Last updated: August 5, 2026
This Privacy Policy explains how BlackMonolith, Inc. ("PolyDraft", "we", "us") collects, uses, and shares information when you use the PolyDraft platform (the "Service").
Account information: when you sign in with Google, we receive your name, email address, and profile picture. Content you provide: business descriptions, brand assets, and other material you submit so the Service can build your website. Usage data: interactions with the Service, feature usage, and AI usage metering (credits), collected to operate billing and improve the product. Payment data: payments are processed by Stripe; we receive limited billing metadata (such as subscription status and card brand/last four digits) but never store full card numbers. Technical data: IP address, browser type, and similar log data. We store a salted hash of sign-up IP addresses (not the raw address) for fraud prevention.
We use collected information to provide and operate the Service (including generating your websites with AI), process payments and manage subscriptions, meter usage, prevent fraud and abuse (including promotional-program abuse), provide customer support, and improve the Service.
We also produce aggregated and de-identified statistics from use of the Service — for example, how long a typical build takes, which features are adopted, or how output quality trends over time — and we may publish or otherwise use those statistics for research, benchmarking, and marketing. This data does not identify you, your business, or your customers, and we do not attempt to re-identify it. We do not publish your name, your logo, or the sites you build unless you separately opt in to a showcase or case-study program, which you can decline or withdraw from at any time without affecting your plan or your access to the Service.
To build your website, the material you submit — your business description, brand assets, instructions, and the conversation with the agent — is sent to third-party AI models for processing. The models we currently use are large language models from Anthropic (the Claude family) and image-generation models from OpenAI, which we reach either directly or through authorized API infrastructure providers. We send only what is needed to produce your result, and our providers are bound by contractual confidentiality obligations.
We do not use your content, prompts, or generated output to train our own models — PolyDraft operates no model-training pipeline of any kind. AI providers process your content to return a result to you; their handling of that data is governed by their own terms, and we choose providers on business (non-consumer) terms. If you need a written confirmation of the current provider list and their data-handling commitments for a vendor review, contact us at the address below and we will supply it.
We rely on a small set of processors to run the Service, each receiving only the data needed to perform its function: Google (sign-in); Supabase (database, authentication, and file storage, hosted in the United States); Stripe (payment processing and card storage); Cloudflare R2 (storage of generated images and workspace snapshots); Daytona (the isolated cloud sandboxes your site is built and previewed in); and the AI providers described in Section 3.
We may also use analytics and product-telemetry tools to understand how the Service is used and to improve it. Where we use such tools, we configure them for our own product analytics rather than for third-party advertising. We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by applicable law. If that ever changes, we will update this Policy and provide the opt-out mechanism the law requires before the change takes effect.
We use cookies for authentication sessions and essential product functionality (for example, remembering a pending invite code). We may also use cookies and similar technologies for product analytics. Where applicable law requires your consent before non-essential cookies are set, we will ask for that consent first, and you can withdraw it at any time.
We retain your account data, projects, and generated sites for as long as your account is active, so that you can come back to your work. Within that, some categories are pruned automatically: workspace snapshots are kept to a fixed number of most-recent versions per site (the exact count depends on your plan) and older ones are deleted as new snapshots are taken; build sandboxes stop automatically after a period of inactivity and are archived after about a week, so the working copy of your project stays available to you until you or we delete it; and the salted sign-up IP hash used for fraud prevention is stored with the referral record it protects, never as a raw address.
You can request deletion of your account and associated personal data by contacting [email protected]. We process verified requests within 30 days. Deletion removes your account, projects, generated sites, stored assets, and snapshots from our active systems. Two things necessarily survive: records we are required to keep by law (in particular billing and tax records, which we retain for as long as the applicable law requires), and residual copies inside routine encrypted infrastructure backups, which are not used to serve the product and are overwritten as those backups rotate.
PolyDraft is operated from the United States and our primary database, storage, and build infrastructure are hosted in the United States. Our payment, authentication, and AI providers may process data in the United States and in other countries where they operate. If you use the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, where data-protection law may differ from that of your own country. We rely on appropriate safeguards, including our providers' standard contractual clauses and equivalent transfer mechanisms, and we transfer only the data needed to deliver the Service.
Depending on where you live, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise any of these rights, contact us at [email protected]. We will respond within the timeframe required by applicable law, and we will not discriminate against you for exercising a right.
We use industry-standard safeguards to protect your data, including encryption in transit, encrypted storage of sensitive credentials, and least-privilege access controls. No system is perfectly secure; please use a strong, unique account with your identity provider.
The Service is not directed to children under 18, and we do not knowingly collect personal information from them.
We may update this Policy from time to time. Material changes will be announced through the Service or by email. The "Last updated" date above reflects the current version.
BlackMonolith, Inc. — 320 Florida Ave NE, Apt. 726-1, Washington, DC 20002, United States. [email protected].