Privacy Policy

Last updated: July 2026

1. Introduction

Draftly ("we", "us") is an AI-powered reply assistant operated by App X Link, House 1/D/1 (3rd Floor), Road 7/A, Dhanmondi, Dhaka 1209, Bangladesh. It consists of a browser extension and the website at draftly.appxlink.com. This policy explains what data we collect, why we collect it, and how it is handled.

2. Information We Collect

Account information

When you sign in with Google we receive your email address, display name, and profile picture. When you register with email and password we collect your full name, email address, and a password (stored only as a salted cryptographic hash — we never store or see your plain-text password). We use these solely to create, secure, and identify your account.

Payment and billing information

Payments are processed by Paddle (paddle.com), our Merchant of Record. Paddle collects and processes your payment details; we never see or store card numbers. We receive from Paddle your subscription status, plan, and transaction history (amount, currency, invoice number) to operate your account and show your payment history.

Conversation content

When you request an AI-generated reply or translation, the content of the conversation you are viewing (ticket description, message history, subject, and related metadata from Jira Service Management, Intercom, or Gmail) is transmitted to our servers and forwarded to our AI provider (Google Gemini) to produce the draft. This content is processed transiently to generate your reply — it is not stored on our servers and not used to train AI models.

Settings and preferences

We store the configuration you create in Draftly — saved prompts, system instructions, reply-style preferences, signature details, and language settings — so they are available across your devices.

Usage data

We record the number of AI generations you use each month to enforce plan limits, and standard technical logs (IP address, browser type, request identifiers, error logs) to operate and secure the Service.

3. How We Use Information

• To provide, operate, and improve the Service;
• To authenticate you and secure your account;
• To process subscriptions and enforce plan limits;
• To send transactional emails (account verification, password resets, subscription and billing notifications);
• To respond to support requests;
• To comply with legal obligations.

We do not sell your personal data. We do not send marketing email without your consent.

4. Google User Data (Limited Use Disclosure)

Draftly's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail message content is read only when you actively use Draftly on an open email thread, only to display context and generate the reply you request, and is never retained, sold, or used for advertising or model training.

5. Third-Party Services

We share data only with the service providers required to operate Draftly:

• Paddle — payment processing and subscription billing (Merchant of Record);
• Google Gemini — AI processing of conversation content to generate replies and translations;
• Cloudflare — application hosting, database, and network security;
• Resend — delivery of transactional emails;
• Google — OAuth sign-in.

6. Data Retention

• Conversation content — not stored; processed transiently per request.
• Account data and settings — retained while your account is active and for 30 days after deletion.
• Payment records — retained for 7 years to meet financial and tax obligations.
• Support communications — retained for up to 3 years.

7. Your Rights

Depending on your location, you may have the right to request access to, rectification or erasure of, or portability of your personal data, to restrict or object to processing, and to withdraw consent. To exercise any of these rights, email draftly@appxlink.com — we respond within 30 days. Deleting your account removes all associated settings, prompts, and subscription records.

8. Security

All traffic is encrypted in transit with TLS. Passwords are stored as salted PBKDF2 hashes. Access tokens are short-lived and signed; sessions can be revoked by signing out or resetting your password. Production secrets are stored in encrypted secret storage.

9. Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.

10. International Transfers

Our infrastructure providers operate globally; your data may be processed in countries other than your own. We rely on our providers' safeguards (including standard contractual clauses where applicable) for such transfers.

11. Changes to This Policy

We may update this policy as the product evolves. Material changes will be announced on this page with an updated date at least 30 days before they take effect where practicable.

12. Contact

App X Link
Privacy: draftly@appxlink.com
Support: draftly@appxlink.com
Address: House 1/D/1 (3rd Floor), Road 7/A, Dhanmondi, Dhaka 1209, Bangladesh