Effective date: February 24, 2026
When you connect a bank account, we receive transaction information to power transaction monitoring and receipt matching. Transaction information may include the date, description/merchant, amount, category, and account identifiers. We do not receive or store your bank login credentials.
Note: Some limited account metadata (such as account name/type or masked account number) may be returned as part of enabling transaction monitoring, depending on the connection and provider.
When you type an address in an address field, we use the Google Places API to provide autocomplete suggestions. The text you type and your general location are sent to Google to return results. We do not store data from Google; results are only used to populate address form fields.
We do not use your clients' contact information to market DraftSpan to them.
We use Plaid to connect your financial accounts to DraftSpan. When you link an account, you authenticate directly with Plaid.
You can disconnect a bank connection within the app at any time. Disconnecting stops future data pulls. You may also request deletion of stored data, subject to limited exceptions described below.
Plaid's collection and use of information is governed by Plaid's own policies, which you can review during the Plaid Link flow.
We use Stripe to process payments. Payment card information is collected and processed directly by Stripe.
We may receive limited billing information from Stripe (such as billing status, plan, the last four digits of a card, and payment method type) to provide customer support and manage your subscription.
If you set up Stripe Connect to receive payments on invoices, your clients' payment information is collected and processed directly by Stripe. We store Stripe Connect account identifiers, payout eligibility status, and masked external account metadata (e.g., last four digits of a linked bank account) to display your payout status. Your clients' full payment card details never pass through DraftSpan's servers.
We use reasonable safeguards designed to protect your information, including HTTPS/TLS encryption in transit and access controls (including MFA for administrative access). Data stored in our systems is protected using provider security controls, including encryption-at-rest features offered by our hosting and database providers.
If we become aware of a security breach that may affect your personal information, we will notify affected users and relevant authorities as required by applicable law. We maintain an internal incident response process to investigate and address security events.
No system is 100% secure, so we cannot guarantee absolute security.
We retain personal information only as long as reasonably necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements.
To request deletion, contact us at support@draftspan.com.
To request access, correction, portability, or deletion, contact us at support@draftspan.com.
Some rights depend on your state of residence and may be subject to verification and legal exceptions.
This section provides additional disclosures for residents of U.S. states with comprehensive privacy laws. These laws vary by state, but generally provide rights to access, delete, correct, and obtain a copy of your personal information, and in some states to opt out of certain processing.
Submit a request by emailing support@draftspan.com. To help us respond, include the email address associated with your account and describe the request (access, correction, deletion, portability).
We may need to verify your identity before completing a request. If you use an authorized agent (where permitted), we may require proof of authorization and may still verify your identity directly.
The Service is not directed to children, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, contact us and we will take steps to delete it.
DraftSpan is a U.S.-based service intended for users located in the United States. We store data primarily in the United States using our hosting and database providers.
Some of our service providers (such as hosting, email delivery, and payment processors) may process information in the United States and other locations where they maintain infrastructure. These locations may have different data protection laws than your state or country. By using the Service, you acknowledge that your information may be processed in these locations.
The Service is operated by Draft Span LLC, a Colorado limited liability company.
We may update this Privacy Policy from time to time. When we do, we will revise the "Effective date" at the top of this page.
Your continued use of the Service after the effective date of an updated policy means you acknowledge the updated policy.
Questions or requests? We're here to help.