1. Accountable person

The person responsible in the sense of the General Data Protection Regulation (GDPR) is:

David Procek
Bavariaring 8
80336 München
Deutschland

E-mail: hello@littledraft.com
Website: https://littledraft.com

2. General information

LittleDraft is an AI-powered macOS application to support the creation, preparation and processing of emails.

In the context of use, personal data can be processed, in particular user account data, e-mail content, writing style preferences, technical usage information and context data provided by the user.

We process personal data only on the basis of legal permission or effective consent.

Insofar as we process personal data exclusively on behalf of commercial customers, the regulations for order processing agreed with these customers apply in addition.

3. Legal bases

The processing takes place according to the purpose on the following legal bases:

  • Art. 6 Abs. 1 lit. a GDPR – Consent
  • Art. 6 Abs. 1 lit. b GDPR – Contract performance and pre-contractual measures
  • Art. 6 Abs. 1 lit. c GDPR – Compliance with legal obligations
  • Art. 6 Abs. 1 lit. f GDPR – Legitimate interests, in particular IT security, abuse prevention and technical error analysis

As far as special categories of personal data in the sense of Art. 9 GDPR are concerned, a corresponding legal basis according to Art. 9 Abs. 2 GDPR must also be available.

4. Use of the website

When accessing our website, technically necessary connection data can be processed.

These include in particular:

  • IP address
  • Time of access
  • Accessed pages
  • Browser and operating system information
  • Technical error and safety information

The processing serves the provision, stability and security of our website.

The legal basis is Art. 6 Abs. 1 lit. f DSGVO.

Hosting: The website is provided through OpenAI sites; Cloudflare provides technical infrastructure. The specific contractual provider organisations have yet to be confirmed.
Hosting Location: [Supplement]
Storage time of the server logs: [Supplement]

5. User account and authentication

When registering and using LittleDraft, the following data can be processed:

  • Email address
  • User identification
  • Required credential and authentication data
  • User and application settings
  • Subscription status
  • Tariff and use quotas
  • Required technical meeting information

The processing serves to set up and manage the user account and to provide the contractually agreed services.

The legal basis is Art. 6 Abs. 1 lit. b DSGVO.

App authentication service: Auth0 by Okta. The specific contractual provider organisation has yet to be confirmed.

6. Access to Apple Mail

LittleDraft can access selected information from Apple Mail after granting the required system permissions.

Depending on the respective function, this can include:

  • Email subject lines
  • News content
  • Consignor and recipient information
  • Previous messages within a conversation
  • Sent emails to determine personal writing style preferences
  • Other information required for processing

The processing serves to create and improve individual response drafts.

Not every function requires the processing of all mentioned data.

Permissions can be managed via the intended settings of macOS.

Technical specification: Writing style analysis is done locally on the Mac. For the generation, the respective e-mail and permitted context information are transmitted to OpenAI via the LittleDraft service; this also applies to activated automatic functions within the selected settings.

7. AI-assisted text generation

LittleDraft uses artificial intelligence to create and customize email designs.

For this purpose, the information required for generation can be processed, in particular:

  • current email and relevant conversation context
  • User instructions
  • Language and desired tonality
  • Required Writing Style Preferences
  • Additional explicitly provided contextual information

For AI-supported text generation, the OpenAI API is used.

Service providers: [Concrete contractual OpenAI provider organization and, if applicable, additional AI providers.]

The processing takes place to provide the requested function, insofar as it is part of the contract, on the basis of Art. 6 Abs. 1 lit. b DSGVO.

Depending on the actual technical and contractual design, additional legal bases may be required.

A use of transmitted content for other purposes takes place only to the legally permissible extent and communicated to the user.

To be completed: actual recipients, storage, API data retention, possible third country transfers and their guarantees.

8. Personalization and Writing Style Analysis

LittleDraft can enable the user to analyze already sent emails.

The aim is to determine typical writing characteristics, for example:

  • preferred language
  • Tonality and courtesy
  • frequently used formulations
  • Message structure and length
  • personal writing style preferences

This information is used to adapt future designs to the user.

Technical storage: Write profiles are stored encrypted locally on the Mac; the keys are protected by macOS Keychain.

Content used: Derived style features can be sent along with the generation. For historical writing examples, there are separate storage and release settings.

Storage time of the style profiles: Learned Profiles remain stored locally until they are removed in the app. General retention periods for other data types are still to be specified in section 16.

Deletion and deactivation: Profile can be checked, re-learned, removed or deactivated for style matching. Learned Profiles remain stored until they are removed.

9. Automatic preparation of response drafts

When the corresponding function is activated, LittleDraft can process email content before a manual generation request in order to prepare response suggestions.

Depending on the settings of the user, the function can only take into account certain messages or message types.

Auto-write can prepare formulations when opening a response. Optional Pro Pre-Drafts check selected inboxes at an adjustable interval while LittleDraft is running and prepare suggestions for suitable new unread messages.

