1. Data Collection

We collect the following categories of data: (1) identity data you provide directly (name, email address, avatar); (2) usage data generated by your use of the service (events, tasks, guest lists, templates); (3) AI assistant chat history; (4) technical data automatically collected for security (IP address, browser type, device type, connection logs); (5) payment data processed exclusively by Stripe — we never have access to your card numbers.

2. Legal Basis & Use

We process your data on the following legal bases: contract performance (Article 6(1)(b) GDPR) to provide the core features of the service; your consent (Article 6(1)(a) GDPR) for non-essential cookies and analytics tools; our legitimate interest (Article 6(1)(f) GDPR) for security, abuse prevention, and product improvement. We never sell your data to third parties.

3. Data Storage & Sub-processors

Your data is entrusted to the following sub-processors: Firebase / Google Cloud (EU regions Belgium/Germany) for hosting, database and authentication; Stripe (Ireland, EU) for payment processing, PCI-DSS compliant; Google Gemini API (Google LLC) for the AI assistant — only the chat messages and event/task data you submit to the assistant are sent, and no data is used for model training (Gemini API Enterprise terms); Sentry (Functional Software Inc., USA) for error monitoring, with GDPR Standard Contractual Clauses signed; Cloudflare Turnstile (Cloudflare Inc., USA) for bot protection, with no cookies and no fingerprinting; Firebase Auth for authentication token management.

4. Data Retention

We retain your data according to the following durations: account data while the account is active; soft-deleted events kept for 7 days before being permanently purged; account deletion requests fully processed within 30 days maximum from production databases; backups kept up to 90 days; invoices kept for 10 years (legal obligation under Article L123-22 of the French Commercial Code); server and security logs kept for a maximum of 12 months (CNIL guideline).

5. Your Rights (GDPR)

Under the GDPR, you have the following rights over your data: right of access, right of rectification, right to erasure ("right to be forgotten"), right to data portability, right to object (Article 21), and right to restriction of processing (Article 18). To exercise these rights, contact us at contact@getdraftline.com. You also have the right to lodge a complaint with the CNIL (French data protection authority) at https://www.cnil.fr.

6. Cookies

We only use strictly necessary cookies (authentication, session, security) deployed without prior consent, in accordance with Article 82 of the French Data Protection Act. Any analytics or non-essential cookies require your explicit consent (opt-in) via the cookie banner.

7. Minimum Age

DraftLine is reserved for users aged 15 or older, in accordance with Article 8 GDPR and Article 45 of the French Data Protection Act. By creating an account, you confirm that you are 15 years old or older. If we discover an account created by a minor under 15 without verifiable parental consent, we will delete it promptly. Parents who wish to report such an account can contact us at contact@getdraftline.com.

8. Data Controller

The data controller is Samy Bouayad, self-employed (micro-entrepreneur, France), SIRET 100 583 715 00014, postal address 153 avenue du Général George S. Patton, 35000 Rennes. For any data-related question, contact contact@getdraftline.com. We commit to responding within one month (extendable to 3 months for complex requests, in accordance with Article 12 GDPR).

9. Security & Data Breaches

We apply appropriate technical and organizational measures: encryption in transit (HTTPS/TLS 1.3), encryption at rest (Firebase), strict Firestore access rules (least privilege), strong authentication, error monitoring (Sentry), bot protection (Cloudflare Turnstile), regular audits. In case of a data breach posing a risk to your rights and freedoms, we will notify the CNIL within 72 hours (GDPR art. 33) and inform you directly without undue delay if the risk is high (art. 34).

Privacy Policy