Privacy policy.

Data collected

Two tables hold user-facing data in Phase 1:

• waitlist — your email, an optional intent label, the timestamp you signed up, and a hashed (non-reversible) form of your IP address for rate-limit visibility.
• consent_log — the cookie choice you made (accepted, rejected, customised), the policy version, the user-agent string, the timestamp, and a hashed form of your IP address. This row is the proof-of-consent record required under GDPR Article 7.

See the cookies and storage page for the full list of cookies and local-storage entries.

Purpose

Email is used to send the single launch notification and, in later phases, transactional messages tied to a purchase. Intent labels are used to prioritise which bundles to publish first. Hashed IP is used only to enforce per-IP rate limits on the waitlist form.

No marketing cadence. No newsletter. No third-party advertising identifiers.

Retention

Waitlist rows persist until you ask for deletion or until the first-bundle launch notification has been sent and you have not converted to a buyer account within 12 months. Consent-log rows persist for the legally required audit window (7 years in India, subject to CA review).

Specific retention windows are under review by Indian counsel and will be confirmed before launch.

Third parties

Data is stored in Supabase (managed Postgres) and routed through Vercel for hosting. Email delivery uses Resend. Aggregated, cookieless page-view counts are collected by Vercel Web Analytics. Optional, consent-gated product analytics are sent to PostHog with a hashed identifier — never your raw email.

Your rights

You have the right to access, correct, or erase your personal data, and to withdraw consent at any time. To exercise any of these rights, email privacy@trydrafted.store. Erasure requests are honoured within 30 days.

DPDP Act 2025 (India) enforcement begins November 2026. This document is under review by Indian counsel ahead of that date.

Contact

Privacy questions go to privacy@trydrafted.store.