Privacy

Aifnet Ltd., Bulgaria Blvd 88, Ent. 3 - Offices, Fl. 2, Ap./Office 6, 1680 Sofia, Bulgaria, registration number 205591406, is responsible for your data (the “controller”). For anything about your data, write to contact@thirddraft.com.

• Your account: your name, email address and a one-way hash of your password, if you set one. If you sign in with Google, that Google account’s ID, name and email address.
• Your workspaces: their names, who is a member and in which role, and invitations.
• Your websites: the domains you add, what you tell us about them (your goal, your market), the public pages we read from them, the brand brief, keyword research and the articles we write.
• Connections you choose to make: if you connect Google Search Console, the search performance data Google gives us for the property you pick (read-only). If you connect storage, your own code, or a WordPress, Shopify, Wix, Webflow, Framer, HubSpot, Ghost or Notion account, the credentials for it, kept encrypted, and what we read from it to send your articles there: its blogs, collections or databases and their fields, the names of its blog’s authors so you can choose one, and the address of each article we send it.
• Billing: your billing name, address and tax id are held by Stripe. We keep the Stripe customer id, and the type and last four digits of the card on file — never the full card number.
• Technical records: what work ran for your sites and whether it succeeded, and server logs, which include IP addresses.

• To provide the service you signed up for and to bill for it — that is our contract with you.
• To keep the service secure, prevent abuse (such as repeat use of the free article) and fix problems — our legitimate interest in running a safe, working service.
• To meet tax and accounting obligations.

We do not sell your data, and we do not use it for advertising.

• Stripe — payments, invoices and billing details.
• OpenRouter — access to the AI models that write and review articles. Your website’s content, the brand brief and the research for each article are sent to the models through it.
• DataForSEO — search volumes and search results. Your domain and the keywords being researched are sent to it.
• Google — signing in with your Google account, if you choose to, and Search Console, only if you connect it.
• Postmark — sending account emails, such as invitations and password resets.
• Bunny — the typeface loaded on our pages, and storage, if you connect your own.
• Gravatar (Automattic) — the pictures shown next to people’s names in the app. They are loaded from Gravatar using a one-way hash of the email address, so Gravatar receives that hash and your IP address, never the address itself.
• Hetzner — the servers the service runs on.

Where one of them is outside the European Economic Area, the transfer relies on the safeguards that provider offers, such as the EU standard contractual clauses.

When you connect a website, storage or your own code, we send it your finished articles and their pictures, as you set it up. It is run by its provider, or by you, under its own terms and privacy policy, and it does not process data for us: what happens to the articles there is between you and that provider.

What we receive from a Shopify store you connect (its name and addresses, its blogs, and the files and articles we put there) we use only to send your articles to that store. We keep it confidential, and delete it as our Terms describe.

If you sign in with Google, we receive your Google account’s ID, name and email address, and use them only to sign you in.

If you connect Google Search Console, we read — never change — the search performance of the property you choose for a website: the searches it appears in, its pages, and their clicks, impressions and positions. We use it for two things you see in ThirdDraft: how each of your articles does in Google search, and which searches your site already ranks for, so that we don’t write an article that competes with a page you have. For that, the address of your page that already ranks for a topic is part of the research the AI models read, through OpenRouter; the figures are not.

We don’t sell this data, use it for advertising, or use it to train or improve AI models, and the AI models we send research to don’t train on it. Nobody at ThirdDraft looks at it except to keep the service working, to fix a problem you tell us about, or where the law requires it.

To stop it, choose Stop using it under Search Console in a website’s settings, or remove ThirdDraft from your Google account’s third-party connections. We delete the data with the website or your account, or when you ask at contact@thirddraft.com.

ThirdDraft’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Your account, workspaces, websites and articles: until you delete them or ask us to.
• Search Console data: the detailed figures for up to 16 months, the same window Google keeps; each site’s daily totals for as long as the site is here.
• A site, storage or code you connect: its credentials, and what we read from it to let you choose (its blogs, collections and authors), until you remove it; the record of which articles went there and the addresses they got, for as long as the website is here.
• Billing records: as long as tax and accounting law requires.
• A record that a free article was given: one-way codes made from the email addresses of the workspace’s owner (the one they signed up with and the one they had when it started) and from the website’s domain — never the addresses or the domain themselves. We keep it after the account and the workspace are deleted, so the same free article can’t be claimed again.
• Server logs: about two weeks.

We use only the cookies the service needs to work: one that keeps you signed in while you use it, one that protects forms from forgery, one that keeps you signed in between visits if you tick “Stay signed in” or sign in with Google, and one that remembers whether you chose the light or dark appearance. That last choice is also kept in your browser’s own storage. There are no analytics or advertising cookies.

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Write to contact@thirddraft.com and we will answer within a month. You can also complain to the data protection authority where you live.

If we change how we handle your data, we will update this page and the date at the top of it.