Privacy policy
Last updated 10 November 2026
DueDraft is a draft-writing tool for freelancers. You paste invoice details. DueDraft prepares chase emails in English and Chinese. You copy them and send them yourself. DueDraft does not send email to your clients, and it does not act as a debt collector.
This policy describes what the service stores and why. The contact address for privacy requests is support@duedraft.com. A postal address will be published here when an operating entity is registered. Until then, email is the contact channel.
Information you give us
- Account email address and a password. The password is stored only as a hash.
- An optional name used to sign drafts. If you leave it blank, drafts use your email.
- Invoice rows you paste or upload: invoice number, client name, client email, amount, currency, due date, and status. Those rows can include personal data about your clients. You are responsible for having a lawful basis to store that data here.
Information collected automatically
The service sets a session cookie so you stay logged in, and an optional preference cookie that remembers English or 中文. The session cookie is httpOnly. DueDraft does not run advertising trackers and does not sell personal information.
The host and the database provider keep ordinary technical logs, such as IP address and request time, to operate and secure the service. Those logs are not used to build advertising profiles.
How the information is used
- To create your account and keep you signed in.
- To show your invoices, sort them by how overdue they are, and fill draft emails.
- To enforce the free plan limit of 3 open invoices.
- To answer support email you send to support@duedraft.com.
- To protect the service against abuse and to fix faults.
Client email addresses in your CSV are shown to you so you can address your own message. DueDraft does not write to those addresses.
Payments
Paid plans are not currently offered for purchase. When Pro is offered, a merchant of record (expected to be Creem) will process the payment. DueDraft does not store card numbers. The merchant of record will handle payment data under its own privacy notice, and DueDraft will receive account status, such as whether a subscription is active, so the plan limit can be lifted.
Who else handles the data
The application is hosted on Vercel. Account and invoice records are stored in Supabase Postgres. Those providers process data to host the product. DueDraft does not sell data to them or to anyone else. The database is reached with a private connection string. DueDraft does not expose the Supabase anonymous API key in the browser.
How long it is kept
Account and invoice data stay until you delete the account, or until the operator deletes an inactive account after notice. Deleting the account removes your user record and the invoice rows stored for it from the application database. Copies may remain in encrypted hosting backups for a short period until those backups expire.
Your requests
You can delete your account from the invoice desk. That is the way to remove the data the application stores. For access, correction, or other privacy requests, email support@duedraft.com. If the law where you live gives you additional rights, such as objection or complaint to a supervisory authority, those rights still apply. DueDraft will not charge a fee for a reasonable request and may ask you to confirm you control the account email.
Children
DueDraft is not directed at children. Do not create an account if you are under 16.
International transfers
Hosting and database providers may store data outside your country. Where the law requires a transfer mechanism, the operator will use one. The product does not offer a separate region selector in this version.
Changes
If this policy changes in a material way, the date at the top will change and the new text will be posted on this page. Continued use after the update means the new policy applies to new use of the service.
Contact
Email support@duedraft.com.