Privacy Policy

Last updated: October 10, 2026

1. Who we are

Professional Drafter ("we", "us") provides AI-assisted report drafting at professionaldrafter.com. This policy explains what personal information we collect when you visit our website or use the Professional Drafter app, why we collect it, who processes it for us, where it is stored, how long we keep it, and the choices and rights you have.

If you have a question about this policy or about your information, email us at info@professionaldrafter.com.

2. What we collect

Your account

When you sign up: your first and last name, your email address and a password. We store the password only as a one-way hash, never in readable form. If you sign up or sign in with Google, Google gives us your name and email address and tells us whether it has verified that address; your Google password is never shared with us.

We also keep your account settings: the kind of work you tell us you do, your preferences and time zone, a profile photo if you add one, whether two-step sign-in is on, and your answer to "How did you find our app?" if you give one.

What you put into Professional Drafter

The recordings you make with Dictate and the transcripts made from them; notes you type; documents and photos you upload, and the text taken from them; your templates; your letterhead, logo and signature images; the documents we draft for you and the drafts the app saves while you work; and the questions you ask in Query, with their answers. This can include information about other people, such as the people your reports are about. Please include only information you are allowed to share with us.

Records Vault works inside your browser: the files you open in it are read on your device and kept in your browser's storage, and are not uploaded to us. We only record that the feature was opened or used.

Messages you send us

What you send through our contact form (your name, email address, subject and message) or by email, the feature requests you submit, and, if you refer someone to us, the name and contact details you give us for them.

Sign-in and security records

When you sign in, we record your IP address, your browser type and the time. We also record failed sign-in attempts (including the email address that was tried), security events such as sign-ins, two-step sign-in checks, email address confirmations and account closure, and a log of actions in your account, such as signing in or deleting a report. The same log records which features you use and, when a search in the app finds nothing, the words you searched for, so that we can see what people look for.

Technical information

Our servers keep logs that can include IP addresses, email addresses, the pages and features used, account IDs and details of errors. If something goes wrong in your browser while you use our site, the page sends us an error report with the page address, the error, your browser type and, if you are signed in, your account ID. When a request from the page fails or takes more than 10 seconds, the report also gives that request's address and how long it took. We store these reports with your IP address.

How you found us

On your first visit, our site notes the campaign tags on the link you followed (for example "google, cpc"), the address of the website that sent you and the page you first landed on. It keeps them in a first-party cookie for up to 90 days, and if you sign up they are saved with your account. We use them in our own sign-up reports and, when the link names a profession or a template, to set up your new account for it. Ad-click identifiers are left out.

How you use our website

Google Analytics measures how visitors use our public website, as described in section 5, where you can also opt out.

3. Why we use it

• To provide the service: to run your account and sign you in, transcribe your recordings, draft and revise your documents, save and export your work, and send the forms you choose to send.
• To email you: messages about your account (confirming your email address, password resets and sign-in codes); messages you ask us to send, such as forms to your clients; up to two check-in emails in the days after you sign up, offering help getting started; and occasional news about Professional Drafter. Every check-in and news email has an unsubscribe link.
• To keep the service and your account secure: to stop automated sign-ups and spam, limit repeated attempts, and detect and investigate misuse.
• To understand and improve Professional Drafter: to see how people find and use our website and which features are used, and to find and fix problems.
• To answer you when you contact us.
• To meet our legal obligations.

4. Who processes it for us

We use the service providers below. They process information on our behalf so that we can run Professional Drafter.

