Privacy Policy
Last updated: September 5, 2026
Draftworks stores billing records, receipts, and bounded request and response content logs. The Responses API store flag controls upstream conversation state separately from these logs.
1. Request content
The gateway sends your request to the selected Azure or Amazon Bedrock model and records request and response content in Convex. Each side is capped at 524,288 characters and larger records may be truncated. Content logs currently have no automatic time-based expiry.
Claude Fable 5 and Fable 5.1 require AWS to share prompts and completions with Anthropic, which retains them for up to 30 days for trust and safety purposes. Setting store: false does not disable that retention.
Signed receipts contain SHA-256 hashes of the request and response. These hashes allow content to be checked against a receipt; they do not replace the separate content logs.
2. What we store
- Account data. Email address, name, and a password hash. We never store plaintext passwords.
- API keys. Keys are shown once at creation and stored only as hashes. We cannot recover a lost key.
- Per-request metadata. Token counts (input, cached input, output), timestamps, latency measurements, request IDs, and the SHA-256 hashes of request and response bodies used for receipts.
- Billing records. Credit purchases, usage deductions, and invoice history.
3. The store parameter
On the Responses API, the store parameter defaults to false on Draftworks. OpenAI and Azure default it to true; we flip that default for upstream conversation state. This does not disable Draftworks content logging.
If you explicitly set store: true, the conversation state for that request is retained by Microsoft Azure to power previous_response_id. That retention happens on Azure's side under Microsoft's data policies. Draftworks keeps its own content logs as described above.
4. Subprocessors
The following services process data on our behalf:
| Subprocessor | Purpose | Data handling |
|---|---|---|
| Amazon Web Services | Claude inference through Bedrock | Processes Claude requests through global inference profiles originating in us-west-2. Global profiles may process requests in another AWS region. Provider data-processing and abuse-monitoring terms apply. |
| Microsoft Azure | Model inference | Prompt and response content is processed transiently in memory to serve your request. Per Microsoft's Azure OpenAI data policies, content may be processed by automated abuse-monitoring systems on Microsoft's side. If you set store: true on the Responses API, Azure retains that conversation state (see section 3). |
| Stripe | Payments | Card details go directly to Stripe. We never see or store card numbers; we keep only Stripe's transaction references and invoice records. |
| Convex | Application database | Stores account data, API key hashes, request metadata, billing records, receipts, and bounded prompt and response content logs. |
| Vercel | Hosting and edge network | Routes API and web traffic. Standard infrastructure logs (IP address, timestamp, path); no request bodies are logged. |
5. Data retention
Request metadata and billing records are kept for billing accuracy and audit. When you close your account, we delete your account data, key hashes, and request metadata, except billing records we are legally required to keep (tax and accounting law), which are deleted when that obligation ends.
6. Your rights
You can access, export, or delete your data at any time. Email support@draftworks.dev and we will act on the request within 30 days. Exports are machine-readable. Deletion follows the retention rules in section 5.
7. Cookies and tracking
We use session cookies to keep you signed in and Vercel Analytics to understand website usage. We do not sell your data.
8. Breach notification
If we confirm a breach affecting your personal data, we will notify you by email within 72 hours of confirmation, including what was affected and what we are doing about it.
9. Changes to this policy
We will announce material changes to this policy by email before they take effect. The latest version is always at this URL. Questions: support@draftworks.dev.