This English version is a translation provided for information. The German version is the legally binding one.

    Privacy Policy

    Status: October 2026

    1. General Information

    The protection of your personal data is an important concern to us. This Privacy Policy informs you about which personal data we process when using the website and the platform draftgo.io, for what purposes and on which legal basis this takes place, and which rights you are entitled to.

    2. Controllers (Art. 26 GDPR)

    draftgo is a joint product of the companies named below. Development and operation take place under joint responsibility; the companies are joint controllers within the meaning of Art. 26 GDPR:

    Mai Ventures GmbH

    Heinrich-Bettinger-Str. 14
    78333 Stockach
    Represented by: Simon Mai

    pacutec UG (haftungsbeschränkt)

    Heinrich-Bettingerstr. 11
    78333 Stockach
    Represented by: Pascal von Briel

    The two companies have concluded an agreement pursuant to Art. 26 GDPR setting out who fulfils which obligations under the GDPR. We will make the essential content of this agreement available to you upon request. You may assert your rights as a data subject against either of the two companies.

    Central contact point for data protection enquiries

    E-mail: service@draftgo.io

    3. Content of our customers (data processing)

    Insofar as our customers process files, comments and other content in draftgo – such as data of team members, guests or persons contained in uploaded files –, we act as a processor pursuant to Art. 28 GDPR. The respective customer is responsible for this processing. The basis is our data processing agreement (DPA), which becomes part of the contract with the customer upon registration. Please direct enquiries regarding these data to the customer who invited you or uploaded your data.

    4. Hosting and Infrastructure

    The application is provided via the cloud infrastructure of specialised service providers.

    Lovable Cloud

    Provider: Lovable Labs Incorporated, 1 Lincoln St, Boston, MA 02111, USA.
    Purpose: Provision of the frontend and execution of server-side functions (Edge Functions).
    Third-country transfer: on the basis of the EU Standard Contractual Clauses.

    Supabase

    Purpose: Database, authentication and file storage.
    Storage location: Servers within the European Union (Frankfurt region, Germany). The physical infrastructure is provided by Amazon Web Services (AWS).

    Cloudflare

    Provider: Cloudflare, Inc., San Francisco, USA.
    Purpose: Runtime environment and delivery of the application via a global data centre network.
    Third-country transfer: on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.

    Server location

    Stored data (database and files) are located on servers in the European Union. During the delivery of the application and the execution of server-side functions, data may also be processed outside the European Union (see Section 10).

    Purpose and legal basis

    Provision of the application, IT security and technical support on the basis of Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation).

    5. Data Processing When Using draftgo.io

    a) Registration and user account

    In principle, a user account is required to use draftgo. For guests, letter b applies.

    Data: Email address, password (stored exclusively in encrypted form), profile name, and company information. Section 3 applies to the content you create in projects (projects, files, comments).
    Authentication: via Supabase Auth. Login via third-party providers (social login) does not take place.
    Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

    b) Guest access

    Our customers can invite external participants as guests. Guests review files without their own user account via a personal link.

    Data: Name and email address of the guest as well as the comments and approvals submitted by the guest.
    Responsibility: The invitation is issued by our customer. The customer is responsible for this processing; we act as a processor (see Section 3).

    c) Server log files

    Each time the website is accessed, our systems automatically collect data.

    Data: IP address, time of access, browser type, operating system, referrer URL, and logs of the Edge Functions.
    Storage period: 7 to 30 days; the data is subsequently deleted.
    Legal basis: Art. 6(1)(f) GDPR (legitimate interest in error analysis and defence against attacks).

    d) Website language

    The website is available in German and English. Upon your first visit, we determine the displayed version based on the language of your browser and – only if this is not German – based on the country to which your IP address is assigned.

    Data: Browser language and the country derived from the IP address. The country is used exclusively for this decision; neither the IP address nor the country is stored in the process.
    Storage of the language selection: Your language selection is stored in your browser’s local storage so that it is retained during subsequent visits. It is not transmitted to third parties. You can change it at any time via the language switcher or remove it by deleting the website data in your browser.
    Legal basis: Art. 6(1)(f) GDPR (legitimate interest in an understandable presentation of the website); the storage of the language selection is necessary for the presentation requested by you (Section 25(2) no. 2 TDDDG).

    e) Fonts

    The fonts used on the website and within the platform are integrated locally and delivered from our own servers. No connection to servers of Google or other font providers takes place in this process.