• Microsoft Azure hosts our website and app, our database, the files you upload or record, and our logs, in Microsoft's Canada Central region (Toronto). Azure OpenAI Service, also from Microsoft, runs the AI models that transcribe your recordings, read the text in the photos and PDF files you scan, draft and revise your documents from the notes, transcripts and files you give it, turn sample documents you upload into templates and forms, answer your questions in Query, and read the feature requests you send us to suggest follow-up questions and to sort and summarise them. The content you use in those features is sent to it for processing, and Microsoft handles it under its own terms for the service. Our Azure OpenAI resource is in the United States, and Microsoft may process these requests in other regions where it runs the service.
• Zoho (Zoho Mail) sends our emails, including account emails, sign-in codes and the forms you send to your clients, and receives email sent to info@professionaldrafter.com. We use Zoho's Canadian data centre.
• Google provides: Google Analytics (section 5); Google reCAPTCHA, which helps stop automated abuse on our website and in the app and sends Google information about your device, your browser and how you interact with the page (Google's Privacy Policy and Terms of Service apply to it); Sign in with Google, if you choose it; Google Fonts, for the fonts on our website; and Google Calendar, if you book a call with us from one of our emails or from the Contact Us page in the app. We do not currently use Google Ads measurement on our website (section 5).
• Content delivery networks and Hugging Face. Some pages load styles, fonts and code libraries directly from public content delivery networks: cdnjs (Cloudflare), jsDelivr, BootstrapCDN, the jQuery CDN and the DataTables CDN. The first time you use search in Records Vault, your browser downloads a public language model from Hugging Face. Your browser connects to these providers itself, so they receive your IP address and basic information about your browser.

We do not take payments through the website at the moment. If we start, we will update this policy to name the payment provider.

We may also disclose information when the law requires it, for example to comply with a court order.

5. Cookies, analytics and ads

Our own cookies

We also keep your analytics choice in your browser's local storage.

Google Analytics

We use Google Analytics on our public website pages when you are not signed in, on the sign-up page, and on the page shown right after you create an account, to understand how visitors use the website: which pages are viewed, how people arrive and roughly where they are. Google Analytics sets its own first-party cookies (_ga and _ga_ followed by an ID), and Google receives the addresses of the pages you visit and technical details about your browser and device. Google Analytics does not run in the app or on your signed-in pages, other than the page shown right after sign-up, and we do not pass your name, your email address or anything you draft to it.

Google Ads

We do not currently use the Google Ads tag on our website, so Google Ads does not measure your visit. If we turn it on, it will measure whether an ad on Google brought you to our website and whether you then created an account. It will run on our home page and sign-up page, and once more on the page shown right after a new account is created. To do this, Google may receive cookie and ad-click identifiers, the addresses of the pages you visit, the address of the page that sent you, your IP address, information about your browser, and these conversion events. We set Google's consent setting for ad personalisation to "denied". No ad tag runs inside the app, and we do not pass your name, your email address or anything you draft to Google Ads. The choices below apply to it as they do to Google Analytics.

Your choices

• We do not show a cookie banner or notice on our website. Unless you have opted out, your browser sends Global Privacy Control, or one of the precautions below applies, Google Analytics (and the Google Ads tag, if we turn it on) loads automatically on the pages named above, including the page shown right after sign-up.
• To opt out, use the Opt out button below. We save your choice in this browser's storage and in the first-party cookie mcw_ad_consent, and while it is saved in either, we do not load Google Analytics or the Google Ads tag on later pages, including the page shown after sign-up. Your choice applies to this browser on this device only. If you opt out, the same place lets you turn measurement back on.
• Opting out also removes the Google Analytics and Google Ads cookies we can reach and withdraws consent from a Google tag already running on the page; requests already queued on that page may still be sent. Opting out does not erase what Google has already received. Clearing this site's data removes your saved choice, and measurement starts again on your next visit unless you opt out again.
• If your browser sends a Global Privacy Control signal, we treat it as an opt-out, even if you turned measurement on earlier. Browsers such as Firefox, Brave and DuckDuckGo can send it, or you can add it with an extension.
• You can also block or delete cookies in your browser's settings, or use a content or tracker blocker. Blocking cookies for our site, or blocking requests to Google's tag and analytics servers, stops this measurement; blocking all cookies also signs you out of the app.
• As a precaution, when you have no saved choice and French is among your browser's languages, or your browser reports a European time zone (including EU places outside mainland Europe, such as Cyprus or the Canary Islands), we load neither. These signals are not a reliable indicator of where you are. We also ask Google's tags to keep their analytics and advertising storage off by default for visitors Google places in the European Economic Area, the United Kingdom or Switzerland, unless they chose to be measured on our site earlier.
• Google offers a browser add-on that turns off Google Analytics on every website: tools.google.com/dlpage/gaoptout.
• Opting out does not change the signup_attribution cookie described in section 2.

