Drawli Privacy Policy
Last updated: 2 August 2026
Drawli Cloud Ltd, a company registered in England and Wales under company number 17123338, with its registered office at 3rd Floor, 86-90 Paul Street, London EC2A 4NE ("Drawli", "we", "us", "our"), is committed to protecting your privacy.
This Privacy Policy explains how we collect, use, share, and protect personal data when you visit our website, sign up for an Account, or use the Drawli platform (together, the "Service"). It should be read alongside our Terms and Conditions.
If you have any questions about this Policy or how we handle personal data, contact us at support@drawli.cloud.
1. Who this Policy applies to
This Policy applies to:
Visitors to our marketing website (drawli.cloud);
Customers who register for a Drawli Account; and
Authorised Users added to a Customer Account, such as team members, contractors, and external collaborators on a project.
Where a Customer adds Authorised Users to their Account, the Customer is responsible for ensuring those individuals have been informed of this Policy and have any necessary basis for their personal data being processed within the Service.
2. Data you give us directly
2.1 Data you give us directly
Account data: name, email address, job title, company name, and password (stored in hashed form).
Billing data: billing name, address, and VAT details. Card details are collected and processed directly by our payment processor, Stripe, and are not stored on our own systems.
Content: documents, drawings, photographs, comments, and other material you or your Authorised Users upload to the Service, which may incidentally contain personal data (for example, names in a site diary or photograph).
Support communications: information you provide when you contact us for support.
2.2 Data we collect automatically
Usage data: pages visited, features used, actions taken within the Service, device and browser type, and IP address.
Cookies and similar technologies: see Section 6 (Cookies).
2.3 Data from third parties
Information from identity or company verification checks, where applicable.
Aggregated or anonymised analytics data from Google Analytics and Google Ads, where you have consented to non-essential cookies.
3. How we use personal data
Purpose
Legal basis (UK GDPR)
Creating and administering your Account - Performance of a contract
Providing the Service, including document storage, revision tracking, and collaboration features - Performance of a contract
AI-assisted features, such as automatically extracting document details from uploaded files - Performance of a contract
Processing payments and managing billing - Performance of a contract; legal obligation (tax and accounting records)
Customer support - Performance of a contract; legitimate interests (resolving issues efficiently)
Improving and monitoring the Service, including analytics - Legitimate interests
Sending service-related communications (for example, changes to these policies, security notices) - Legitimate interests; legal obligation
Sending product updates and marketing communication - Legitimate interests, with an unsubscribe option in every email
Preventing fraud and misuse, enforcing our Terms - Legitimate interests; legal obligation
Complying with legal and regulatory obligations - Legal obligation
We do not sell personal data to third parties.
4. AI-assisted features
Certain features, such as automatically populating document details when a Construction Document is uploaded, use a third-party AI service to analyse the content of the file you upload. Only the document you choose to upload is processed for this purpose, and it is handled under contractual terms with our AI provider that prevent it from being used to train the provider's underlying models. This processing is necessary to deliver the feature and forms part of the Service you have signed up for.
5. Who we share data with
We share personal data with the following categories of third-party service providers, each acting under contractual obligations consistent with UK GDPR:
Hosting and storage: Amazon Web Services (AWS S3), hosted in the UK (London, eu-west-2), with encryption at rest.
Payments: Stripe, for processing subscription payments.
Email delivery: Brevo, for transactional and marketing emails.
Productivity and internal tools: Google Workspace, used internally by our team.
AI-assisted document processing: our AI service provider, as described in Section 4.
Analytics and advertising: Google Analytics and Google Ads, where you have consented to non-essential cookies.
Professional advisers: our accountants and legal advisers, where necessary.
Authorities: regulators, law enforcement, or other third parties where required by law, or to protect our rights or the safety of others.
Where a service provider processes personal data outside the UK, we ensure an appropriate safeguard is in place, such as the UK's International Data Transfer Addendum to the EU Standard Contractual Clauses, or reliance on an adequacy regulation.
6. Cookies
We use cookies and similar technologies on our website and within the Service.
Essential cookies are required for the website and Service to function (for example, keeping you logged in) and cannot be switched off.
Analytics and advertising cookies (such as Google Analytics and Google Ads) help us understand how the site is used and measure the effectiveness of our marketing. These are set only with your consent, given through the cookie banner shown when you first visit our site. You can withdraw or change your consent at any time via the cookie settings link in the website footer.
7. Data Retention
Account and Content data: retained for as long as your Account is active. If you close your Account or your subscription is cancelled, Content remains available for export for 90 days (as set out in our Terms and Conditions), after which it is permanently deleted from our systems, except where we are required to retain specific records for longer to comply with legal or tax obligations.
Billing records: retained for as long as required by UK tax law.
Marketing data: retained until you unsubscribe or request deletion.
Website analytics data: retained in line with Google's default retention settings, or as configured in our analytics account.
8. Your Rights
Under UK GDPR, you have the right to:
Access the personal data we hold about you;
Rectify inaccurate or incomplete data;
Erase your data in certain circumstances;
Restrict or object to certain processing, including direct marketing;
Data portability, where processing is based on consent or contract and carried out by automated means; and
Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
To exercise any of these rights, contact us at support@drawli.cloud. We may need to verify your identity before acting on a request.
If you are not satisfied with how we handle your personal data, you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
9. Data Security
We apply appropriate technical and organisational measures to protect personal data, including encryption of data at rest, access controls, and regular review of our security practices. No system is completely secure, and we cannot guarantee absolute security of information transmitted to or from the Service.
10. Children's privacy
The Service is intended for business use by individuals aged 18 and over. We do not knowingly collect personal data from children, and the Service is not directed at them.
11. Changes to this Policy
We may update this Policy from time to time to reflect changes in our practices or legal requirements. Where changes are material, we will notify you by email or in-app notification before they take effect. The "Last updated" date at the top of this Policy shows when it was last revised.
12. Contact Us
If you have questions about this Policy or wish to exercise your data protection rights, contact us at:
Drawli Cloud Ltd 3rd Floor, 86-90 Paul Street, London EC2A 4NE