Privacy Policy

1. Introduction

This Privacy Policy explains how Voca Inc. (“Voca Inc.,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information when you use Draft and related sites and services (the “Service”).

By using the Service, you acknowledge this Policy. If you do not agree, do not use the Service. Capitalized terms not defined here have the meanings in our Terms of Service.

2. Information we collect

We collect information in these categories:

• Account and profile: name, email address, password or authentication tokens, workspace and brand profile details you provide.
• Customer Content: prompts, uploads, URLs, connected account metadata you authorize, research threads, saved creators or clips, and similar workspace data.
• Usage and device: log data, IP address, approximate location derived from IP, browser and device type, referring URLs, feature usage, credit consumption, and diagnostic events.
• Payment: billing details are processed by our payment processor; we receive limited payment metadata (such as last four digits, billing country, and subscription status), not full card numbers.
• Communications: messages you send through support or Report an issue, and email correspondence.
• Cookies and similar technologies: as described in our Cookie Policy.

We also process publicly available social content and related metrics obtained through licensed data providers or platform interfaces in order to provide research features. That content may include usernames, captions, media URLs, engagement counts, and similar public fields. We treat it as Customer Content when you save it to your workspace, and otherwise as operational data needed to run the Service.

3. How we use information

We use personal information to:

• Provide, operate, secure, and improve the Service, including running research jobs and generating Outputs.
• Authenticate users, prevent fraud and abuse, and enforce our Terms.
• Process payments, manage subscriptions and credits, and send transactional notices.
• Respond to support requests and product feedback.
• Comply with law, respond to lawful requests, and protect rights, safety, and property.
• With your consent where required, send product updates or marketing (you may unsubscribe).

We do not sell your personal information for money. We do not use your Customer Content to train third-party foundation models for their general public models, beyond transient processing required for an API call to return a result under that provider’s terms.

4. Legal bases (EEA/UK)

If you are in the European Economic Area or United Kingdom, we process personal data under one or more of these bases: performance of a contract with you; legitimate interests (such as securing and improving the Service, in ways that do not override your rights); consent where we ask for it; and legal obligation.

5. How we share information

We share personal information with:

• Service providers / subprocessors who process data for us (for example hosting and database providers, AI model API providers, data collection vendors, analytics, email, and payment processors), under contracts that limit their use of the data.
• Professional advisors (legal, accounting) under confidentiality.
• Authorities or parties to a transaction when required by law, or to protect rights and safety, or in connection with a merger, acquisition, financing, or sale of assets (with appropriate protections).
• Others with your direction or consent (for example if you export or share workspace content).

We do not control third-party platforms you visit via links in research results. Their privacy practices apply separately.

6. Retention

We retain personal information for as long as your account is active and as needed to provide the Service, comply with law, resolve disputes, and enforce agreements. Research logs and caches may be kept for shorter operational windows. You may request deletion of your account; we will delete or anonymize personal information except where retention is required or permitted by law (for example billing records or security logs).

7. Security

We use administrative, technical, and organizational measures designed to protect personal information, including encryption in transit, access controls, and least-privilege practices. No method of transmission or storage is completely secure. See our Security page for a plain-language overview. Report suspected vulnerabilities through the Report an issue control on the Draft site.

8. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or export personal information; to object to or restrict certain processing; to withdraw consent; and to appeal a denied request. California residents may have rights under the CCPA/CPRA, including to know, delete, correct, and opt out of “selling” or “sharing” for cross-context behavioral advertising. We do not sell personal information, and we do not share it for cross-context behavioral advertising as those terms are commonly defined under CCPA/CPRA.

To exercise rights, contact us through the Report an issue control on the Draft site and describe your request. We may need to verify your identity. You may authorize an agent where the law allows. We will not discriminate against you for exercising privacy rights.

You can update account profile fields in-product where available, and control cookies as described in the Cookie Policy.

9. International transfers

Voca Inc. is based in the United States. If you access the Service from outside the U.S., your information may be processed in the United States and other countries where we or our providers operate. Where required, we use appropriate transfer mechanisms (such as standard contractual clauses) for transfers from the EEA/UK.

10. Children

The Service is not directed to individuals under 18, and we do not knowingly collect personal information from children. If you believe a child has provided personal information, contact us through the Report an issue control on the Draft site and we will take appropriate steps to delete it.

11. Changes

We may update this Privacy Policy from time to time. We will post the updated Policy with a new “Last updated” date and provide additional notice when required by law.

12. Contact

Privacy requests and questions: use the Report an issue control on the Draft site and mark your message as a privacy request. Controller: Voca Inc., operating Draft.