Privacy Policy

At Draftva ("Draftva", "we", "us", or "our"), we believe that your privacy, intellectual property, and audience trust are sacred. This Privacy Policy explains how we collect, store, process, transfer, and protect your information when you use our multi-channel social scheduling, composition, and writing assistant platform.

We collect information in three ways: information you provide directly, information collected automatically, and information received via authorized third-party OAuth flows.

1. Information You Provide Directly

• Account Details: Full name, email address, password hash, and profile details.
• Workspace Information: Workspace name, team member invitations, role designations.
• User Content: Text posts, thread structures, drafts, notes, uploaded images, video assets, alt text, and custom voice profile samples.
• Billing Information: Payment card details and billing address (collected and tokenized directly by Stripe; Draftva never stores full credit card numbers).
• Support Communications: Messages, feedback, inquiries, or bug reports submitted to our team.

2. Information Received From Connected Channels (OAuth)

When you connect a social account (X, LinkedIn, Reddit, Bluesky, Mastodon, Facebook, Instagram, Threads), we receive authorized profile data from that provider:

• Platform user ID, handle/username, profile display name, and avatar URL.
• OAuth 2.0 access tokens, refresh tokens, token expiration timestamps, and granted permission scopes.
• Target IDs (e.g., Facebook Pages, LinkedIn Company Pages, or subreddit profiles you manage).
• Post metrics fetched on your behalf (views, likes, reposts, comments, impressions) to display in your analytics dashboard.

3. Information Collected Automatically

• Log & Usage Data: IP address, browser type, device information, operating system, time stamps, referrers, and pages visited.
• Cookies & Session Tokens: Strictly necessary authentication tokens and functional preferences (see our Cookie Policy).

Connecting social channels requires authorization tokens. Draftva implements bank-grade security protocols to safeguard your tokens:

We process your data strictly to fulfill our contractual agreement with you and for legitimate business purposes:

• Providing the Publishing Pipeline: Transmitting scheduled posts, media attachments, and thread sequences to your chosen social networks at your specified calendar times.
• AI Assistant Features: Processing prompt requests to generate drafts, refine copy, suggest hooks, format platform variants, and generate alt text.
• Analytics Aggregation: Fetching engagement snapshots from official APIs to provide content performance analytics.
• Account & Workspace Management: Authenticating logins, enforcing role-based permissions, and sending operational notifications.
• Billing & Subscriptions: Processing payments, invoices, plan changes, and calculating billing quota usage.
• Platform Protection & Fraud Prevention: Detecting abusive spam patterns, rate limit breaches, and bot automation to protect community integrity.

Draftva does not sell or lease your personal data. We disclose your information only in the limited circumstances described below:

We retain your information only as long as your workspace is active or as necessary to provide the Service, resolve disputes, and comply with legal obligations.

• Account Deletion: If you delete your workspace, all scheduled posts, unpublished drafts, uploaded media assets, and connected OAuth tokens are permanently queued for purge within 30 days.
• OAuth Disconnection: Disconnecting an individual social account purges its encrypted tokens within 24 hours.
• Aggregated Logs: Anonymized telemetry and error logs may be retained for up to 90 days for operational debugging.

If you are located in the European Economic Area (EEA) or the United Kingdom, you have comprehensive privacy rights under the General Data Protection Regulation (GDPR):

To exercise any of these rights, email us at privacy@draftva.com. We respond within 30 days without charge.

Under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CPRA), California residents are entitled to specific disclosures:

• We Do Not Sell or Share Personal Data: Draftva has not sold or shared personal information for cross-context behavioral advertising in the preceding 12 months.
• Right to Know & Access: You may request the categories and specific pieces of personal information collected.
• Right to Delete: You have the right to request deletion of personal information subject to legal exemptions.
• Non-Discrimination: We will not discriminate against you in pricing, service quality, or features for exercising your California privacy rights.

Draftva maintains technical and organizational measures (TOMs) designed to ensure a level of security appropriate to the risk of data processing:

• TLS 1.3 encryption for all data in transit.
• AES-256 encryption at rest for databases, backups, and secret tokens.
• Multi-factor authentication (MFA) and least-privilege role access for internal systems.
• Continuous automated vulnerability scanning and third-party penetration testing.
• Distributed multi-region backups with recovery point objectives (RPO) under 1 hour.

If you have questions, feedback, or requests regarding this Privacy Policy or our data practices, please reach out to our designated Data Protection Officer: