DraftAria Privacy Policy

This Privacy Policy explains how DraftAria ("DraftAria", "we" or "us") collects, uses and shares personal information when you visit draftaria.com, subscribe to our newsletter, contact us or book a demo, or use the DraftAria application and Word add-in.

Content your firm puts into DraftAria is handled differently. Documents, case details and other material a law firm submits to DraftAria ("Customer Content") belong to that firm. For Customer Content, the firm is in control and we act as its service provider (a "processor"): we process it only on the firm's instructions, under our Terms of Service and Data Processing Agreement. If your information appears in a document a law firm uploaded, for example as a client, opposing party or witness, please contact that firm; we will help it respond.

Information you give us

• Account information: your name, work email address, password (stored only in hashed form by our authentication provider), your firm and your role (attorney, paralegal or firm admin).
• Customer Content: documents, text, files and case details you or your colleagues submit, and what DraftAria produces from them (see above).
• Billing information: when a firm subscribes, the billing email and firm name, and the number of seats. Payment card details are entered directly on Stripe's payment page; we never receive or store full card numbers. Stripe tells us the subscription status and gives us invoices.
• Newsletter: your email address and the page where you signed up.
• Contact and demo requests: what you enter in our contact or demo form (such as your name, email, firm and message). If you book a demo, Calendly collects your name, email and the time you pick.
• Support and correspondence: emails you send us and our replies.

Information collected automatically

• Server and request logs: our hosting providers (Vercel for the website, Supabase for the application) record standard request data such as IP address, browser and device type, pages or endpoints requested, and the time of the request.
• Activity in the app: records needed to run and secure the Service, such as usage counts for rate limits and entries in your firm's audit log (for example, team invitations).
• Browser storage: the app stores your sign-in session and your light/dark theme choice in your browser's local storage. These are needed for the site to work.
• Analytics and advertising cookies, only if you accept them: see Cookies and analytics.

• to provide the Service: create and secure accounts, store your firm’s work, generate and check documents, and run the features you use;
• to run Aria features you choose to use (see the next section);
• to keep the Service secure and prevent abuse, including rate limits and investigating suspicious activity;
• to bill subscriptions through Stripe;
• to send service emails, such as sign-up confirmation, password reset, billing notices and notice of changes to our terms;
• to respond to support requests, contact and demo requests;
• to send our newsletter, if you subscribed;
• to understand how our website is used and to measure our advertising, only if you accept analytics or advertising cookies; and
• to comply with law and enforce our terms.

We do not use Customer Content to train AI models, to advertise, or for any purpose other than providing the Service to the firm that submitted it.

Aria's features use Anthropic's Claude models through Anthropic's commercial API. When you use an Aria feature, the text you submit (and, in the AI workspace, files you attach) is sent from our servers to Anthropic to produce the response. Your browser never connects to the AI provider directly.

• No training. Customer Content is never used to train AI models, by us or by Anthropic under its commercial terms.
• Limited retention by Anthropic. We do not have a zero-data-retention arrangement with Anthropic. Under its commercial terms, Anthropic may keep API inputs and outputs for a limited period (for example, for trust and safety review) before deleting them.
• Rule-based checks don't use AI. Filing checks and the citation checker run on stored rules. When citation lookup is turned on, only the citation strings found in a document are sent to Free Law Project's CourtListener service, not the document.

Essential storage. We use browser storage to keep you signed in and to remember your theme. This is necessary for the site and app to work and is not used for analytics or advertising.

Analytics and advertising tags, only with your consent. Our website may use Google Analytics 4 (Google), the Meta Pixel (Meta) and the LinkedIn Insight Tag (LinkedIn). These tools load only after you accept analytics or advertising cookies in our cookie banner. If you decline or ignore the banner, they don't load.

If you accept, these providers may set cookies or similar identifiers in your browser and receive information such as the pages you visit on our website, the site that referred you, your browser and device type, an approximate location derived from your IP address, and interactions such as clicking a button or submitting a form. We use this to understand how the website is used and to measure our advertising. Meta and LinkedIn may also use it to show you DraftAria ads on their platforms and to measure them. These providers handle that information under their own privacy policies. We never send Customer Content to analytics or advertising providers.

You can change your choice at any time with the Cookie settings link at the bottom of every page, or by clearing the cookies and site data for draftaria.com in your browser. These tags never load inside the signed-in app. You can also use your browser's settings to block cookies.

We share personal information only as follows:

• Service providers (subprocessors) that help us run DraftAria: Supabase (database, sign-in and file storage), Vercel (website hosting), Anthropic (AI), Stripe (payments), Resend (account and support emails) and Free Law Project's CourtListener (citation strings only, when used). The current list, with what each receives, is on our Trust Center. Calendly handles demo bookings for people who book one.
• Analytics and advertising providers (Google, Meta, LinkedIn), only if you accept those cookies, as described above.
• Within your firm. Other members of your firm workspace can see your name, role and the work you share in the workspace, and firm admins can see the firm's members and audit log.
• Legal reasons. When we believe in good faith it is required by law or legal process, or needed to protect the rights, safety or security of our users, the public or DraftAria. For Customer Content, we follow the notice commitments in our DPA.
• Business transfers. As part of a merger, acquisition or sale of assets, subject to this policy's protections.
• With your direction or consent.

We do not sell personal information, and we do not share it for cross-context behavioral advertising, except that if you accept advertising cookies on our website, the Meta Pixel and LinkedIn Insight Tag may share information about your visit with Meta and LinkedIn for advertising. Some state laws treat that as "sharing" or "targeted advertising"; you can opt out by declining or withdrawing consent for those cookies.

• Accounts and Customer Content are kept until the firm deletes them or a firm admin asks us to delete them. There is no automatic deletion schedule. Deleted data can remain in our database provider's automatic backups for a limited period until those backups expire.
• Newsletter sign-ups are kept until you unsubscribe.
• Contact and demo requests and support emails are kept as long as needed to respond and to keep a record of our correspondence, and deleted on request where the law allows.
• Billing records are kept by us and Stripe as long as needed for accounting and tax purposes.
• Server logs are kept by our hosting providers for their standard log retention periods.

We protect information with firm isolation through row-level security, encryption in transit (TLS) and at rest, role-based access and an audit log for firm admins. Only DraftAria's founder can access customer data, and only when a firm asks for help that requires it. No system is perfectly secure, and some controls are not yet in place (we have not completed a SOC 2 audit, and single sign-on and multi-factor authentication are not yet available). See our Security page for details.

Depending on where you live, U.S. state privacy laws (such as those of California, Colorado, Connecticut, Virginia and other states) may give you the right to:

• know what personal information we have about you and get a copy of it (access and portability);
• correct inaccurate personal information;
• delete personal information we have about you;
• opt out of the sale of personal information, of “sharing” for cross-context behavioral advertising, and of targeted advertising (we don’t sell personal information; to opt out of advertising cookies, decline or withdraw consent as described above); and
• not be discriminated against for exercising these rights.

We give these rights to all our U.S. users, whether or not a state law requires it. To make a request, email support@draftaria.com from the email address linked to your account or newsletter subscription. We may need to confirm your identity before acting. You can use an authorized agent, who must show us that you have authorized them. We will respond within the time the law requires (generally 45 days). If we decline your request, you can reply to ask us to reconsider, and we will explain our decision; if you are still not satisfied, you may contact your state attorney general.

If your request concerns Customer Content that a law firm submitted (for example, a document about a case you are involved in), we will refer you to that firm, because the firm decides how that information is handled, and we will help it respond.

You can unsubscribe from the newsletter at any time by emailing support@draftaria.com.

DraftAria is a professional service for adults. You must be at least 18 to use it, and it is not directed at children. We don't knowingly collect personal information from children, other than as it may appear in Customer Content that a law firm submits, which we process only on that firm's behalf. If you believe a child has given us personal information, contact us and we will delete it.

DraftAria is intended for use in the United States. Account data and Customer Content are stored in the United States, in the AWS US West (Oregon) region through our database provider, Supabase. If you access DraftAria from outside the United States, your information will be transferred to, and processed in, the United States.

We will post any changes on this page and update the "Last updated" date. If a change materially affects how we handle your personal information, we will tell account holders by email or in the app before it takes effect.

For privacy questions or requests, email support@draftaria.com.