Privacy notice

Last updated 4 November 2026

This notice explains what Draft keeps about you, why, who else sees it, how long it is kept and what you can ask for. It covers the website at drafttool.org.uk and the Draft apps, which show the same website.

1. Who is responsible

Draft is run by Yasir Widatalla, who is the controller of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For anything about your data, write to [email protected].

2. What Draft keeps, and why

What	Why	Lawful basis
Your email address (typed by you, or given by Google if you sign in with Google)	To sign you in, keep your plan in your account, and send you the copies you ask for	Contract
Your name, field, degree or level of training, region and type of institution	To greet you, head your plans and fill in the background of your plan	Contract
Your job or role and age range, if you choose to give them	The same, and to understand who uses Draft	Consent (you can remove them at any time on your account page)
Your plan: everything you type into the tool	To save your work so you can carry on from any device	Contract
Subscription details from Stripe: Stripe’s reference for you, the plan, whether it is active, and the date it is paid until	To give paying subscribers access	Contract; legal obligation (business records)
A scrambled copy of a sign-in code, and daily counts of codes, questions asked and copies emailed	To keep accounts secure and stop the service being misused	Legitimate interests
Feedback form answers, if you send them	To improve Draft	Consent
Daily totals of which pages, sections, questions and toolkit documents are used	To see which parts of Draft help and which need work. These totals hold no name or email address	Legitimate interests

You need an email address to use your account; everything else about you is optional or is made by using the tool. Draft does not sell your data, does not show advertising, and makes no decisions about you by automated means.

Please do not enter patient-identifiable information, or anything about your own health, into Draft. It is a planning tool, not a place for study data.

Draft uses these services to run. Each handles your data only to provide its service to Draft.

Service	What it does for Draft	What it receives
Cloudflare	Hosts the website and its database, and sends Draft’s emails	Everything listed above, and your network address when you visit
Google	“Sign in with Google”, if you choose it	That you signed in to Draft. Google tells Draft your email address and name
Google Fonts	Supplies the typefaces the pages use	Your network address and browser details, as with any website
Stripe	Takes payments and manages subscriptions. Draft never sees your card number	What you give Stripe on its payment page; from Draft, only Stripe’s own reference for you
Anthropic	Answers questions typed into the Ask box (the model is called Claude)	Your question and passages from Draft’s reference library. Not your name or email address. Draft does not keep the question

Draft would also share data if the law required it.

4. Data outside the UK

Cloudflare, Google, Stripe and Anthropic may handle data in the United States or elsewhere. Where they do, the transfer is covered by the UK–US Data Bridge (for certified companies) or by the UK’s International Data Transfer Agreement or Addendum in the provider’s terms.

5. How long it is kept

Your account and plan: until you delete them. A plan, or account answers, not used for 12 months is deleted automatically.
Sign-in: a signed-in session lasts 14 days. Sign-in codes are kept, scrambled, for 10 minutes.
Daily counts of codes, questions and emailed copies: one week.
Subscription details: while you subscribe and for about 13 months after it ends. Stripe keeps its own payment records under its privacy policy, and business accounting records are kept for six years, as UK tax law requires.
Usage totals: 400 days. They hold no name or email address.
Feedback: kept without your name or email address unless you said you may be contacted. Feedback kept against your email address is deleted with your account.

6. Your rights

You can ask for a copy of your data, ask for it to be corrected or deleted, object to or restrict how it is used, ask for it in a form you can take elsewhere, and withdraw consent you gave. Much of this you can do yourself on your account page: Edit my details, Delete my plan everywhere and Delete my account. For anything else, write to [email protected]. You will get an answer within one month.

7. Keeping it safe

Every connection to Draft is encrypted. Draft has no passwords to steal: you sign in with a one-time code or with Google. The sign-in cookie cannot be read by the page’s scripts, and the owner’s pages are open only to the owner. If a breach put you at high risk, you and the Information Commissioner’s Office would be told, as the law requires.

8. Age

Draft is for students and professionals aged 18 or over. It is not meant for children, and does not knowingly keep their data.

9. Complaints

Please write to [email protected] first. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.

10. Changes

If this notice changes in a way that matters, Draft will say so on the first page and, for account holders, by email, before the change applies.