Privacy Policy

The data controller for your account and your customer relationship is Disp, CVR 38507508, which operates the DraftKite service. For the content of the emails you connect, you are the data controller — DraftKite acts as a data processor on your behalf (see section 6).

You can contact us at support@draftkite.com.

To deliver the service, we process:

• Account details: name, email address and password (stored hashed — we cannot see your password in plain text).
• OAuth tokens for Gmail or Microsoft — encrypted at rest with industry-standard encryption.
• Content and metadata of emails in the inboxes you have connected (sender, recipient, subject, body).
• Documents and text you upload to your knowledge base.
• Usage and billing data: number of processed emails and subscription status.
• Technical logs: IP address, browser and events in the service.

• Delivery of the service (contract, GDPR art. 6(1)(b)): labeling, draft generation and connection to your inboxes.
• Billing and accounting (legal obligation, art. 6(1)(c)).
• Product improvements and troubleshooting (legitimate interest, art. 6(1)(f)).
• Marketing — only with your consent (art. 6(1)(a)).

Your data is stored in the EU. OAuth tokens and other sensitive fields are encrypted at rest.

We use data processors within the following categories in order to deliver the service:

• Hosting, database and storage — EU.
• AI models for classification, drafts and embeddings. Your data is not used to train their models.
• Email providers (OAuth and access to your inbox) — global.
• Payment and billing provider — EU/US.
• Background-job and queue infrastructure — EU.
• Transactional email provider — EU/US.
• Web analytics and ad measurement — see section 9 on cookies and consent.

Transfers outside the EU/EEA take place on the basis of the EU Commission's Standard Contractual Clauses (SCCs). A specific list of named data processors can be requested by writing to support@draftkite.com.

DraftKite sends the content of the emails we process for you to an AI provider (currently OpenAI) to classify, embed and generate drafts. Inboxes may contain sensitive personal data — for example information about health, religion, trade-union membership or other special categories (GDPR art. 9). This means:

• Your responsibility: as the data controller for your inbox, you ensure that you have a lawful basis under art. 6 and — where relevant — art. 9 for processing the data, including when you use AI to produce drafts.
• No model training: the AI provider processes the content as a data processor under a written data-processing agreement and may not use your content to train its models.
• Short-term retention: prompts and responses may be retained by the AI provider for up to 30 days for safety and abuse-prevention purposes, after which they are deleted. We do not keep a copy with the AI provider beyond this.
• Transfer to the US: the AI models are hosted in the US. The transfer takes place on the basis of the EU Commission's Standard Contractual Clauses (SCCs) with supplementary measures.

If you run, for example, a medical, legal or psychological practice where the inbox systematically receives sensitive data, you should carry out a specific risk assessment before connecting the inbox to DraftKite. Write to support@draftkite.com for a data-processing agreement or further documentation.

DraftKite complies with the Google API Services User Data Policy, including the Limited Use requirements. In concrete terms, this means that Google user data from Gmail (emails, metadata, settings) that DraftKite receives via the Gmail API:

• is used solely to deliver the features you have requested yourself — automatic labeling of your inbox and generation of email drafts for your approval;
• is never sold to third parties or data aggregators;
• is never used for advertising — neither to display, target or measure ads, nor for retargeting;
• is never used to train general AI models. The content is sent to OpenAI as a data processor under a written data-processing agreement that explicitly prohibits model training on your data;
• is not transferred to third parties other than the data processors necessary to deliver the service (see section 5), at your own explicit direction, or where required by law;
• is only accessed by humans (a) if you explicitly grant us access for troubleshooting, (b) where strictly necessary for security or legal reasons, or (c) in anonymised, aggregated form for internal statistics.

You can withdraw DraftKite's access to your Gmail at any time by removing the permission in your Google account under Third-party apps & services or by disconnecting the inbox in DraftKite. Emails and drafts associated with the inbox are deleted no later than 30 days after disconnection.

• Account details: for as long as your account is active.
• Processed emails and drafts: deleted no later than 30 days after you delete your account or remove the inbox.
• Billing data: 5 years, cf. the Danish Bookkeeping Act.
• Technical logs: at most 90 days.

On draftkite.com we use the following tools:

• Plausible Analytics sets no cookies and collects no personal data. It always runs and does not require consent.
• Google Analytics 4 is used to understand how our website is used. Sets cookies. Only runs if you give consent.
• Google Ads measures the effect of our ads on Google. Sets cookies. Only runs if you give consent.
• Meta Pixel (Meta Platforms Ireland Ltd.) measures the effect of our ads on Facebook and Instagram. Sets cookies and additionally sends events server-to-server via Meta's Conversions API. With your consent, we share in that connection your email address (only in pseudonymised, hashed form), your IP address and Meta's browser/click IDs (_fbp/_fbc) with Meta. The processing takes place at Meta Platforms, Inc. in the US on the basis of the EU Commission's Standard Contractual Clauses (SCCs). Only runs if you give consent.

You can change your choice at any time via the cookie settings at the bottom of the page. We use Google Consent Mode v2, and the Meta Pixel is only loaded once you have consented to advertising — so no marketing or analytics cookies are set before you have given your consent.

We use industry-standard encryption: TLS in transit, strong encryption of OAuth tokens at rest and per-user access isolation at database level. Only a few employees have access to production systems, and all access is logged.

As a data subject, you have the right to:

• access your data,
• have incorrect data rectified,
• have your data erased (the "right to be forgotten"),
• have processing restricted or object to it,
• data portability,
• withdraw your consent.

Contact support@draftkite.com to exercise your rights. You can also complain to the Danish Data Protection Agency (datatilsynet.dk).

We may update this policy. Material changes are announced at least 30 days in advance by email or in the service.