    6. Other Service Providers

    Stripe

    Provider: Stripe Payments Europe, Ltd. (Ireland); a transfer to Stripe, Inc. (USA) is possible.
    Zweck: Processing of payments and subscriptions.
    Data: Payment and billing data.
    Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

    E-mail dispatch: Google Workspace

    Provider: Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland; a transfer to Google LLC (USA) is possible.
    Purpose: Dispatch of our e-mails from the mailbox service@draftgo.io, e.g. invitations, notifications from projects, invoice and support e-mails, e-mails to prospective customers as well as our newsletter (see Section 7).
    Data: E-mail address and name of the recipients as well as the content of the respective e-mail.
    Legal basis: Art. 6(1)(b) GDPR (performance of a contract) for e-mails in the context of using draftgo; Art. 6(1)(f) GDPR (legitimate interest in communicating with prospective customers and business partners); for the newsletter, your consent pursuant to Art. 6(1)(a) GDPR. For e-mails triggered by our customers via draftgo (e.g. invitations of guests), we act as a processor (see Section 3).
    Third-country transfer: on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.

    E-mail dispatch: Lovable

    Provider: Lovable Labs Incorporated, 1 Lincoln St, Boston, MA 02111, USA.
    Purpose: Dispatch of e-mails for log-in and account security (confirmation of registration, log-in link, password reset) as well as a fallback route if dispatch via Google Workspace is temporarily not possible.
    Data: E-mail address of the recipients as well as the content of the respective e-mail.
    Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in reliable delivery).
    Third-country transfer: on the basis of the EU Standard Contractual Clauses.

    Browserless

    Provider: Browserless (USA).
    Purpose: automated generation of website preview images in your projects. As a rule, no personal data of yours are transferred in this process.
    Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

    7. Newsletter

    We send our newsletter ourselves; an external newsletter service is not used.

    Subscription: Via the subscription forms on the blog and in the footer of the website, you will receive a confirmation e-mail with a link after entering your e-mail address. Only once you access this link is the subscription completed (double opt-in). Alternatively, you can subscribe to the newsletter during registration via a voluntary checkbox; as your e-mail address is in this case already verified upon confirmation of your user account, we do not send a separate confirmation e-mail.
    Data: E-mail address, status of the subscription, location of subscription (e.g. blog, website or registration), date and time of subscription and confirmation, IP address upon confirmation (to provide proof of your consent) as well as, where applicable, date and time of unsubscription.
    No performance measurement: We do not evaluate whether or when you open the newsletter or which links you click.
    Dispatch: via Google Workspace (see Section 6). The data is stored in our database at Supabase on servers in the European Union (Frankfurt region).
    Legal basis: Your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future, for instance via the personal unsubscribe link in each newsletter, via the unsubscribe function of your e-mail client or by e-mail to service@draftgo.io.
    Retention period: We delete unconfirmed subscriptions after 30 days. Following an unsubscription, we no longer send any newsletters; we retain the information regarding subscription, confirmation and unsubscription for as long as we must maintain proof of previously granted consent.

    Use of the company domain for our sales research

    In the case of confirmed subscribers with a business e-mail address, our team may use the domain of the address (e.g. “beispiel.de”) as a starting point to research publicly available information about the respective company and comparable companies. In doing so, we use an AI assistant (Claude by Anthropic, PBC, USA); only the domain is transmitted in this process, not your e-mail address. We do not use your newsletter address for sales e-mails, and your subscription does not constitute consent to promotional contact. Addresses from freemail providers are not considered.
    Legal basis: Art. 6(1)(f) GDPR (legitimate interest in identifying suitable business customers).
    Third-country transfer: on the basis of the EU Standard Contractual Clauses.
    Objection: You can object to this use at any time, e.g. by e-mail to service@draftgo.io.

    8. Analytics, Marketing and Cookies

    We use Google Tag Manager (GTM) of Google Ireland Ltd. exclusively as a technical container in order to control the analytics and marketing services listed below. The legal basis for all services mentioned below is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. Prior to your consent, neither cookies are set nor are scripts from these providers executed.

    Google Consent Mode v2

    By default, any tracking is deactivated (status “denied”). Only after your active consent in the cookie banner are the respective services activated. In addition, a technical pre-consent guard prevents session replay scripts (in particular Mouseflow) from being loaded prior to your consent.

