Draft Draft — under legal review. Not yet in force.

This page is a working draft written by the Draaftly team and has not been reviewed or approved by a lawyer. It does not yet create rights or obligations for anyone. If you need a binding document today — a signed DPA, for example — write to us and we will send the current version.

Privacy notice

What we collect, why, how long we keep it and what you can ask us to do.

Status: Draft, under legal review
Last updated: 17 October 2026
Applies to: draaftly.com, the Draaftly platform and Hisaab

In short

We collect what we need to run our website, the Draaftly platform and Hisaab, and nothing we cannot explain. We do not sell personal data. Draaftly never uses your data to train AI models. Our AI providers, Anthropic and Google Cloud, do not use customer data from their commercial services to train their models by default.

Who this covers

This notice covers Resolva Insights Private Limited, of Amravati, Maharashtra, India, trading as Draaftly and Hisaab by Draaftly (“we”, “us”). It applies to our website, the Draaftly platform and Hisaab.

Our role depends on what is happening. For visitors to our website, and for the account details of the people who buy from us, we are the controller: we decide why and how the data is used. For the material a customer puts into the platform or into Hisaab — their documents, their clients, their staff, their customers — we are a processor acting on that customer’s instructions, and their own privacy notice governs it. Our terms as a processor are in thedata processing agreement.

Which laws we work to

We aim to meet the stricter of the laws that apply to a given person, rather than the minimum. These are the regimes we have written this notice against:

The EU General Data Protection Regulation (GDPR) and the UK GDPR, with the Data Protection Act 2018.
The California Consumer Privacy Act as amended by the CPRA.
India’s Digital Personal Data Protection Act, 2023 (DPDP Act).
The UAE Federal Personal Data Protection Law (PDPL).
The Personal Data Protection Law of the Kingdom of Saudi Arabia (KSA PDPL).

What we collect, and why

From our website

What	Why	Legal basis (GDPR / UK GDPR)
Details you type into a form: name, work email, organisation, country, role, and whatever you write in the message.	To answer your enquiry, your early-access request or a partner application, and to keep a record of it.	Legitimate interests in responding to you; steps towards a contract where you are asking to buy.
Booking details when you book a demo through Cal.com: name, email, the time you chose and anything you add.	To hold and run the call.	Steps towards a contract, and your consent in choosing to book.
Strictly necessary cookies, and other cookies only where you have agreed.	To make the site work, and — with consent — to count visits.	Legitimate interests for strictly necessary cookies; consent for everything else.
Server and security logs, including IP address and user agent.	To keep the site available and to deal with abuse.	Legitimate interests in security.

From the Draaftly platform

What	Why	Legal basis
Account data: name, work email, organisation, role, authentication details.	To give you an account, apply permissions, and keep it secure.	Performance of our contract with the customer.
Billing data: plan, invoices, payment status. Card details go to our payment providers and not to us.	To take payment and meet tax and accounting duties.	Contract, and legal obligation.
Customer content: documents, evidence, assumptions, models and deliverables, including any personal data inside them.	To provide the service the customer is paying for. We act on their instructions.	The customer’s own basis; we act as processor under the DPA.
Usage and audit records: sign-ins, uploads, downloads, exports, permission changes, credits used, and any staff access.	To run the service, show customers what happened in their own account, and investigate problems.	Contract, and legitimate interests in security.

From Hisaab

What	Why	Legal basis
Outlet and staff accounts: names, logins and roles set up by the outlet.	To run the till and apply permissions.	Contract with the outlet; we act as processor for their staff data.
Sales records: bills, items, payment method, taxes, and the stock behind them.	To provide billing, reporting and stock control to the outlet.	The outlet’s own basis; we act as processor.
Customer phone numbers and visit history, where an outlet uses the regulars feature.	To show the outlet a returning customer’s last order and how often they visit.	The outlet’s own basis. It is for them to tell their customers and to collect consent where it is needed.

