Privacy.

Who processes the data

Cloud4medical s.r.o., company ID 08771243, registered office at Na Horečkách 173, 747 64 Budišovice, Czech Republic, entered in the Commercial Register kept by the Regional Court in Ostrava, section C, file 80756 (“we”). Write to info@draften.ai with anything about personal data.

Our role

• When you visit the draften.ai website, write to us or have an account in draften, we are the controller of your data.
• When your business or organisation uses draften, we process the mail and the data in it on its behalf: it is the controller and we are the processor. The terms of that processing are in the data processing agreement, which is part of the terms of use.
• When you use draften for your private mail, we are also the controller of the mail we process for you. We use it only to provide the service to you.

The draften.ai website

The website uses no analytics or advertising cookies. The language and look you choose are remembered by your browser only; they never reach us.

The website runs through the Cloudflare network, which processes technical data such as your IP address and browser type to deliver the pages and protect them from attacks. The contact form is also protected from spam by Cloudflare Turnstile, which processes technical data about your browser and device to tell people from robots; it loads only on the Contact page. Legal basis: our legitimate interest in running the website securely (Art. 6(1)(f) GDPR).

When you write to us

From the contact form or an email we process your name, email address, the content of your message and, if you give them, your organisation and the topic, in order to reply. We keep them as long as needed to deal with your message and, if a contract comes of it, for as long as the contract lasts. Legal basis: steps taken before entering into a contract, or our legitimate interest in answering questions (Art. 6(1)(b) and (f) GDPR).

Messages from the contact form are delivered to us by Brevo (Sendinblue SAS, France).

If you tick the box in the form saying you want news, we will send you an occasional email about draften. You can withdraw your consent at any time by replying to any such email or writing to info@draften.ai. Without the tick we send you no news. Legal basis: your consent (Art. 6(1)(a) GDPR and Section 7 of Czech Act No. 480/2004 Coll.).

Your draften account

We process your name, email address, organisation and role, how you sign in (Microsoft, Google or a password – a password only as an encrypted hash), sign-in records and the history of changes to settings. We need them to provide the service and keep it secure. Legal basis: performance of a contract and our legitimate interest in security (Art. 6(1)(b) and (f) GDPR).

We keep account data while the account exists. When it is closed we delete it, except what the law requires us to keep, such as tax documents.

System emails (invitations, links to set a password) are sent through an email delivery provider, or through the sender your organisation sets up.

The mail draften processes

draften reads the text of incoming emails from the mailbox when it writes a reply, and in its everyday work does not store it. It stores the sender, the subject and selected technical headers of messages; the drafts it wrote, their edits and how they were finally sent; lessons and knowledge corrections learned from edits; when an assistant is set up, examples of sent replies and the selected threads it is tried on; and the messages users save to the trial set themselves.

Messages, drafts, their edits and the texts from setting up an assistant are deleted automatically after 90 days; on an installation on your own server, after the time its administrator sets (30 days to never). Lessons and knowledge corrections stay, with the snippets of text they came from, for as long as the service is used. The trial set stays until users delete it. When you stop using the service, we delete the data.

We store the data on our own infrastructure in the Czech Republic (EU). With an installation on the organisation’s own server (on-premise), it stays there and we have no access to it.

To write a reply, the assistant passes the text of the message to the language model you or your organisation choose: Anthropic, PBC or OpenAI (both in the USA), or the organisation’s own model. Neither Anthropic nor OpenAI uses data sent through their APIs to train models, and both delete it within 30 days at the latest. Transfers to the USA rely on the standard contractual clauses approved by the European Commission or on the EU–US Data Privacy Framework. With its own model, the organisation’s mail goes to no other provider.

If you use draften for private mail, we process your data and the data of the people who write to you only to provide the service you asked for. Legal basis: performance of our contract with you and, for the people in your mail, our legitimate interest in providing the service you ordered (Art. 6(1)(b) and (f) GDPR).

Whom we pass data to

Only to processors who help us run the service:

• Cloudflare – the network, encrypted connections and the contact form’s spam protection (Turnstile),
• Brevo (Sendinblue SAS, France) – delivering messages from the contact form,
• an email delivery provider for system emails,
• the language model provider you or your organisation choose (Anthropic or OpenAI).

We do not sell data and do not use it for advertising.

Automated decisions

draften proposes replies automatically, but a person always decides whether to send them. There is no decision based solely on automated processing that would have legal effects for anyone.

Security

Connections are encrypted. Passwords, keys and mailbox access are stored encrypted. Roles decide who may do what, and changes to settings are recorded in a history.

Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing, to data portability, and to object; you can withdraw your consent to news at any time. Just write to info@draften.ai. For mail draften processes for your organisation, contact the organisation – we will help it deal with your request.

If you believe we handle your data unlawfully, you may lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz, or with the supervisory authority where you live.

Changes

We may update this notice when the service or the law changes. The current version is always here; we let you know about an important change in advance.