Privacy Policy

1. Introduction

This document sets out the privacy policy of Harrison Duske trading as Drafty (referred to in this privacy policy as ‘we’, ‘us’, or ‘our’).

Drafty is an AI email assistant for Australian mortgage brokers. Brokers connect a work inbox (Gmail or Microsoft Outlook). Drafty labels incoming mail, drafts replies into the broker’s inbox, supports dashboard compose with recipient lookup, can use calendar free/busy when you allow calendar access, and runs compliance checks. Brokers review drafts themselves. Drafty does not auto-send email. You may send from your own inbox, or explicitly send from dashboard compose when you choose to.

We take our privacy obligations seriously and we've created this privacy policy to explain how we store, maintain, use and disclose personal information.

By providing personal information to us, you consent to our storage, maintenance, use and disclosing of personal information in accordance with this privacy policy.

We may change this privacy policy from time to time by posting an updated copy on our website and we encourage you to check our website regularly to ensure that you are aware of our most current privacy policy.

2. Type of Personal Information we collect

The personal information we collect may include the following:

• Name;
• Email address;
• Telephone number and other contact details;
• Account login and authentication details (managed by our auth provider, we do not store your password in plain text);
• Subscription and billing status;
• Payment information (where you subscribe, card details are processed by our payment provider; we receive billing identifiers, not your full card number);
• Information about your business or professional circumstances;
• Connected inbox data, including email metadata (sender, recipients, subject, date, message identifiers, labels), email body text needed to classify mail and draft replies, and a sample of sent mail (typically up to 300 messages) where voice learning is enabled;
• A broker-scoped correspondent index (display name and email only) built from mail Drafty processes, used for compose recipient lookup. No subjects or bodies are stored in this index. Cleared when you disconnect the inbox or delete your account;
• Contact and recipient lookup data from your connected provider when those permissions are granted (for example Google Contacts or Microsoft contacts), used only to help you address compose and related features;
• Calendar free/busy and related scheduling metadata when you allow calendar access, used only to suggest available times;
• A voice profile derived from your sent mail (for example, tone and sign-off style stored as a summary, not a permanent archive of all sent mail);
• Usage and operational data, including message identifiers, truncated subject lines, label categories, draft metadata, AI usage logs, connection identifiers, and processing timestamps;
• Information in connection with client surveys, questionnaires and promotions;
• Your device identity and type, I.P. address, geo-location information, page view statistics, advertising data and standard web log information;
• Information about third parties contained in emails in your connected inbox (including your clients' personal and financial information); and
• Any other information provided by you to us via our website or our online presence, or otherwise required by us or provided by you.

3. How we collect personal information

We may collect personal information either directly from you, or from third parties, including where you:

• Contact us through our website;
• Sign up for or use Drafty;
• Connect your work inbox via OAuth (Gmail or Outlook through our email integration partner), including optional calendar access;
• Use dashboard compose, recipient lookup, or scheduling features;
• Receive goods or services from us;
• Submit any of our online sign up forms;
• Communicate with us via email, telephone, SMS, social applications (such as LinkedIn) or otherwise;
• Interact with our website, services, content and advertising; and
• Invest in our business or enquire as to a potential purchase in our business.

We may also collect personal information from your connected inbox when new mail is received and processed through our service (including via webhooks from our email integration partner).

Thread context used to draft a reply is built from your live inbox for that request. We do not keep a permanent archive of full client thread notes in our database for that purpose.

We may also collect personal information from you when you use or access our website or our social media pages. This may be done through use of web analytics tools, ‘cookies’ or other similar tracking technologies that allow us to track and analyse your website usage. Cookies are small files that store information on your computer, mobile phone or other device and enable and allow the creator of the cookie to identify when you visit different websites. If you do not wish information to be stored as a cookie, you can disable cookies in your web browser.

We may use Google Analytics to collect and process data, including when you use third party websites or apps. To find out more see How Google uses data when you use our partners' sites or apps.

4. Use of your personal information

We collect and use personal information for the following purposes:

• To provide goods, services or information to you (including labelling inbox mail, drafting replies into your inbox, dashboard compose, recipient lookup, optional calendar free/busy for scheduling suggestions, voice personalisation, and compliance assistance, not legal advice);
• To process email content using AI providers solely to provide the Service for your account;
• For record keeping and administrative purposes;
• To provide information about you to our contractors, employees, consultants, agents or other third parties for the purpose of providing goods or services to you;
• To improve and optimise our service offering and customer experience;
• To comply with our legal obligations, resolve disputes or enforce our agreements with third parties;
• To send you marketing and promotional messages and other information that may be of interest to you and for the purpose of direct marketing (in accordance with the Spam Act). In this regard, we may use email, SMS, social media or mail to send you direct marketing communications. You can opt out of receiving marketing materials from us by using the opt-out facility provided (e.g. an unsubscribe link);
• To send you administrative messages, reminders, notices, updates, security alerts, and other information requested by you; and
• To consider an application of employment from you.

