1. Data Controller
Shenzhen Xinghui Future Technology Co., Ltd. ("we", "us" or "our") is the data controller for the Draftio website, canvas and related services. We determine what personal information the service processes, for what purposes, and what safeguards are applied.
- Legal entity: Shenzhen Xinghui Future Technology Co., Ltd.
- Registered address: Room 501, Building A, Ganfeng Technology Building, Bantian Street, Longgang District, Shenzhen, China
- Privacy and data request contact: support@draftio.ai
- Data Protection Officer (DPO): not currently appointed. All privacy matters are handled through the contact email above and escalated to the responsible person.
2. Personal Information We Collect
We collect only the information needed to provide the service, plus information you choose to provide while using it.
- Account information: phone number or email address, password (stored hashed), nickname and avatar, and basic profile data authorised by a third-party login provider.
- Login and security information: verification codes, device and session identifiers, IP address, login time, and bot-check results such as Cloudflare Turnstile.
- Payment and order information: order ID, product or point package purchased, amount, currency, payment status, refund status, and invoicing details. We do not store full card numbers, expiry dates or security codes; card data is processed directly by our payment processor (see Section 5).
- Creation content: prompts and text instructions you enter, reference images/videos/audio you upload, canvas project and layer data, generated results, and their parameters (such as model, size, aspect ratio and number of outputs).
- Communications: support emails, ticket content, feedback and reports you send us, and the outcome of our handling.
- Device and log information: device model, operating system, browser type and language, time zone, page views and feature usage, request timestamps, error logs and performance data.
3. How We Use Personal Information
We use personal information for the purposes below, each backed by a legal basis:
- Providing and maintaining the service (generation, canvas editing, asset storage and sync, account management) — performance of a contract.
- Billing, payment processing, refunds and invoicing — performance of a contract.
- Customer support and troubleshooting — performance of a contract / legitimate interests.
- Service notices (billing, security alerts, terms and policy updates) — legitimate interests.
- Security, anti-fraud, anti-abuse and risk control (including prompt and content safety screening) — legitimate interests.
- Product improvement and analytics — legitimate interests, using aggregated or de-identified data only.
- Complying with legal obligations (tax, accounting, judicial or regulatory requirements) — legal obligation.
- Marketing — only with your consent, which you can withdraw at any time.
6. How We Protect Personal Information
- Encryption in transit: TLS / HTTPS across the site.
- Storage security: passwords are irreversibly hashed; sensitive configuration and keys are isolated through environment variables and access control.
- Access control: least-privilege principle; production data access requires authorisation and is logged.
- Security operations: regular dependency updates, vulnerability scanning and security audits, with monitoring for anomalous access.
- Storage location: data is stored in cloud regions we select, with access controls and encryption in place.
7. Retention Periods
We retain personal information only as long as needed for the purposes described above, then delete or anonymise it:
| Data type | Retention period | Disposal |
|---|---|---|
| Account information | While the account is active; 90 days after deletion | Deleted or anonymised |
| Orders and transactions | 5 years from completion (tax, accounting and dispute handling) | Deleted or archived |
| Refund and invoicing records | 5 years from completion | Deleted or archived |
| Support and ticket records | 3 years from the last communication | Securely deleted |
| Security and audit logs | 12 months | Securely deleted |
| Uploaded assets and generated results | While the account is active; purged within 30 days of a deletion request or account closure | Securely deleted |
| Incomplete temporary files | 7 days | Securely deleted |
8. Your Rights
You can exercise the rights below by emailing support@draftio.ai. We respond within 30 calendar days after verifying your identity; for complex requests we will explain any extension and the reasons for it.
| Right | What it covers |
|---|---|
| Right to be informed | Know what personal information we collect and use |
| Right of access | Obtain a copy of your personal information |
| Right to rectification | Correct inaccurate or incomplete information |
| Right to erasure | Request deletion where legally applicable |
| Right to restrict processing | Ask us to pause processing in specific circumstances |
| Right to data portability | Receive the information you provided in a machine-readable format |
| Right to object | Object to processing based on legitimate interests or for marketing |
| Right to withdraw consent | Withdraw consent-based processing at any time |
9. Marketing Communications and Opt-Out
With your consent, we may send product updates, events and offers by email, SMS or in-app notification. You can opt out at any time by clicking "unsubscribe" in an email, turning off marketing notifications in account settings, or contacting support. Opting out does not affect service notices such as billing, security alerts and policy updates.
10. Cross-Border Data Transfers
Our servers, databases and some providers may be located outside mainland China (for example Singapore and the United States). When you use features involving overseas providers, relevant data may be transferred abroad for processing. We apply the following safeguards:
- Transfer only to recipients with an equivalent level of data protection, under a data processing agreement.
- Where required by applicable law, rely on standard contractual clauses (SCCs) or another lawful transfer mechanism.
- Assess and minimise the scope of cross-border data so that no content unrelated to the service purpose is transferred.
11. Minors
The service is intended for users aged 18 or older. We do not knowingly collect personal information from minors. If you believe a minor has provided information to us without guardian consent, contact us immediately and we will delete it and take appropriate action.
12. Third-Party Links and Services
The service may contain links to or integrations with third-party sites (for example model providers' official documentation). This policy covers only information we collect directly; third parties are responsible for their own processing, and we recommend reviewing their privacy policies before use.
13. Changes to This Policy
We may update this policy from time to time. For material changes we will notify you at least 15 days in advance via an in-app announcement or your registered email, and update the "Last updated" date at the top of this page. Continued use of the service after the effective date constitutes acceptance of the updated policy.
14. Contact Us
If you have questions about this policy, our processing of personal information, exercising your rights or filing a complaint, contact us using the details below. We respond as quickly as possible.
- Privacy and data requests: support@draftio.ai
- Customer support: support@draftio.ai
- Company: Shenzhen Xinghui Future Technology Co., Ltd.
- Postal address: Room 501, Building A, Ganfeng Technology Building, Bantian Street, Longgang District, Shenzhen, China
- Website: https://draftio.ai
- Support hours: Monday to Friday, 10:00–18:00 (UTC+8), excluding public holidays.
Contact us
If you have questions about this page, account security, data processing, appeals or complaints, contact us at support@draftio.ai. We reply within 2 business days.
Shenzhen Xinghui Future Technology Co., Ltd. · Room 501, Building A, Ganfeng Technology Building, Bantian Street, Longgang District, Shenzhen, China · https://draftio.ai