Users choose up to five accounts, daily limits and operating hours; filters and sender and domain exclusions limit the choice. Suitable email content and permitted context can be transmitted to OpenAI via LittleDraft.

Prepared proposals are stored encrypted locally for up to 24 hours. The function can be deactivated; LittleDraft does not send emails automatically.

10. Optional screen capture and context analysis

LittleDraft may offer a feature to provide additional information from the currently displayed screen content.

For example, users can use it to provide information from another application as context for an email draft.

Such content may contain personal data, confidential company data or third party information.

Before using the function, the user should check whether he or she is entitled to such processing and transmission.

The processing takes place only for the purposes of the respective intended function.

Technical procedure: When explicitly called, Capture Context creates a snapshot of the entire display under the pointer. Text recognition is local; screenshot images are not saved or uploaded. Recognized text is stored encrypted in the library and can be transmitted to OpenAI as a permitted context. For library entries, a retention of 7, 30 or 90 days or until manual deletion can be selected.

11. Subscription and payment processing

When concluding a paid subscription, the following data in particular can be processed:

  • Name and billing information
  • Email address
  • Tariff
  • Payment status
  • Transaction and subscription identifiers
  • Information required for invoicing and accounting

The purpose is the contract processing, payment management and fulfillment of tax and commercial obligations.

Legal bases are Art. 6 Abs. 1 lit. b and c GDPR.

Payment processing: Paid Personal and Pro subscriptions are processed via Paddle. The specific contractual provider organisation, its data protection role and the associated agreements have yet to be confirmed.

Payment card data will only be processed according to the actual technical integration.

12. Cookies, local storage technologies and analysis

The website and the app may use technically necessary storage technologies, in particular for login, security and settings.

For access to terminal information that is not absolutely necessary, consent is obtained in advance, if required by law.

The requirements of § 25 TDDDG and the GDPR are taken into account.

Analytics and tracking services: LittleDraft uses optional website analysis by LittleDraft and Google Analytics only according to your choice. Further information and your recruitment options can be found under Cookie & Tracking Information.

Storage technologies and storage durations: Details can be found under Cookie & Tracking Information.

13. Support and contact

If users contact us by e-mail or via a support function, we process the transmitted contact data and message content to process the request.

Depending on the event, the legal basis is Art. 6 Abs. 1 lit. b or f DSGVO.

Any storage beyond this will only take place to the extent legally permissible or necessary.

Support system and storage period: [Supplement]

14. Recipients and service providers

Depending on the actual infrastructure used, personal data may be transferred to service providers of the following categories:

  • Hosting and infrastructure
  • Authentication and account management
  • AI processing
  • Payment processing
  • Technical communication and support
  • Error monitoring

Insofar as they act as processors, the necessary agreements are concluded in accordance with Art. 28 GDPR.

Information on service providers: See also Subprocessors and Infrastructure. Contractual partners, roles and processing locations have yet to be confirmed.

15. Transmission to third countries

If personal data is processed outside the European Economic Area, this is done in compliance with the legal requirements.

This may include adequacy decisions, standard contractual clauses or other transfer mechanisms provided for by law.

Third countries and concrete protection mechanisms: [Supplement]

16. Storage period and deletion

Personal data will only be processed and stored for as long as this is necessary for the respective purposes or a legal storage obligation exists.

After expiry of the corresponding deadlines, the data will be deleted or anonymized, unless there is another legal basis for further processing.

Specific deadlines for account data, message content, AI requests, style profiles, prepared drafts, screenshots, Protokolle and backups: [Supplement]

17. Data security

We take appropriate technical and organizational measures in accordance with Art. 32 GDPR.

These include, in accordance with the actual technical infrastructure, in particular secure transmission procedures, access controls, authorisation management and measures to prevent unauthorised access.

18. Rights of data subjects

Within the framework of the legal requirements, affected persons have the following rights in particular:

  • Information according to Art. 15 GDPR
  • Correction according to Art. 16 GDPR
  • Deletion according to Art. 17 GDPR
  • Restriction of processing in accordance with Art. 18 GDPR
  • Data portability according to Art. 20 GDPR
  • Objection according to Art. 21 GDPR
  • Withdrawal of granted consent with effect for the future

Requests may be made to: hello@littledraft.com directed.

Information on: Deletion of accounts.

19. Right of appeal

Data subjects can complain to a data protection supervisory authority.

For private bodies based in Bavaria, the Bavarian State Office is generally responsible for data protection supervision.

20. Changes to this data protection declaration

We may update this Privacy Policy if technical, legal or organizational changes so require.

The current version is available at littledraft.com.

Enterprise requests via the website form

In the case of a Enterprise request, name, business email address, company, approximate team size and the voluntary message will be sent to hello@littledraft.com via Resend so that we can answer your request. Please do not submit confidential documents or email content. The website database only stores key-based checksums and proofs of delivery to prevent abuse and detect duplicate transfers. Subsequent requests will delete records as soon as they are older than 30 days. The request itself remains in the receiving mailbox for processing. Further information can be found in the Service provider overview.