Last updated: August 3, 2026
Draftbase, Inc. ("Draftbase," "we," "us") is the developer of the Draftbase headless CMS platform. This Privacy Policy explains what personal data we collect, how we use it, and the rights you have with respect to it, when you use our website or the Draftbase Service.
For content that you or your organization store in the Service ("Customer Content," which may include end-user or visitor data your organization chooses to store as entries or media), your organization is the data controller and Draftbase acts as a data processor, handling that content only per your organization's instructions as configured through the Service. This Policy addresses that relationship in Section 3, and otherwise describes our practices as a controller of your account data.
Account data. When you create an account, we collect your name, email address, and organization details you provide.
Organization and billing data. Organization name, member roles, and, where you have a paid subscription, billing contact and transaction information. Payment card details are not collected or stored by us directly — they are handled by our payment processor at the time such a processor is enabled for your account.
Customer Content. Templates, entries, media, and other data your organization stores in the Service. We do not review or use Customer Content except as necessary to provide, secure, and support the Service, or as required by law.
Usage and log data. IP address, browser type, device information, pages visited, API request metadata, and timestamps, collected automatically to operate, secure, and improve the Service.
Cookies. We use strictly necessary cookies to keep you signed in and to secure your session. We do not currently use third-party advertising or analytics cookies. If that changes, we will update this Policy and provide any consent mechanism required by applicable law before doing so.
If your organization stores personal data belonging to your own end users, customers, or site visitors within Customer Content, your organization is responsible for that data as its controller, including for providing any required notices and obtaining any required consents from those individuals. Draftbase processes that Customer Content solely to provide the Service, in accordance with your organization's instructions, and does not use it for our own independent purposes. Requests from individuals to access, correct, or delete data contained in Customer Content should be directed to the organization that controls it; we will assist that organization in responding as needed to operate the Service.
We use the information described above to:
Where the General Data Protection Regulation (GDPR) applies, our legal bases for these uses are: performance of a contract with you, our legitimate interests in operating and securing the Service, compliance with legal obligations, and, where applicable, your consent.
We do not sell personal data. We share information only with:
We retain account data for as long as your account is active and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce our agreements. Customer Content is retained until you or your organization delete it or close your account, after which we delete it within a commercially reasonable period, subject to residual copies in backups that age out on a rolling basis.
We use industry-standard technical and organizational measures, including encryption in transit, access controls, and infrastructure hosted on AWS, to protect data against unauthorized access, alteration, disclosure, or destruction. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Draftbase is based in the United States, and our infrastructure providers may process and store data in the United States and other countries. Where we transfer personal data out of the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards recognized under applicable law, such as Standard Contractual Clauses, to protect that data.
Depending on your location, you may have rights to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. Residents of California and other U.S. states with comprehensive privacy laws may have similar rights, including the right to know what personal information is collected and the right to request deletion, under laws such as the California Consumer Privacy Act (CCPA). We do not sell personal information as defined under the CCPA.
To exercise any of these rights regarding your account data, contact us at legal@draftbase.co. We will respond within the timeframe required by applicable law. We may need to verify your identity before fulfilling a request.
The Service is not directed to individuals under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at legal@draftbase.co and we will delete it.
We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice, such as by posting a notice on the Service or emailing the address associated with your account, before the changes take effect.
Questions about this Privacy Policy or our data practices can be sent to legal@draftbase.co.
