Last updated: 2026-10-07
Controller: draft. UG (haftungsbeschränkt)
Address: Barmbeker Straße 11, 22303 Hamburg, Germany
Data Protection Contact: privacy@draft.social
This Privacy Policy describes how we collect, use, and protect your information when you use our social media planning application.
We do not access, store, or process private messages, private media, or personal conversations from connected social media accounts.
We use Supabase (PostgreSQL) for data storage and authentication. We apply reasonable technical and organizational measures to protect data:
We integrate with the following third-party services:
Connected platforms process information under their own privacy policies and terms. Service providers supporting draft. are described below.
Where processing is based on your consent, you may withdraw it at any time. For marketing emails, use Settings or the unsubscribe link in a marketing email. For a connected social media account, you can disconnect it or request data deletion.
If you ask to receive them, we send occasional emails with product tips, updates and draft. news. This is optional and separate from creating an account, service messages and notification settings. Declining has no effect on your use of draft.
We rely on your consent under GDPR Art. 6(1)(a). After you request marketing emails, we send a neutral confirmation email. Marketing emails begin only after you confirm that request. We record the wording and version you saw, your request and confirmation times, the email address confirmed, and any later withdrawal or new request. We do not collect IP address or user agent as marketing consent evidence.
You can withdraw at any time in Settings or through the unsubscribe link in every marketing email, without signing in. Withdrawal stops future marketing emails; it does not affect earlier processing. A later opt-in needs a new confirmation. We keep limited consent and withdrawal evidence while needed to demonstrate the status of your permission and resolve legal claims, then delete or minimize it when no longer necessary. Account deletion stops marketing and removes user-linked consent records.
Resend processes the email address and message for delivery. Account, authentication, billing and necessary invitation emails are handled separately from marketing consent.
We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:
You have the following rights regarding your personal information:
You can exercise these rights by contacting us at contact@draft.social or visit our Data Deletion page. See our Terms of Service for more information. You also have the right to lodge a complaint with a supervisory authority.
For direct connection of an Instagram Professional account, we request instagram_business_basic to identify and manage the connected account and instagram_business_content_publish to create and publish organic photos and videos with the caption and metadata you choose. We retrieve the Instagram account/user ID, username, and account type. You select the destination, content, and publish or schedule action. This connection does not request analytics access.
We store the connected account ID, username, account type, access token, token type, expiration time, scopes, and connection-provider metadata to maintain the connection and publish your selected content. Scopes reflect permissions returned by Meta or, if absent, the requested permission set. The Connections interface receives account information and the connection method; access tokens and token metadata remain server-side.
Existing Facebook/Page connections request instagram_basic for account information, instagram_content_publish for publishing, instagram_manage_insights for performance metrics, and pages_show_list and pages_read_engagement to find Pages and their linked Instagram accounts. business_management is conditional: it is requested only when explicitly enabled in the connection configuration.
For the Facebook/Page route we retrieve and store the Instagram account ID and username, linked Page ID and name, and authorization tokens. The connection display receives account and Page identifiers and names, without tokens. Separate analytics requests retrieve available views, reach, profile views, accounts engaged, total interactions, profile link taps, and follower counts, stored as dated metrics.
You do not necessarily grant both permission sets. Publishing uses authorization tokens and account identifiers and receives media container IDs, processing status, and published media IDs.
Meta Platforms is the connected platform/API provider. Vercel executes requests that process connected-platform data; Supabase stores connection and publishing records. Sentry may receive operational diagnostics related to those requests. AI campaign recommendations use campaign information and post performance summaries when enabled. Payment and account-email services serve separate purposes.
We retain personal information only as long as necessary to provide the Service and fulfill the purposes outlined in this Privacy Policy. You can disconnect social accounts and request deletion at any time (see /data-deletion). We may retain limited data where required for legal, security, or operational reasons.
We use cookies and similar technologies to enhance your experience, analyze usage patterns, and improve our services. You can control cookie settings through your browser preferences. Some features may not function properly if cookies are disabled.
Our service providers may process information in countries outside your country of residence, including outside the European Economic Area. Contact privacy@draft.social for information about the applicable providers, processing locations, and transfer arrangements.
Our service is not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe that a child has provided us with personal data, please contact us so that we can delete such information.
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically for any changes.
If you have any questions about this Privacy Policy or our data practices, please contact us:
Email: contact@draft.social
Response Time: We will respond to your inquiry within 48 hours.