Privacy Policy

Bluman sp. z o.o., trading as HelpDraft ("HelpDraft", "we", "us"), provides a tenant-isolated relationship communication service. This Policy covers helpdraft.com, the HelpDraft SaaS platform, customer-facing communication surfaces and connected channels including email, SMS and WhatsApp.

In plain language: when a business uses HelpDraft to communicate with its customers, that business determines why the data is used and HelpDraft processes it on the business's instructions. We do not sell personal data, use WhatsApp message content for advertising, or use one customer's communication to train a model for another customer.

1. Who is responsible for the data

HelpDraft as controller

HelpDraft is the controller for data needed to operate our own website and business, including account administration, billing, service security, support, direct sales and marketing preferences.

HelpDraft as processor for customers

A business using a HelpDraft workspace (a "Customer" or "tenant") is normally the controller of its contacts' details, communication content, relationship history and channel choices. HelpDraft processes that data on the Customer's documented instructions to provide the requested service. Customers are responsible for their own privacy notices, lawful basis, permissions and communication rules. Contractual data-processing terms supplement this Policy where applicable.

If you are an individual communicating with a business through HelpDraft, that business is usually the first point of contact for privacy requests. We will support it in responding.

2. Data we process

• Account and business data: name, business name, role, email address, phone number, address, tax and billing details, plan and account settings.
• Authentication and security data: one-time-code and device-session records, credential hashes, access roles, IP address, device/browser information, security and audit events. We do not store plain-text passwords for passwordless accounts.
• Customer and contact data: names, contact details, identifiers, company, relationship stage, preferences, consents, opt-outs, assignments and notes supplied by the Customer.
• Communication data: messages and replies, email headers, SMS and WhatsApp content, attachments or media where enabled, message templates, timestamps, delivery/read/failure statuses, conversation-window state and channel history.
• Channel and provider identifiers: phone numbers, Meta Business Portfolio and WhatsApp Business Account (WABA) identifiers, WhatsApp phone-number identifiers, messaging-profile identifiers, template identifiers, setup status and provider event identifiers.
• Workspace content: offers, materials, knowledge sources, meetings, bookings, tasks, drafts, corrections and other content a Customer chooses to use in HelpDraft.
• AI inputs and outputs: the minimum relevant excerpts, instructions, retrieved business knowledge, generated drafts, classifications and user corrections when an AI-assisted feature is enabled.
• Usage and support data: feature interactions, diagnostics, error reports, support correspondence and privacy-minimised operational metrics.
• Website and launch-list data: contact information submitted through forms, consent records and limited website events, cookies or campaign attribution where enabled and legally permitted.

Please do not submit special-category or highly sensitive data unless it is necessary, lawful and appropriate for the selected feature and channel. Customers using HelpDraft in regulated contexts must configure suitable access, retention and human-review controls.

3. Why and on what basis we process data

• to create, authenticate and administer accounts and workspaces;
• to send, receive, route, display and maintain requested communications;
• to provide drafts, summaries, retrieval, translation and relationship-continuity features at the Customer's direction;
• to provision and manage phone, SMS, WhatsApp and related channel services;
• to maintain consent, opt-out, template, delivery and compliance records;
• to secure, troubleshoot, monitor and improve the reliability of the service;
• to provide support, bill for services and meet legal obligations;
• to send marketing only where permitted, with an unsubscribe or withdrawal mechanism.

Where HelpDraft is controller, the legal basis may be performance of a contract, steps requested before a contract, compliance with law, legitimate interests in securely operating and improving the service, or consent where required. Where HelpDraft is processor, the Customer determines the legal basis and purpose.

4. Meta, WhatsApp and Tech Provider processing

HelpDraft enables Customers to connect or create their own WhatsApp Business Account and authorize the requested WhatsApp Business Solution. In the managed onboarding flow, authentication and provider authorization take place in interfaces operated by Meta and/or our communications provider, Telnyx. HelpDraft receives the technical identifiers and status needed to associate the approved WABA and phone number with the correct tenant. Customers are not asked to disclose their personal Facebook password to HelpDraft.

For WhatsApp User Data obtained on behalf of a Customer, HelpDraft acts only on that Customer's instructions and authorization and uses the data solely to provide the WhatsApp and related HelpDraft communication functions requested by that Customer. This can include receiving and displaying messages, sending approved messages, maintaining conversation context, preparing replies, managing templates and reporting delivery status.

• WhatsApp message content is not sold or used by HelpDraft for advertising.
• It is not used to train a shared model for other Customers.
• Tenant data is logically isolated and access is role- and tenant-scoped.
• A Customer must obtain required opt-ins, provide notices, respect opt-outs and follow WhatsApp policies and applicable messaging law.
• Meta and WhatsApp separately process data under their own applicable terms and privacy policies.

Disconnecting a channel stops new HelpDraft processing through that connection. Existing records are then handled under the Customer's instructions, legal requirements and the retention rules below. See the HelpDraft Data Deletion Instructions.

5. AI-assisted features

Where a Customer enables AI-assisted functions, HelpDraft may send a limited, task-relevant portion of Customer content to an approved AI service provider to produce the requested result. HelpDraft applies tenant boundaries and does not intentionally use one tenant's raw communication to improve outputs for another tenant. AI output is assistive and may require human review, especially for sensitive, unusual or high-impact matters.

6. Providers and disclosures

We disclose only the data reasonably required to operate a selected feature. Current provider categories include:

• Telnyx: phone-number provisioning, SMS, WhatsApp connectivity, voice infrastructure and hosted WhatsApp onboarding;
• Meta / WhatsApp: Business Portfolio and WABA authorization, WhatsApp messaging, templates, account quality and related platform functions;
• OpenAI: AI generation, classification, retrieval support, transcription or media functions where enabled;
• DigitalOcean: application hosting and object-storage infrastructure;
• Amazon Web Services: email delivery and delivery-event processing;
• Cloudflare: DNS, TLS, content delivery, abuse prevention and network security;
• Stripe: payment and subscription processing;
• identity, email and marketing providers selected or enabled for a workspace, including Google, Microsoft or Systeme.io where applicable.

We may also disclose data to professional advisers, auditors or authorities where legally required, or during a corporate transaction subject to appropriate safeguards. We do not sell personal data. We do not share personal data for cross-context behavioural advertising.

7. International transfers

Some providers may process data outside Poland or the European Economic Area. Where transfer restrictions apply, we use an available lawful mechanism appropriate to the provider and transfer, such as an adequacy decision or contractual safeguards, and apply technical and organisational protections.

8. Security and tenant isolation

Measures include encryption in transit, encrypted or hashed secrets where applicable, tenant-scoped authorization, least-privilege service boundaries, signed provider webhooks, audit trails, rate limits, secure cookies, anti-CSRF controls, backups and monitored background processing. No system is completely risk-free; Customers should use appropriate permissions and avoid placing unnecessary sensitive detail in inherently less-private notification channels.

9. Retention

We retain data only for as long as needed for the purpose for which it was collected, the Customer's documented instructions, the service agreement, security and dispute handling, and applicable legal or provider requirements.

• Workspace content and communication records remain subject to the Customer's account, retention settings and deletion instructions.
• Short-lived onboarding links and authorization sessions expire automatically; HelpDraft does not persist the bearer token contained in a Telnyx hosted-signup URL.
• Billing, tax, fraud-prevention and necessary audit records may be retained for legally required periods. Certain records of access to provider data may be retained where provider terms require them.
• Backups are protected and removed through the backup-rotation cycle; deleted data is not restored to active use except for disaster recovery or legal necessity.

10. Cookies, measurement and marketing

HelpDraft uses necessary storage for security, login, language, theme and service operation. Analytics or marketing measurement, including Meta business tools where enabled, must be used with the notice and consent required in the relevant jurisdiction. You can withdraw marketing consent or unsubscribe from marketing messages at any time. Operational and security messages may still be sent where necessary to provide the service.

11. Your choices and rights

Depending on applicable law, you may have rights to access, correction, deletion, restriction, objection, portability, withdrawal of consent and a complaint to a supervisory authority. In Poland, the supervisory authority is the President of the Personal Data Protection Office (UODO). Rights in other jurisdictions may also include knowing categories of data, correcting or deleting data and opting out of certain disclosures. HelpDraft does not discriminate for exercising applicable privacy rights.

For data controlled by a HelpDraft Customer, contact that Customer first. You may also contact us and we will route or support the request after appropriate identity verification. Instructions are available at helpdraft.com/data-deletion.

12. Children

HelpDraft is a business service and is not directed to children. Customers must not use it to collect children's data without a valid legal basis, appropriate notices and any required parental or guardian authorization.

13. Changes to this Policy

We may update this Policy when the service, providers or law changes. We will publish the revised date and, for material changes affecting Customers, provide appropriate notice through the service or account contact.

14. Contact

Bluman sp. z o.o. (HelpDraft)
Plac Bankowy 2
00-095 Warsaw, Poland
VAT EU: PL5252897446
Email: [email protected]

For a privacy or Meta/WhatsApp data request, write “Privacy request” or “Meta data deletion request” in the subject. Never send passwords, access tokens or verification codes.