Effective: 14 August 2026
Draftwright is operated by Paul Fremantle ("Draftwright", "we", "us"). This policy explains how we process personal data when you use the Draftwright website, drawing service, account features, and supported API or MCP integrations. Contact us at paul@fremantle.org.
Depending on how you use the service, we process:
Your STEP model and drawing data are sent to our service on Fly.io for inspection, rendering, validation, and export. For authenticated workflows, inputs, immutable script versions, job records and attempts, logs, previews, and outputs are stored durably in private Supabase database and Storage resources. This happens as part of the drawing workflow and is not limited to projects on which you later select cloud save.
We use this data to provide and resume the workflow, retry interrupted work, return results to you, protect tenant boundaries, enforce service limits, investigate failures, and operate the service. Access controls scope durable drawing records and artifacts to the authenticated owner and project. If supported API or MCP access is enabled, an authenticated client acting with your credentials and project scope may submit work and retrieve your results.
Draftwright's Stage 2 drawing review and Stage 3 drawing chat use a Draftwright-funded, server-run Codex or OpenCode agent. Stage 2 sends the current Sheet script, part metadata, generated Draftwright API reference, deterministic critique, rendered PNG, and bounded previous-attempt diagnostic. Stage 3 sends your drawing instruction, current Sheet script, generated Draftwright API reference, deterministic critique, and rendered PNG. To preserve context, Stage 3 may resume the stored agent session for that drawing, subject to the selected model and runtime's context limits. The selected agent returns a proposed replacement script and bounded response, which Draftwright validates and renders before applying. Stage 3 messages are stored as private, owner-scoped artifacts so the conversation and interrupted work can resume. We do not send your raw account identifier to the model service; we send a keyed, non-reversible safety identifier used for abuse monitoring. The browser does not hold a model-provider credential or call a model directly.
Draftwright configures model requests not to retain response state where the selected service supports that control, and does not opt customer content into provider model training. The selected model service may retain limited request data for safety, abuse prevention, or legal compliance under its own terms and privacy policy.
Google OAuth is used only for Draftwright account authentication and account transfer. It does not request model access, and Draftwright does not store provider access or refresh tokens for drawing generation in the browser. Signing out does not clear every locally saved setting, script, or project; clear this site's browser storage to remove all application data held on that device.
We use Vercel Web Analytics and Speed Insights for aggregate website usage and performance measurement. We also store the limited account-linked product events and durable job/queue metadata described above in Supabase so we can understand activation, reliability, demand, and failures. We do not intentionally put customer CAD content, prompts, scripts, credentials, filenames, email addresses, or raw errors into product analytics.
A submitted Stage 3 correction summary is linked internally to its account and successful Stage 2 job for ownership checks, replay prevention, distinct-user reporting, and comparison with cost, turn, and reliability telemetry. It is pseudonymous personal data while those links exist. Raw application access is restricted to narrowly scoped service operations; authorised database operators retain administrative access. Reports are suppressed below five distinct account owners.
We do not currently send Stage 3 correction summaries to an AI provider. If we enable AI-assisted product analysis, we will first remove account, job, session, request, and exact-time identifiers and send only allowlisted categorical fields, bounded counts, and coarse operational buckets in batches. We will not send drawing content or use this analysis to make a decision about an individual.
Where UK or EEA data-protection law applies, we process account and drawing data as necessary to provide the service you request and take steps at your request before providing it. We process security, abuse prevention, reliability, limited product analytics, and service administration for our legitimate interests in operating and improving a safe service, balanced against user rights. We process information where necessary to comply with legal obligations, and rely on consent where the law requires it for a specific optional activity. You may withdraw consent without affecting earlier lawful processing.
We disclose data only as needed to operate the service, follow your instructions, protect users and the service, or comply with law. Our principal service providers are:
These providers may process information in the United Kingdom, European Economic Area, United States, or other countries in which they and their subprocessors operate. Where restricted-transfer rules apply, we rely on applicable adequacy arrangements or contractual and organisational safeguards offered by the relevant provider. Contact us for further information. We do not sell your personal data.
For linked accounts, we retain account, project, durable drawing, job, artifact, and product-event data while the account remains active and for as long as reasonably needed to provide resumable work, protect the service, diagnose failures, meet legal obligations, and resolve disputes. Production does not currently apply a fixed automatic deletion period to all durable records and artifacts associated with a linked account.
A linked Stage 3 correction summary is retained for no more than 90 days from its start. A bounded deletion task removes expired summaries, and deleting the associated account or Stage 2 job also deletes its summary. Aggregate reports are recomputed from the retained summaries and no longer include a summary after it is deleted.
Trial work is temporary. An unlinked anonymous trial identity and its associated projects, uploaded models, scripts, job records, previews, and generated files become eligible for permanent deletion after 24 hours with no activity recorded by Draftwright. Active jobs or operations, an account link in progress, and documented ownership, incident, or legal holds exclude an identity from cleanup. Linking the trial to an account before deletion preserves the identity and its work.
We are introducing anonymous-trial deletion in stages. The production classifier currently operates in observation-only mode and does not delete eligible trial data. Eligible data may therefore remain longer while deletion is disabled. This temporary staging does not make trial storage durable or guarantee preservation or recovery; once deletion is enabled, eligible trial data may be deleted without further notice.
We periodically review retention as cleanup and account-deletion capabilities are completed. Deleted live data may remain for a limited period in provider backups and disaster-recovery copies until those copies expire or are overwritten under provider backup schedules. Browser data remains until you remove it, use an applicable reset control, or clear site storage.
We use access controls, private storage, authenticated project scoping, bounded execution, and operational safeguards intended to protect data. No internet service is completely secure, and this alpha service may change as its controls are tested and improved. Durable storage and project-save features do not guarantee preservation, recovery, or availability of data. Data may be lost or become unavailable, so retain independent copies of source files, scripts, projects, and outputs you need.
Depending on your location and the lawful basis involved, you may have rights to access, correct, erase, restrict, object to processing, or receive a portable copy of personal data, and to withdraw consent. To exercise a right or request account and associated data deletion, email us. We may need to verify your identity. We will assess and complete valid requests as required by applicable law, subject to data we must retain and the backup limitations described above. The service does not currently offer verified instant self-service deletion of every durable record and storage object.
If UK data-protection law applies, you may complain to the Information Commissioner's Office. Please contact us first if you would like us to try to resolve a concern.
We may update this policy as the service or law changes. We will update the effective date and, where appropriate, provide a prominent notice or seek renewed agreement before a material change takes effect.
For privacy questions, contact: paul@fremantle.org