data processing agreement exists between us, that one wins over this page.

Getting a signed copy

Write to hello@draaftly.com and we will send the current version for signature, including the Standard Contractual Clauses and the sub-processor list as annexes.