Privacy policy

1. Introduction and scope

AI Draftsman ("we", "us", "our") is operated by Consultancy Outfit Limited. We provide a business platform for building, running and monitoring AI agents: a workspace with agents, knowledge bases, chat, a customer portal, lead tools and usage-based billing (together, the "Service"). This policy explains how we handle information about you when you access or use it.

The Service is bought by a business and used by the people that business invites into its workspace. Where we decide how and why personal data is processed — your own staff account, our billing records, our security logs — we are the controller and this policy governs it.

Where your workspace loads other people's data into the Service — your customers, your leads, the documents in your knowledge bases, the transcripts of conversations your agents hold — your business is the controller and we process it on your instructions. Those records are yours: what they contain, how long you keep them and what you tell the people in them are your decisions, and your own privacy notice is what covers them.

By using the Service you agree to this policy. If you do not agree, please do not use it.

2. Information we collect

• Account data — your name, email address, hashed password, profile photo, your role in the workspace and your two-factor authenticator enrolment.
• Business verification data — the company details, registration number and any documents submitted when a workspace is set up, together with what a company registry returns about that company.
• Workspace content — your agents and their configuration, the documents you upload to knowledge bases, the prompts and responses in chat and playground runs, attachments, and the customers, leads and projects you create.
• Usage and billing data — credits consumed, per-model usage, your wallet balance, invoices, payment records and API-key activity.
• Technical data — IP address, browser and operating system, pages visited, session duration, referring URLs and a record of significant actions taken in the workspace.
• Cookies and browser storage — the session cookie that keeps you signed in, and your appearance preference.

3. How we use your information

• To provide, operate and improve the Service.
• To run your agents, which means passing prompts and the context they need to the model provider you have selected.
• To meter what you consume and bill you for it, and to stop chargeable work once your credits and daily free allowance run out.
• To verify a business when its workspace is created, and to meet our own anti-fraud and know-your-business obligations.
• To send transactional email — invitations, email confirmation, password resets, billing notices and alerts you have asked for.
• To keep an audit trail, so a workspace owner can see who did what.
• To detect and prevent fraud, abuse and security incidents.
• To produce aggregated, de-identified statistics about how the platform is used. These cannot be traced back to a person or a workspace.
• To comply with legal obligations.

4. AI processing and model providers

Running an agent means sending its prompt, and the context it has been given, to a third-party model provider for inference. Which provider depends on the model your workspace selects. Each provider's own terms and privacy policy govern what they do with the request, and we only engage providers contractually bound, under data processing agreements, to use it solely to generate the response you asked for.

We do not sell prompt data, and we do not allow it to be used to train a provider's models.

What you send and what comes back is stored in our database so that conversation history, credit accounting and your audit trail work at all. You control how long that is kept for: deleting a conversation, a knowledge base or a document removes it, and closing the workspace removes all of it.

You are responsible for what you put into a prompt. If your workspace loads personal data about other people into the Service, you decide whether that is lawful and whether those people have been told.

5. Cookies and tracking

We use one essential cookie to keep you signed in. It is httpOnly — no script on the page can read it — and it is set when you complete sign-in and cleared when you sign out.

Your browser also stores your appearance preference, so the portal does not flash the wrong theme on the next load.

We do not use advertising cookies and we do not load third-party analytics or tracking scripts. Usage statistics come from our own server-side records. Clearing your browser storage signs you out and loses nothing else.

6. Data sharing

We share personal data only in these circumstances:

• Service providers — cloud hosting and file storage (Microsoft Azure), our managed PostgreSQL database, our Redis cache, our email delivery provider, and Stripe for payments. All are engaged under data processing agreements.
• AI model providers — as described above, and only for the requests your workspace makes.
• Within your workspace — what you do in a workspace is visible to the people your business has invited into it, according to the role and scope its owner gives them. A workspace owner can see the audit trail, the usage figures and the billing records for the whole workspace.
• Legal requirements — where required by law, by a court order, or to establish or defend legal claims.
• Business transfers — on a merger, acquisition or sale of assets, data may transfer to the successor entity, with prior notice to you.

7. Data retention and security

We keep account data for as long as the workspace is active. When a workspace is closed, access ends immediately, the data is deleted within 30 days and backup copies are fully cleared within 90 days. Billing, tax and minimal security records are kept beyond that where the law requires it, and then deleted on our normal retention schedule.

Workspace content you delete yourself — a conversation, a document, a knowledge base, a customer — is removed when you delete it, subject to the same billing and audit exceptions.

Data is encrypted in transit with TLS. Files are encrypted at rest. Passwords are stored hashed and never in a form anyone can read. Access to production systems is restricted to authorised personnel using role-based access control and multi-factor authentication, and every workspace's data is isolated from every other workspace's.

8. Your rights

Depending on where you live you may have the right to: access the personal data we hold about you; correct it if it is wrong; ask us to delete it; receive a machine-readable copy of it; restrict or object to how it is processed; and withdraw consent where we rely on consent.

To exercise any of these, email info@aidraftsman.ai from the address your account uses. We will respond within 30 days. If you are a member of a workspace rather than its owner, some of what you are asking about may be your employer's record rather than ours, and we will tell you when that is the case.

A workspace owner can close their workspace, and everything it contains, from the Delete account page in the portal (/delete-account). That page sets out exactly what is deleted, what is retained, and how long each takes.

If you are in the UK or the EEA you may also complain to your data protection authority — in the UK, the Information Commissioner's Office. California residents have additional rights under the CCPA, including the right to know what categories of personal information are sold; we do not sell personal information.

9. Children's privacy

The Service is a business tool and is not directed to anyone under 16. We do not knowingly collect personal data from children, and if we discover we have, we delete it promptly.

10. Changes to this policy

We may update this policy from time to time. We will tell you about a material change by email or by a notice in the portal at least 14 days before it takes effect. Continuing to use the Service after the effective date means you accept the updated policy.

11. Contact

Questions or concerns about this policy, or about how your data is handled: email info@aidraftsman.ai. We are Consultancy Outfit Limited, registered in England and Wales.