This English version is a translation provided for information. The German version is the legally binding one.

    Privacy Policy

    As of: September 2026

    1. General Information

    The protection of your personal data is an important concern to us. This Privacy Policy informs you about which personal data we process when using the website and the platform draftgo.io, for what purposes and on which legal basis this takes place, and what rights you are entitled to.

    2. Controllers (Art. 26 GDPR)

    draftgo is a joint product of the companies named below. Development and operation are carried out under joint responsibility; the companies are joint controllers within the meaning of Art. 26 GDPR:

    Mai Ventures GmbH

    Heinrich-Bettinger-Str. 14
    78333 Stockach
    Represented by: Simon Mai

    pacutec UG (haftungsbeschränkt)

    Heinrich-Bettingerstr. 11
    78333 Stockach
    Represented by: Pascal von Briel

    The two companies have concluded an agreement pursuant to Art. 26 GDPR in which they determine who fulfils which obligations under the GDPR. We will make the essential content of this agreement available to you upon request. You may assert your rights as a data subject against either of the two companies.

    Central contact point for data protection enquiries

    E-mail: service@draftgo.io

    3. Content of our customers (Processing on behalf)

    Insofar as our customers process files, comments and other content in draftgo – such as data of team members, guests or persons contained in uploaded files –, we act as a processor pursuant to Art. 28 GDPR. The respective customer is responsible for this processing. The basis is our data processing agreement (DPA), which becomes part of the contract with the customer upon registration. Please direct enquiries regarding this data to the customer who invited you or uploaded your data.

    4. Hosting and Infrastructure

    The application is provided via the cloud infrastructure of specialised service providers.

    Lovable Cloud

    Provider: Lovable Labs Incorporated, 1 Lincoln St, Boston, MA 02111, USA.
    Purpose: Provision of the frontend and execution of server-side functions (Edge Functions).
    Third-country transfer: on the basis of the EU Standard Contractual Clauses.

    Supabase

    Purpose: Database, authentication and file storage.
    Storage location: Servers within the European Union (Frankfurt region, Germany). The physical infrastructure is provided by Amazon Web Services (AWS).

    Cloudflare

    Provider: Cloudflare, Inc., San Francisco, USA.
    Purpose: Runtime environment and delivery of the application via a global data centre network.
    Third-country transfer: on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.

    Server location

    Stored data (database and files) are located on servers within the European Union. During the delivery of the application and the execution of server-side functions, data may also be processed outside the European Union (see Section 10).

    Purpose and legal basis

    Provision of the application, IT security and technical support on the basis of Art. 6(1)(b) GDPR (performance of a contract) as well as Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation).

    5. Data processing when using draftgo.io

    a) Registration and user account

    A user account is generally required to use draftgo. For guests, letter (b) applies.

    Data: Email address, password (stored exclusively in encrypted form), profile name, and company information. Section 3 applies to the content you create in projects (projects, files, comments).
    Authentication: via Supabase Auth. Login via third-party providers (social login) does not take place.
    Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

    b) Guest access

    Our customers can invite external participants as guests. Guests review files without having their own user account via a personal link.

    Data: Name and email address of the guest, as well as the comments and approvals submitted by the guest.
    Responsibility: The invitation is issued by our customer. The customer is responsible for this processing; we act as a processor (see Section 3).

    c) Server log files

    Each time the website is accessed, our systems automatically collect data.

    Data: IP address, time of access, browser type, operating system, referrer URL, and logs of the Edge Functions.
    Retention period: 7 to 30 days; the data is subsequently deleted.
    Legal basis: Art. 6(1)(f) GDPR (legitimate interest in error analysis and defence against attacks).

    d) Website language

    The website is available in German and English. Upon your first visit, we determine the version displayed based on your browser language and – only if this is not German – based on the country to which your IP address is assigned.

    Data: Browser language and the country derived from the IP address. The country is used exclusively for this decision; neither the IP address nor the country is stored in the process.
    Storage of the language selection: Your language selection is stored in your browser’s local storage so that it is retained for subsequent visits. It is not transmitted to third parties. You can change it at any time using the language switcher or remove it by deleting the website data in your browser.
    Legal basis: Art. 6(1)(f) GDPR (legitimate interest in an intelligible presentation of the website); the storage of the language selection is necessary for the presentation requested by you (Section 25(2) no. 2 TDDDG).

    e) Fonts

    The fonts used on the website and in the platform are integrated locally and served from our own servers. No connection to servers of Google or other font providers takes place.

    6. Other Service Providers

    Stripe

    Provider: Stripe Payments Europe, Ltd. (Ireland); a transfer to Stripe, Inc. (USA) is possible.
    Zweck: Processing of payments and subscriptions.
    Data: Payment and billing data.
    Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

    Resend

    Provider: Resend Labs, Inc. (USA).
    Purpose: Dispatch of transactional emails, e.g. password resets and invitations.
    Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

    Browserless

    Provider: Browserless (USA).
    Purpose: Automated creation of website preview images in your projects. As a rule, no personal data of yours is transferred in this process.
    Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

    7. Newsletter

    Provider: MailerLite Limited (Ireland).
    Purpose: Dispatch of our newsletter via the double opt-in procedure as well as reach and performance measurement (open and click rates).
    Data: Email address, IP address, time of registration as well as interaction data.
    Legal basis: Your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw it at any time via the unsubscribe link in each newsletter.
    Privacy Policy: mailerlite.com/legal/privacy-policy

    8. Analytics, Marketing and Cookies

    We use the Google Tag Manager (GTM) of Google Ireland Ltd. solely as a technical container to control the analytics and marketing services listed below. The legal basis for all of the services mentioned below is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. Prior to your consent, neither cookies are set nor scripts of these providers are executed.