Hisaab data is stored in India, in the Mumbai region. See trust and security.

What we do not do

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We have never done so.
We do not use customer content to train AI models. Draaftly never uses your data to train AI models. Our AI providers, Anthropic and Google Cloud, do not use customer data from their commercial services to train their models by default.
We do not use one customer’s material for another customer, or in benchmarks, templates or examples.
We do not make decisions about you by automated means that produce legal or similarly significant effects.

Who else sees it

We use a small number of service providers, listed on our sub-processors page with what each one does and where. In use today:

Google Cloud — Hosting, database, file storage, and access to the AI models (United States and other Google Cloud regions).
Anthropic — Claude models, used through Google Cloud, for drafting and analysis (Accessed through Google Cloud).
Supabase — Database and storage for Hisaab (India (Mumbai region)).
Cloudflare — Website hosting, DNS, protection against attacks, the Turnstile spam check on our forms, and the database that stores what you send us through them (Global edge network; the forms database is in the Asia-Pacific region).
Stripe — Card payments and subscription billing (United States and Ireland).
Razorpay — Payments in India, including UPI (India).
Cal.com — Booking demo calls from our website (European Union and United States).

We may also share personal data with professional advisers, or where we are required to by law. If the business is ever sold or reorganised, data may transfer with it, and we would tell affected customers.

Sending data between countries

We are based in India and use providers in the European Union, the United Kingdom, the United States and elsewhere, so personal data does cross borders. Where data protected by the GDPR or UK GDPR leaves that protection, we rely on the European Commission’s Standard Contractual Clauses, with the UK International Data Transfer Addendum where the UK GDPR applies, together with the technical measures described on our trust page. For the DPDP Act, transfers are made to countries not restricted by the Indian government. You can ask us for details of the safeguards that apply to you.

How long we keep it

What	How long
Enquiries, early-access requests and partner applications	While we are dealing with them and for a reasonable period afterwards, then deleted.
Account data	While the account is open, and a short period after it closes.
Customer content in the platform or Hisaab	As the customer instructs. On deletion it is removed from live systems, and from backups as those age out.
Billing and tax records	As long as tax and company law requires.
Security and audit logs	A limited period, as needed to investigate incidents.

The exact retention periods are being set with our advisers and will be stated here as numbers, not adjectives, when this notice is approved.

Your rights

Depending on where you live, you can ask us to:

tell you what we hold about you, and give you a copy;
correct it if it is wrong, or complete it if it is partial;
delete it, or restrict what we do with it;
give it to you, or to someone else, in a portable form;
stop processing based on legitimate interests, or stop direct marketing, which you can do at any time;
withdraw consent you have given, without affecting what we did before you withdrew it;
nominate someone to exercise your rights for you, if you are in India under the DPDP Act;
be free from being treated worse for exercising any of these rights, which we will not do.

Write to hello@draaftly.com and we will answer within the time the applicable law allows. We may need to check who you are first. If your data sits inside a customer’s account — a document they uploaded, or a bill from their outlet — we will point you to that customer, because it is their data to act on, and we will help them do it.

If you think we have got it wrong, please tell us first. You can also complain to your data protection authority: in the EU, your local supervisory authority; in the UK, the Information Commissioner’s Office; in India, the Data Protection Board; in the UAE, the UAE Data Office; in Saudi Arabia, SDAIA.

Children

Draaftly is for people at work and for students in higher education. It is not for children, and we do not knowingly collect their data. Where the DPDP Act’s rules on children apply to a user, we will meet them before providing the service. If you believe a child’s data has reached us, write to us and we will remove it.

Changes

If we change this notice in a way that matters, we will tell customers before it takes effect, and the date at the top of this page will change.

Who you are dealing with

Company: Resolva Insights Private Limited
Registered office: Amravati, Maharashtra, India
Brands: Draaftly™ and Hisaab by Draaftly
Contact: hello@draaftly.com