Who we are
Draft is operated by Arbour Villa Limited, a private company limited by shares registered in Ireland, company number 812496, with its registered office at Apartment 6, Ashbrook House, Sallymount Avenue, Dublin 6, D06 VN20, Ireland. Arbour Villa Limited is the controller of the personal information described in this notice.
For any privacy question or request, contact Fergus O'Reilly at fergus@arbourvilla.ie.
Who this covers
Draft's financing is for businesses, not individuals. This notice covers people whose information we handle in that work: visitors to this website, people who send us enquiries, and the owners, directors, guarantors, employees and advisers of businesses that apply for or receive financing from us.
Much of the information we handle is about businesses rather than people. Where business information identifies an individual, such as a name on a bank account, we treat it as personal information.
Website and enquiries
Website visits. Vercel hosts this website. Delivering and protecting it involves technical information such as your IP address, the page requested, the time and your browser. This website uses no analytics, advertising trackers or cookies of its own. See our cookie notice.
Enquiries. When you use our enquiry form or email us, we receive the details you provide: your name, role and work email, an optional phone number, the company's name, website, country of registration and revenue range, what the financing would support and anything else you choose to tell us. Enquiry form submissions are stored in a private store in Dublin. We use this information to reply, to decide whether Draft may be able to help and to keep a record of the conversation.
Assessment and financing
If a business goes further with us, we may collect:
- Company information: legal name, registration, addresses, ownership structure and trading details.
- Information about people: names, contact details, roles, dates of birth, home addresses and identity documents of the people who own, control or guarantee the business, so that we can verify who they are.
- Business bank account information: account names and types, partial account numbers, balances, transactions, statements and the account holder's name, address, email and phone number as held by the bank.
- Sales and accounting information: store, marketplace and payment-processor records such as orders, refunds, fees and payouts, and accounting records such as profit and loss, balance sheet, receivables and payables.
- Information from other sources: company registries, identity verification and sanctions screening providers, fraud prevention services, business credit bureaus and, where an individual guarantees financing and the law allows, consumer credit reporting agencies.
We ask only for information relevant to the financing being considered and explain why before you share it.
Bank connections through Plaid
We use Plaid Inc. ("Plaid") to connect business bank accounts. If you choose to connect an account, Plaid collects the information you authorise from your bank and passes it to us. You sign in through Plaid or your bank, so we never receive your banking username or password, and the connection is read-only.
Before you connect, you'll see which information will be shared and why, and you choose whether to continue. We keep a record of each authorisation, including when it was given and what it covered. Plaid's handling of your information is described in the Plaid End User Privacy Policy.
While financing is in place, and with your authorisation, we may refresh connected information to monitor the facility. You can disconnect at any time through Plaid Portal, your bank's connected-apps settings or by emailing us. Disconnecting stops new information reaching us. It doesn't change an agreement already signed.
Sales and accounting connections through Rutter
We use Rutter to connect store, marketplace, payment-processor and accounting platforms, such as Shopify, Amazon and QuickBooks from Intuit. If you choose to connect one, you approve the connection on that platform and Rutter passes us the information it covers, such as orders, refunds, fees, payouts, invoices, bills and financial statements. We never receive your password for the platform.
Some platforms grant broader permissions than we need. We only read information, and we don't create, change or delete records. Rutter's handling of information is described in its privacy notice. You can disconnect through the platform's connected-apps settings or by emailing us, as our security page explains.
How we use information, and our legal bases
- Responding to enquiries
- Our legitimate interest in handling business enquiries.
- Assessing eligibility and preparing a proposal
- Taking steps at the business's request before entering a contract, and our legitimate interest in lending responsibly.
- Verifying identity, preventing fraud and screening against sanctions
- Compliance with legal obligations, and our legitimate interest in preventing fraud and financial crime.
- Providing, monitoring and collecting financing
- Performance of the financing agreement, and our legitimate interest in managing credit risk.
- Keeping records and meeting legal requirements
- Compliance with legal obligations.
- Improving how we assess and serve businesses
- Our legitimate interest in improving our service, using information about businesses we have assessed, within the purposes described here.
We don't sell personal information or business data, and we don't share it for anyone else's marketing. We don't add people to marketing lists because they contacted us.
Decisions and technology
We use software, including analytical and AI tools provided by service providers acting on our instructions, to organise and analyse information. People at Draft make every financing decision. We don't make decisions with legal or similarly significant effects about individuals solely by automated means.
Who we share information with
- Service providers acting on our instructions, such as hosting, cloud storage, email, data connection, identity verification and analysis providers.
- Affiliates, funding partners and lenders involved in providing or financing a facility, and their advisers, under confidentiality obligations.
- Credit bureaus and fraud prevention services, where the law allows.
- Professional advisers, auditors and insurers.
- Courts, regulators, law enforcement and public authorities where the law requires or permits it.
- A buyer or successor if all or part of our business is sold or reorganised, subject to this notice.
International transfers
We are based in Ireland and work with US businesses, so information moves between the United States and the European Economic Area. Some of our service providers process information in the United States and other countries. Where information leaves the European Economic Area, we rely on an adequacy decision, such as the EU-US Data Privacy Framework for certified recipients, or on the European Commission's standard contractual clauses. Contact us for details of the safeguards that apply.
How long we keep information
- Enquiries that don't lead further
- Up to 24 months after our last contact.
- Assessments that don't lead to financing, including connected bank information
- Up to 12 months after the decision or withdrawal.
- Businesses we finance
- For the life of the relationship and six years after it ends.
- Website hosting records
- According to our hosting provider's security and service retention periods.
We keep information longer only where the law requires it, such as anti-money-laundering or credit record-keeping rules, or where it's needed for a legal claim. When information is no longer needed, we delete it or make it anonymous.
Your rights
Depending on where you are and the circumstances, you can ask to access, correct or delete your personal information, restrict or object to how we use it, or receive a portable copy. You can withdraw an authorisation at any time, which won't affect what happened before.
Email fergus@arbourvilla.ie to make a request. We may need to verify your identity first. We reply within one month, and if the law allows more time for a complex request, we'll tell you within that month. If we can't delete something because the law requires us to keep it, we'll explain why.
You can complain to the Irish Data Protection Commission or the data protection authority where you live or work. If you're in the United States, you may also have rights under your state's privacy laws.
Our security page explains how we protect information.
Changes to this notice
We'll update this notice when the way we handle information changes, and show the date of the latest version at the top. If a change materially affects information we already hold, we'll tell the businesses concerned before it takes effect.