6. Forms sent through Professional Drafter

Professional Drafter users can send forms to their own clients. If you fill in one of these forms:

• your answers, and any details the sender entered about you (such as your name, email address or phone number), are stored by us for the person who sent you the form, who can see them;
• if the form asks you to sign, we record when you signed, the name you typed, your IP address and your browser type, as a record of the signature;
• if the sender has us email you the form, the link comes from us through Zoho;
• if the form asks you to confirm your email address with a code, we send the code through Zoho to the address you type and keep that address, and when you sign we add it to the record of the signature;
• we encrypt your answers, the details the sender entered about you, the name you type to sign and the email address you give for a signing code with an extra layer of encryption in our database;
• if the sender uses your answers to draft a document, they are processed by Azure OpenAI Service like other content (section 4).

The person who sent you the form decides how your answers are used. Please contact them with questions about your answers; you can also contact us.

7. Where your information is stored

Your account, the content you save and our logs are stored with Microsoft Azure in Canada, in the Canada Central region (Toronto), and our email is handled in Zoho's Canadian data centre. Some processing happens outside Canada: Azure OpenAI Service (our resource is in the United States, and Microsoft may run requests in other regions); Google's services, which may process information in the United States and other countries; and the content delivery networks and Hugging Face named in section 4, which may handle your browser's connection outside Canada. Information processed in another country is subject to that country's laws, and courts, law enforcement and national security authorities there may be able to access it.

8. How long we keep it

• We keep your account and the content you save in it while your account is open.
• When you delete a report, transcript, draft or template in the app, it disappears from your view at once but may not be erased immediately.
• You can delete your account in Account Settings. We close it straight away: you are signed out on every device, emails we had scheduled are cancelled, and your logo, signature and letterhead images are deleted. The rest of your content is not erased at that moment. We keep it for at least 90 days, so that an account closed by mistake can be restored if you contact us. To ask us to erase it, email info@professionaldrafter.com.
• We keep sign-in records, security records and server logs while we need them to protect the service and investigate problems.
• Our database backups are kept for 7 days, so information erased from the database can remain in a backup for up to 7 days.

9. Your rights

Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) gives you these rights:

• Access. You can ask what personal information we hold about you, how we use it and who we have shared it with, and get a copy.
• Correction. You can ask us to correct information that is wrong or incomplete. You can change your name and email address yourself in Account Settings.
• Withdrawing consent. You can withdraw your consent, subject to legal or contractual limits: opt out of analytics, unsubscribe from our check-in and news emails, or delete your account. If you withdraw consent to something we need to provide the service, we may not be able to keep providing it.
• Complaints. If you have a concern, please contact us first. If we cannot resolve it, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

To make a request, email info@professionaldrafter.com, preferably from the address on your account so we can confirm it is you. PIPEDA generally requires us to respond within 30 days.

10. Security

We protect your information with measures that include:

• encrypted connections (HTTPS) for the website and the app;
• encryption at rest for our database and file storage, and an extra layer of encryption for the answers people give in forms sent through Professional Drafter;
• passwords stored only as one-way hashes;
• optional two-step sign-in with a code sent to your email, and a password reset that signs you out on every device;
• bot checks on sign-up and on our contact form, and limits on repeated attempts at sign-up, sign-in and on our contact form.

No way of sending or storing information is completely secure, so we cannot guarantee that your information will never be accessed without permission. If you think your account has been misused, contact us right away.

11. Changes to this policy

We may update this policy. We will post the new version on this page and change the date at the top. If a change is significant, we will also tell account holders by email or with a notice on the site before it takes effect.

12. Contact us

Questions, requests and complaints about privacy: info@professionaldrafter.com.