Data Processing Addendum
Last updated 15 September 2026 · forms part of our Terms of Service
1. Roles
For the personal information you (an employer using Draftly) submit about your own employees, you are the Responsible Party and Draftly is the Operator, as those terms are used in the Protection of Personal Information Act, 2013 (POPIA), sections 20–21. Draftly processes that information only on your instructions, and only to provide the service — generating, storing, and delivering the documents you request.
2. Security measures
In line with POPIA section 19, we maintain appropriate technical and organisational security measures, including: database-level row-level-security isolation between accounts; encryption of data in transit and at rest; audit logging of access to your data; and a deliberate design choice not to collect South African ID numbers.
3. Sub-operators
We use the following sub-operators, each engaged under written terms and only to the extent needed to perform their function: Supabase (database and authentication, hosted in the EU), Anthropic (AI document generation, United States), Vercel (application hosting, EU), Postmark (transactional email, United States), and Stripe (payment processing, United States).
AI processing. To generate the documents you request, relevant information you have submitted is processed by our AI sub-operator, Anthropic (“Claude”), via its commercial API. Your data remains confidential and is processed only to provide the service.
4. Cross-border transfers
Where personal information is transferred outside South Africa — for example to Anthropic or Postmark in the United States — this is done under POPIA section 72(1)(a).
5. Breach notification
If we become aware of a security compromise involving your employees’ personal information, we will notify you without undue delay.
6. Return and deletion
On termination of your account, we will delete or return your employees’ personal information, subject to any retention we are required to observe to meet our own legal obligations.
7. Contact
For any question about this addendum, email info@draftly.co.za.