Legal
Data processing agreement
Version 2026-08-22. Last updated 22 August 2026. Accepting it is part of creating a workspace, and the version you accepted is recorded and shown in your settings.
1. Who is who
You are the controller of the personal data you put into Indraft. O'Shea & Sons, LLC is the processor, and acts only on your documented instructions. Using the product is such an instruction. Where you are yourself a processor for your own client, we are a sub-processor and this agreement passes through to them.
This matters more here than in most products. Indraft holds personal data about people who never chose us: your customers and prospects. They exercise their rights through you, and we have to be able to help you answer them.
2. What we process, and what we refuse
CRM records you or your agents create, interaction summaries with their author and assertion kind, a bounded evidence snippet, the change ledger, and a control plane holding your organization mapping, credential hashes, billing state, and usage counters.
There is no field in Indraft for an email body, a call transcript, a recording, an attachment, or an arbitrary file. They are not filtered out. There is nowhere to put them.
3. Duration and purpose
We process for as long as your workspace exists, for the sole purpose of providing the product. We do not use your data to train models, to build a profile of you or the people in your records, or for any purpose of our own. Indraft makes no model calls in any code path, so no part of your data reaches a model provider through us.
4. Sub-processors
We give thirty days' written notice by email to every workspace owner before a new subprocessor starts processing customer data, and you may object in that window. Updating this page is not notice on its own.
| Sub-processor | Processes | Why |
|---|---|---|
| Cloudflare | All CRM data, at rest and in transit, and the email address we send service notices to | Hosting, application compute, content delivery, and the transactional email we send you about your own workspace. Your workspace data is stored and processed on Cloudflare infrastructure, and mail goes through Cloudflare's own service rather than a separate provider, so this list stays as short as it is. |
| WorkOS | Identity: user, organization, membership, and role | Authentication and MCP authorization. Indraft implements no passwords and issues no sessions of its own. |
| Stripe | Billing contact and payment data | Subscriptions, hosted Checkout, and the Customer Portal. No CRM record reaches Stripe. |
No model provider is on that list, and that is not an omission.
5. Where processing happens
Your workspace runs on Cloudflare's global network and is not pinned to a region. O'Shea & Sons, LLC is a United States company, so treat processing as taking place in the United States and wherever Cloudflare operates.
Transfers out of the UK and EEA
The European Commission's Standard Contractual Clauses (module three, processor to sub-processor) and the UK International Data Transfer Addendum, both incorporated into the data processing agreement. We do not hold a Data Privacy Framework certification and do not rely on one.
6. Security
Each workspace is a separate database rather than a filtered view of a shared one, so a request that resolved to the wrong workspace would reach a different database and could not read another customer's rows. Data is encrypted in transit and at rest by our infrastructure provider. Access to production is limited to the people who operate it. Credentials are stored only as hashes and are shown once.
We describe controls rather than claiming an outcome. We hold no SOC 2 report and no ISO certification, and we will say so plainly rather than implying otherwise.
7. Personal data breaches
We notify you without undue delay and within seventy-two hours of becoming aware of a personal data breach affecting your workspace, with what we know, what we are doing, and what we do not yet know. A notice that waits for certainty is a notice that arrives too late to be useful to you.
8. Helping you answer the people in your records
You can export everything in your workspace yourself, at any time, from Settings. Erasure of one person's record is within thirty days of your request. Workspace deletion is scheduled immediately and destroyed within seven days, with backups and replicas expiring within thirty-five. The commitments and the reasoning are on the deletion and portability page.
9. Audit
We answer reasonable written questions about this agreement, and provide what we have. We are a small company and cannot host an on-site audit; if that is a requirement for you, we would rather tell you now than discover it during procurement.
10. Ending
On termination you export what you hold, and we delete the workspace on the timetable above. We do not retain a copy beyond backup expiry.
11. Governing law
Illinois, United States, and the courts of Illinois. This agreement forms part of the terms of service and prevails over them on anything concerning personal data.
What this page does not do
It describes what the system does and what we commit to. It does not award us a compliance verdict, a certification, or a coverage claim, because those are not ours to award and your counsel is better placed to judge than our marketing is.