    Google Consent Mode v2

    By default, all tracking is disabled (status “denied”). Only after your active consent in the cookie banner are the respective services activated. In addition, a technical pre-consent guard prevents session replay scripts (in particular Mouseflow) from being loaded prior to your consent.

    Google Analytics 4

    Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.
    Purpose: Reach measurement and statistical analysis of user behaviour to improve the offering.
    Data: truncated IP address, device and browser information, referrer, interaction events, pseudonymous client ID.
    Storage location: EU with potential transfer to the USA (safeguarded by EU Standard Contractual Clauses and EU-US Data Privacy Framework).
    Storage duration: up to 14 months.
    Privacy Policy: policies.google.com/privacy

    Google Ads / Conversion Tracking

    Provider: Google Ireland Ltd., Dublin, Ireland.
    Purpose: Measuring the effectiveness of our advertisements (conversion tracking) as well as remarketing.
    Data: click IDs (GCLID), conversion events, device and browser information, pseudonymous cookie IDs.
    Storage location: EU/USA (EU Standard Contractual Clauses, EU-US Data Privacy Framework).
    Storage duration: up to 540 days.
    Privacy Policy: policies.google.com/privacy

    LinkedIn Insight Tag

    Provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.
    Purpose: Conversion measurement, target group creation, and retargeting for LinkedIn campaigns.
    Data: pseudonymous LinkedIn member ID, IP address, device and browser information, visited pages, timestamp.
    Storage location: EU/USA (EU Standard Contractual Clauses).
    Storage duration: up to 180 days.
    Privacy Policy: linkedin.com/legal/privacy-policy

    Mouseflow (Session Replay & Heatmaps)

    Provider: Mouseflow ApS, Flæsketorvet 68, 1711 Kopenhagen, Denmark.
    Purpose: Analysis of pseudonymised user journeys (session replay, heatmaps) to optimise the performance and usability of the website.
    Data: anonymised IP address, mouse, click, scroll and keystroke inputs (contents of input fields are automatically masked), device and browser information.
    Storage location: EU.
    Storage duration: generally 12 months.
    Special feature: By means of a technical pre-consent guard, the Mouseflow script is verifiably loaded only after your active consent to analytics cookies.
    Privacy Policy: mouseflow.com/legal/privacy

    Withdrawal of your consent

    You may withdraw your consent for all aforementioned services at any time with effect for the future by adjusting your cookie settings on our website. The lawfulness of the processing carried out until the withdrawal remains unaffected.

    9. AI Features

    draftgo offers AI features that you trigger yourself. No content is transmitted to an AI model without your action.

    AI review of files (Add-on “AI Assistant”)

    If you start the AI review for a file, its content (the pages of a PDF or the image) is transmitted to a language model and checked for formal and technical errors. The results are saved as comments on the file. The feature is only available to businesses with a booked add-on and can be deactivated per project.

    Assistant “GO”

    If you ask the assistant a question, your input and the information from the respective project required to answer it (e.g. file names, status and comments) are transmitted to a language model.

    Service providers

    Processing takes place via the Lovable AI Gateway of our infrastructure provider Lovable Labs Incorporated (USA) using language models from Google (Gemini). Processing may also take place outside the European Union (see Section 10).

    Purpose and legal basis

    Provision of the feature requested by you on the basis of Art. 6(1)(b) GDPR (performance of a contract). We do not use your content to train AI models.

    10. Transfer to third countries

    Some of the service providers mentioned are based in the USA or process data outside the EU and the EEA. Such a transfer only takes place if the requirements of Art. 44 et seq. GDPR are met – in particular on the basis of an adequacy decision of the European Commission (e.g. EU-US Data Privacy Framework for certified companies) or the EU Standard Contractual Clauses.

    11. Retention period

    Insofar as no specific retention period is stated in this Privacy Policy, we only store personal data for as long as is necessary for the respective purpose. We delete data of your user account after termination of the contract, provided that no statutory retention obligations, such as under commercial and tax law, preclude this.

    12. Your Rights

    Under the GDPR, you have the following rights:

    • Right of access (Art. 15 GDPR): You can request information about which personal data we process about you.
    • Right to rectification (Art. 16 GDPR): You can request the rectification of inaccurate data.
    • Right to erasure (Art. 17 GDPR): You can request the erasure of your data (“right to be forgotten”).
    • Right to restriction of processing (Art. 18 GDPR): You can, under certain conditions, request that we restrict the processing of your data.
    • Right to data portability (Art. 20 GDPR): You can receive your data in a structured, commonly used and machine-readable format.
    • Right to object (Art. 21 GDPR): You can object to processing based on our legitimate interest on grounds relating to your particular situation.
    • Withdrawal of consent (Art. 7(3) GDPR): You can withdraw consent granted at any time with effect for the future.
    • Right to lodge a complaint (Art. 77 GDPR): You can lodge a complaint with a data protection supervisory authority, in particular with the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.

    To exercise your rights, an e-mail to service@draftgo.io is sufficient.

    13. Data Security

    We use state-of-the-art encryption methods (e.g. TLS), access rights per project and user, as well as the security mechanisms of Supabase, to protect your data from unauthorised access.