    Google Analytics 4

    Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.
    Purpose: Audience measurement and statistical analysis of user behaviour to improve the offering.
    Data: truncated IP address, device and browser information, referrer, interaction events, pseudonymous client ID.
    Storage location: EU with possible transfer to the USA (safeguarded by EU Standard Contractual Clauses and EU-US Data Privacy Framework).
    Storage period: up to 14 months.
    Privacy Policy: policies.google.com/privacy

    Google Ads / Conversion-Tracking

    Provider: Google Ireland Ltd., Dublin, Ireland.
    Purpose: Measuring the effectiveness of our advertisements (conversion tracking) as well as remarketing.
    Data: click IDs (GCLID), conversion events, device and browser information, pseudonymous cookie IDs.
    Storage location: EU/USA (EU Standard Contractual Clauses, EU-US Data Privacy Framework).
    Storage period: up to 540 days.
    Privacy Policy: policies.google.com/privacy

    LinkedIn Insight Tag

    Provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.
    Purpose: Conversion measurement, target audience creation and retargeting for LinkedIn campaigns.
    Data: pseudonymous LinkedIn member ID, IP address, device and browser information, visited pages, timestamp.
    Storage location: EU/USA (EU Standard Contractual Clauses).
    Storage period: up to 180 days.
    Privacy Policy: linkedin.com/legal/privacy-policy

    Mouseflow (Session-Replay & Heatmaps)

    Provider: Mouseflow ApS, Flæsketorvet 68, 1711 Kopenhagen, Denmark.
    Purpose: Analysis of pseudonymised user journeys (session replay, heatmaps) to optimise the performance and usability of the website.
    Data: anonymised IP address, mouse, click, scroll and keyboard inputs (contents of input fields are automatically masked), device and browser information.
    Storage location: EU.
    Storage period: generally 12 months.
    Special feature: By means of a technical pre-consent guard, the Mouseflow script is verifiably loaded only after your active consent to analytics cookies.
    Privacy Policy: mouseflow.com/legal/privacy

    Withdrawal of your consent

    You may withdraw your consent for all aforementioned services at any time with effect for the future by adjusting your cookie settings on our website. The lawfulness of the processing carried out up to the withdrawal shall remain unaffected.

    9. AI Features

    draftgo offers AI features that you trigger yourself. No content is transmitted to an AI model without your action.

    AI review of files (Add-on “AI Assistant”)

    If you start the AI review for a file, its content (the pages of a PDF or the image) is transmitted to a language model and checked for formal and technical errors. The results are saved as comments on the file. The feature is only available to companies that have booked the add-on and can be deactivated on a per-project basis.

    Assistant “GO”

    If you ask the assistant a question, your input and the information from the respective project required to answer it (e.g. file names, status and comments) are transmitted to a language model.

    Service providers

    Processing takes place via the Lovable AI Gateway of our infrastructure provider Lovable Labs Incorporated (USA) using language models from Google (Gemini). Processing may also take place outside the European Union (see Section 10).

    Purpose and legal basis

    Provision of the feature requested by you on the basis of Art. 6(1)(b) GDPR (performance of a contract). We do not use your content to train AI models.

    10. Transfers to third countries

    Some of the service providers mentioned are based in the USA or process data outside the EU and the EEA. Such a transfer takes place only if the requirements of Art. 44 et seq. GDPR are met – in particular on the basis of an adequacy decision of the European Commission (e.g. EU-US Data Privacy Framework for certified companies) or the EU Standard Contractual Clauses.

    11. Storage period

    Insofar as no specific storage period is stated in this Privacy Policy, we only store personal data for as long as is necessary for the respective purpose. We delete data from your user account after termination of the contract, provided that no statutory retention obligations, such as under commercial and tax law, preclude this.

    12. Your Rights

    Under the GDPR, you have the following rights:

    • Right of access (Art. 15 GDPR): You may request information regarding which personal data we process about you.
    • Right to rectification (Art. 16 GDPR): You may request the rectification of inaccurate data.
    • Right to erasure (Art. 17 GDPR): You may request the erasure of your data (“right to be forgotten”).
    • Right to restriction of processing (Art. 18 GDPR): You may, under certain conditions, request that we restrict the processing of your data.
    • Right to data portability (Art. 20 GDPR): You may receive your data in a structured, commonly used and machine-readable format.
    • Right to object (Art. 21 GDPR): You may object to processing that is based on our legitimate interest on grounds relating to your particular situation.
    • Withdrawal of consent (Art. 7(3) GDPR): You may withdraw consent granted at any time with effect for the future.
    • Right to lodge a complaint (Art. 77 GDPR): You may lodge a complaint with a data protection supervisory authority, in particular with the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.

    To exercise your rights, an e-mail to service@draftgo.io is sufficient.

    13. Data Security

    We employ state-of-the-art encryption methods (e.g. TLS), access rights per project and user, as well as the security mechanisms of Supabase to protect your data against unauthorised access.