If you are a mortgage broker, emails in your inbox may contain your clients’ personal information. We process that information on your behalf to provide the Service. You remain responsible for how you handle your clients’ personal information and for reviewing every draft before you send it.

We may disclose your personal information to cloud-providers, contractors and other third parties located inside or outside of Australia (including providers of hosting, database, authentication, email integration, AI processing, and payments). If we do so, we will take reasonable steps to ensure that any overseas recipient deals with such personal information in a manner consistent with how we deal with it.

5. Google user data (Limited Use)

Drafty's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When you connect Gmail, we access Google user data only to provide or improve user-facing Drafty features for your account, including:

• Reading inbox mail to classify it and apply Drafty labels;
• Creating and updating draft replies in Gmail Drafts;
• Dashboard compose and recipient lookup, including read-only access to Google Contacts and related contact data when those permissions are granted, plus a broker-scoped name and email correspondent index from mail we process;
• Optional calendar free/busy checks when you allow calendar access, to suggest available meeting times; and
• Account connection status and security for your connected inbox.

• We do not sell Google user data.
• We do not use Google user data for serving advertisements, including retargeting, personalised, or interest-based advertising.
• We do not use Google user data to train generalised AI or machine learning models that are not specific to providing Drafty features for your account.
• We do not transfer Google user data to third parties except as necessary to provide or improve Drafty features for you (for example our email integration partner and AI processors that generate labels and drafts for your account), for security purposes, or as required by law.
• Human access to Google user data is limited to cases where you give affirmative consent for specific support, where it is necessary for security or abuse investigation, where it is required by law, or where data is aggregated and anonymised for internal operations and no longer identifies you or your messages.

You can disconnect Gmail at any time in Settings. Disconnecting revokes Drafty's access to new Google user data for that inbox and clears the correspondent index for that connection.

6. Third-party access

To operate Drafty, we use trusted service providers including Supabase (database and authentication), Nylas (Gmail and Outlook connection, including contacts and calendar access where you allow it), OpenAI (AI processing of email content for your account only), Vercel (hosting), Resend (transactional email), and Stripe (payments, if enabled). A current list is on our Subprocessors page.

Email content may be sent to OpenAI only as needed to classify mail, draft replies, build short-lived thread context for follow-ups, learn your writing style, run compliance checks, and support dashboard compose for your account. We do not use your inbox data to train public or shared AI models for other customers. AI outputs can be inaccurate, you must review every draft before sending.

We do not sell your personal information. We do not otherwise share your personal information without your consent unless required by law.

7. Security

We take reasonable steps to ensure your personal information is secure and protected from misuse or unauthorised access. Our information technology systems are password protected, and we use a range of administrative and technical measures to protect these systems (including encrypted connections, access controls, and OAuth for inbox access, we do not store your email password). However, we cannot guarantee the security of your personal information.

8. Retention and deletion

We retain personal information only as long as needed to provide the Service, meet legal obligations, or resolve disputes. Typical retention for Drafty and Google user data is:

• Account and broker profile: while your account is active;
• Voice profile (tone and sign-off style summary): until you disconnect your inbox, delete your account, or re-learn voice;
• Correspondent index (name and email only): until you disconnect the inbox or delete your account;
• Usage and operational logs (message identifiers, label categories, draft metadata, AI usage, timestamps): for an operational period needed for billing, security, and debugging;
• Full email bodies and thread context used to label or draft: processed for that request from your live inbox, and not kept as a permanent archive in our database; and
• Google user data accessed via Gmail, Contacts, or Calendar: used only while your inbox stays connected for the features above. Disconnecting stops new access.

You can disconnect Gmail in Settings at any time. That revokes Drafty's access to new Google user data for that inbox and clears the correspondent index for that connection. You can delete your account in Settings, which removes your broker account data we hold (subject to any records we must keep by law). You may also email us using the contact details below to request access, correction, or deletion. We will respond within a reasonable timeframe after verifying your identity. Some limited logs may be retained where required by law or for legitimate security and business records.

9. Links

Our website may contain links to other websites. Those links are provided for convenience and may not remain current or be maintained. We are not responsible for the privacy practices of those linked websites and we suggest you review the privacy policies of those websites before using them.

10. Requesting access, correcting, or deleting your personal information

If you wish to request access to the personal information we hold about you, please contact us using the contact details set out below including your name and contact details. We may need to verify your identity before providing you with your personal information. In some cases, we may be unable to provide you with access to all your personal information and where this occurs, we will explain why. We will deal with all requests for access to personal information within a reasonable timeframe.

You may also access and update certain account details through Settings in the Service, disconnect your inbox to stop new email processing, or delete your account in Settings. Deletion requests can also be sent to the email below.

If you think that any personal information we hold about you is inaccurate, please contact us using the contact details set out below and we will take reasonable steps to ensure that it is corrected.

11. Complaints

If you wish to complain about how we handle your personal information held by us, please contact us using the details set out below including your name and contact details. We will investigate your complaint promptly and respond to you within a reasonable timeframe.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or 1300 363 992.

12. Contact us

For further information about our privacy policy or practices, or to access or correct your personal information, or make a complaint, please contact us using the details set out below: