Privacy Policy

Overview

PureDraft HR is an AI-powered HR document platform. We collect only the minimum data necessary to provide our services: authentication, document storage, and AI-powered generation.

Account & Authentication

• •User authentication is managed by Clerk. When you create an account, Clerk stores your email address, name, and authentication credentials.
• •You may sign in with email/password or Google OAuth. Clerk handles all credential storage and verification.
• •See Clerk's Privacy Policy for how they manage your authentication data.
• •You can delete your account at any time through your profile settings.

Document Storage

• •When you save a document, it is stored in a Supabase PostgreSQL database linked to your user account.
• •Documents are user-scoped — only you can view, access, or delete your saved documents.
• •You can delete any saved document at any time from your Dashboard.
• •Uploaded files (PDF, DOCX, TXT, XLSX, CSV) used for text extraction are processed in-memory and never stored on our servers.

How Your Data Is Processed

PureDraft HR uses the Google Gemini API for all AI-powered features. The Essential tier uses Gemini 2.5 Flash; the Professional tier uses Gemini 2.5 Pro:

• •Assistant — Your prompts and any uploaded reference documents are sent to the Gemini API to generate answers, drafts, or meeting schedules.
• •Builder — Key details you enter (document type, tone, employee info) are transmitted to generate a full document. Bulk CSV data follows the same flow.
• •Formatter — Your raw text and optional reference templates are sent for restructuring.
• •Summarizer — Uploaded or pasted documents are transmitted for summarization.
• •All communication uses HTTPS encryption.
• •Google processes the text under their own Privacy Policy.
• •Important: Gemini AI can make mistakes. Always review AI-generated content for accuracy.

Email Services

• •Document sharing via email opens a compose window in your chosen email provider (Gmail, Outlook, Yahoo, etc.) — no server-side email processing is involved.
• •Authentication emails (verification codes) are sent by Clerk.
• •E-signature invitation emails and scheduled report emails are sent via Resend. These contain your document content and signing links. See Resend's Privacy Policy.
• •We do not use your email for marketing or share it with third parties.

Document Sharing & E-Signatures

• •When you share a document via a token link, the document content becomes accessible to anyone with the link until the link expires or is revoked.
• •E-signature requests store the signer's name, email, and drawn signature data in our database. Signature data is linked to the specific document and request.
• •You can revoke share links and delete signature requests at any time from Settings.

Webhooks & Integrations

• •If you configure webhook endpoints, event data (document creation, signature updates) is sent to the URLs you specify. Payloads are signed with HMAC SHA-256 using a per-endpoint secret.
• •Webhook delivery logs (status codes, timestamps) are stored in our database for troubleshooting.
• •You are responsible for the security and privacy practices of any external endpoints you configure.

Organizations & Multi-Tenancy

• •If you create or join an organization, your user ID and role (owner, admin, or member) are stored alongside the organization data.
• •Organization owners and admins can add or remove members. Deleting an organization removes all associated membership data.

Rate Limiting

We use Upstash Redis to enforce rate limits on AI endpoints. This stores only anonymous request counts tied to IP addresses — no personal data or document content is stored in Redis.

Voice Input

• •The Assistant tool offers optional voice-to-text input. When you activate it, your browser will request microphone permission.
• •Audio is processed entirely by your browser's built-in Web Speech API — no audio data is sent to PureDraft servers.
• •You can revoke microphone access at any time through your browser's site-permission settings.

Employee Data Safety

• •If you include employee names, IDs, salary figures, or other personal data, this information is processed in-memory and sent to the Gemini API for generation. Saved documents may contain this data in your database.
• •We recommend redacting highly sensitive identifiers (e.g., social security numbers) before uploading, as a precaution.
• •You can delete any saved documents containing sensitive data at any time from your Dashboard.

Analytics, Audit Log & Notifications

• •The Analytics Dashboard displays aggregated document generation metrics for your account. This data is derived from your saved documents and is user-scoped.
• •The Audit Log records actions you perform (document generation, saves, deletions). This log is visible only to you and linked to your account.
• •Notifications are generated for account activity and document events. They are stored server-side, linked to your account, and visible only to you.

Browser-Level Data

• •Chat history (Assistant conversations) is stored in your browser's localStorage. No chat data is sent to our servers — conversations stay on your device.
• •Theme preference (dark/light) is stored in your browser's localStorage.
• •Saved templates (My Templates Library) are stored in your browser's localStorage. No template data is ever sent to our servers.
• •Authentication cookies are managed by Clerk for session management.
• •No tracking cookies or analytics are deployed.
• •No third-party scripts collect your browsing behavior.
• •AI Memory (optional, consent-gated) stores context you share with the AI assistant (name, company, preferences) in the database linked to your account. Memories are invisible to you and used solely to personalize AI responses. You can disable memory or clear all stored context at any time from Settings → AI Memory.
• •Language preference is stored in your browser's localStorage. The UI is available in eight languages — all translation happens client-side.

Third-Party Services

Your Rights

• •You can view, export, and delete your saved documents at any time from the Dashboard.
• •You can export or permanently delete all your app data (documents, chats, policies, API keys, audit logs, and notifications) from Settings → Data & Privacy.
• •You can delete your account through Clerk's user profile settings, which will remove your authentication data.
• •Saved Templates in localStorage can be deleted at any time from within the app or by clearing your browser data.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect new features or legal requirements. Your continued use of PureDraft HR constitutes acceptance of any changes. We encourage you to review this page periodically.