Privacy Policy
Effective 27 October 2026
1. Who is responsible
Tanzeel Labs LLC, Delaware, United States of America ("we") is the controller of personal data about our users and website visitors.
For personal data inside the contracts and documents our customers process in Draftbench, the customer is the controller and we act as their processor under our Data Processing Agreement.
Contact: privacy@draftbench.com.
2. What we collect
| Data | Examples | Source |
|---|---|---|
| Account data | Name, email, organisation, role, password hash | You |
| Billing data | Billing name and address, VAT number, invoices. Card details are handled by Stripe; we never see full card numbers | You, Stripe |
| Content | Briefs, contracts, comments, uploaded documents, signatures; these may include personal data of other people, such as counterparties | You and the people you invite |
| Signing data | Signer name, email, IP address, time, verification code result, document fingerprint | Signers |
| Usage and security data | Log‑ins, IP address, device and browser, actions in the Service, error logs | Automatically |
| Support data | Messages you send us, problem reports | You |
We use only cookies that are strictly necessary for the Service to work (for example keeping you signed in). We do not use advertising or tracking cookies. Any analytics we use are cookie‑free and do not identify you.
3. Why we use it, and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the Service, including AI drafting, review and signing | Contract |
| Billing, invoices and tax records | Contract; legal obligation |
| Security, fraud and abuse prevention, usage limits | Legitimate interests |
| Improving quality, using problem reports you choose to send | Legitimate interests |
| Service emails (renewal reminders, security alerts, key‑date reminders) | Contract |
| Marketing emails | Consent; you can withdraw at any time |
| Complying with law and responding to authorities | Legal obligation |
We do not make decisions with legal or similarly significant effects about you based solely on automated processing. The Service produces drafts and analysis that you decide whether to use.
4. AI processing
Content you submit for drafting, review or revision is sent to our AI provider, Anthropic, to generate the output. Content is stored in our database in Frankfurt, Germany. AI processing takes place in the United States, under Standard Contractual Clauses.
Neither we nor Anthropic use your content to train AI models. Anthropic may keep inputs for up to 30 days for trust‑and‑safety purposes, as set out in its commercial terms.
5. Who we share it with
We share personal data only with the providers below (our sub‑processors), with a lawyer you choose for review, and where the law requires.
| Provider | Purpose | Location |
|---|---|---|
| Render | Hosting and database | Frankfurt, Germany (US company) |
| Anthropic | AI processing | United States |
| Stripe | Payments | EU and United States |
| Resend | Transactional email | United States |
We give customers 15 days' notice before adding or replacing a sub‑processor. We never sell personal data.
6. International transfers
Where personal data leaves the EEA, the UK or another country with transfer rules, we use the European Commission's Standard Contractual Clauses (with the UK addendum where relevant), or rely on an adequacy decision such as the EU–US Data Privacy Framework where the provider is certified. Ask us at privacy@draftbench.com for a copy of the safeguards.
7. How long we keep it
- Account data: while your account is open, then 30 days after closure.
- Content: until you delete it or close your account. Closed matters are deleted after 24 months unless you choose to keep them.
- Signing evidence: for the retention period shown on the signing certificate, so you can prove execution.
- Invoices and tax records: as long as tax law requires, typically up to 10 years.
- Backups: deleted data disappears from backups as they expire, within 30 days.
8. Security
Measures include:
- encryption in transit (TLS);
- session-based authentication with secure password hashing (bcrypt) and rate-limited login;
- access controls that limit each user to their own data;
- logging of access to content and security events;
- backups where the hosting provider supports them.
If a personal‑data breach occurs, we act under our breach‑response plan and notify authorities and affected customers as the law requires.
9. Your rights
Depending on where you live, you can:
- ask for access to your data;
- correct it;
- delete it;
- restrict or object to its use;
- receive it in a portable format;
- withdraw consent.
You can export and delete your data yourself from your account page, or write to privacy@draftbench.com. We reply within one month.
You can complain to a data-protection authority. For the EU, this is the supervisory authority in the member state where you live or work. For the UK, this is the Information Commissioner's Office (ico.org.uk). For the UAE, this is the UAE Data Office.
10. Country‑specific information
- United Kingdom: we apply the UK GDPR and the Data Protection Act 2018. You may complain to the ICO (ico.org.uk).
- United Arab Emirates: we apply the safeguards in this policy to meet Federal Decree‑Law No. 45 of 2021. For DIFC customers, AI processing is described in section 4.
- Saudi Arabia: we apply the safeguards in this policy to meet the Personal Data Protection Law, including for transfers outside the Kingdom.
- Pakistan: we apply the safeguards in this policy and the Prevention of Electronic Crimes Act 2016.
- United States (California): we do not sell or share personal information as defined by the CCPA/CPRA. We do not use sensitive personal information for purposes beyond what is necessary to provide the Service. California residents have the right to know what personal information we collect, to request its deletion, to correct inaccuracies, and to opt out of any sale or sharing (we do not sell or share). We will not discriminate against you for exercising these rights. To exercise any right, contact privacy@draftbench.com.
11. Children
The Service is not for anyone under 18. We do not knowingly collect their data.
12. Changes
We will post updates here and notify you of material changes by email.
Last updated 27 October 2026.