PledWell Privacy Policy

Effective date: October 17, 2026
Last updated: October 2026

PledWell, Inc. ("PledWell," "we," "us," or "our") operates codraftai.com. This Privacy Policy explains how we collect, use, and disclose personal information when you visit our website, create an account, or use our services (the "Services"), and describes your privacy choices and rights.

PledWell, Inc.
29 Chase Road, PO Box #234
Scarsdale, New York 10583
Privacy contact: afiorilla@codraftai.com

1 About this Policy

This Policy applies when you visit our website, create an account, use our Services, or communicate with us. Our Services are designed for lawyers and law firms.

2 Information We Collect

Account and firm information. When you or your firm creates an account, we collect information such as your name, email address, telephone number, business address, firm name, professional role, username, and account credentials.

Billing information. When you purchase a subscription, we collect billing contact information, billing address, subscription details, and transaction records. Payments are processed by a third-party payment processor; we do not store full card numbers. The payment information we receive depends on the processor and payment method.

Information provided through the Services. We collect the prompts and instructions you submit, the results generated for you, and information you save in your account, such as case selections and alert preferences. For drafting, your firm may provide basic plaintiff details, such as a name and address or a name and county, and general facts relevant to the complaint.

Connected advertising accounts. If your firm connects a Facebook or Instagram advertising account to run client-notification ads through the Services, we receive from Meta the connecting user's name and Meta user ID, an access token, and the names and IDs of the ad accounts and Pages your firm selects. We use this information only to create and manage the campaigns your firm directs and to retrieve the lead-form submissions those campaigns generate for your firm. Access tokens are stored encrypted. Your firm can disconnect the account at any time from the Ad Campaigns page, which deletes the stored token.

Communications. If you contact us, we collect your contact information and the contents of your message.

Information collected automatically. When you visit our website or use the Services, we may collect your IP address, browser and device information, approximate location, referring website, pages viewed, interactions, and error or performance information. We collect this information through cookies, pixels, and similar technologies, as described in Section 5.

Other sources. We may receive information from your firm's authorized representatives, payment and other service providers, and integrations you authorize. We also obtain research information from public sources, including court filings, government notices, news, and regulatory publications.

3 How We Use Information

We use the information we collect to:

• Provide the Services, including case discovery, investigation, and drafting features.
• Create and administer accounts, manage firm access, and save your work and preferences.
• Process payments, maintain financial records, and answer billing questions.
• Respond to requests and send alerts, account updates, and other service communications.
• Understand how the website and Services are used, improve their performance, and troubleshoot problems.
• Promote our Services and measure advertising performance, subject to your privacy choices.
• Develop and improve our AI technology as described in Section 4.
• Protect the Services, prevent misuse, comply with legal obligations, and establish or defend legal rights.

We do not use plaintiff details, private prompts, or generated case work to build advertising audiences.

4 AI Processing and Training

We use AI to process your instructions and relevant case information and generate results, such as draft complaints. AI and document-generation providers may process this information on our behalf to provide the requested feature. Those providers are not permitted to use it to train their own models.

Training on what you submit. We use the prompts and instructions you submit, the responses and documents we generate for you, and any materials you upload to develop, evaluate, improve, and train our AI models. Firms agree to this in our Terms of Use when they subscribe. Do not upload confidential or protected material to PledWell, including client files, privileged communications, protected health information, or material covered by a protective order or confidentiality agreement.

Limits. We do not disclose your submitted content itself to other customers, sell it as a dataset, or use it for advertising. We may apply deidentification or filtering before training but do not promise to. We also use lawfully available public information, such as court filings and government notices, for AI development. Account, billing, and website-activity information is not used to train AI.

Stopping future use. A firm may ask us to stop using its future submissions for training by emailing afiorilla@codraftai.com. Information already incorporated into a trained model cannot be removed from that model; we address existing datasets as required by law.

5 Cookies Analytics and Advertising

We use cookies, pixels, and similar technologies to operate the website, remember preferences, measure usage, and support advertising.

Necessary technologies. Some cookies and storage are needed for login, security, and account and privacy preferences.

Google Analytics. We use Google Analytics to understand website activity and performance. It may collect device information, identifiers, page views, and events. Learn more about how Google uses information from partner websites.

Meta Pixel. We use Meta Pixel to measure advertising and support advertising to interested visitors. Meta may receive identifiers and information about website visits or interactions and associate that information with a Meta account. See Meta's Privacy Policy.

Troubleshooting. We use Sentry to identify errors and improve reliability, including session replay of website interactions. Replay is configured to mask all typed text and form inputs, so drafting prompts, plaintiff details, and credentials are not recorded. See Sentry's Privacy Policy.

We configure these tools to exclude plaintiff details, private prompts and results, payment credentials, and authentication secrets.

Disclosures to advertising providers may constitute a sale or sharing of personal information under California law or targeted advertising under other state laws, even when we receive no money for the information.

You can manage optional technologies through the Cookie Settings control in the website footer and opt out of covered sharing and targeted advertising through the Your Privacy Choices link in the footer. Optional analytics and advertising technologies are not enabled until you make a choice. Where consent is required, we obtain it before enabling optional collection. You may withdraw consent or change your choices later.

We honor qualifying opt-out preference signals, including Global Privacy Control, for covered sale, sharing, and targeted advertising. We apply the signal to your browser or device and a recognized account as required. Choices may need to be repeated on another browser or device.

We do not respond to legacy browser Do Not Track signals, which have no common standard. We do honor Global Privacy Control signals as described above.

6 How We Disclose Information

We may disclose information to:

• Service providers: companies that provide hosting, infrastructure, security, support, AI processing, document generation, payment processing, accounting, and email delivery.
• Your firm: administrators and authorized colleagues who manage your account or access work shared within your firm's workspace.
• Authorized integrations: third-party services you or your firm choose to connect, as needed to provide the selected feature.
• Analytics and advertising providers: companies receiving permitted website information for the purposes described in Section 5, subject to applicable privacy choices.
• Professional advisers and legal recipients: advisers, authorities, courts, and others when reasonably necessary for advice, compliance, valid legal process, or protection of legal rights.
• Business transaction participants: parties involved in a merger, acquisition, financing, reorganization, or sale of business assets, subject to appropriate confidentiality protections.

We require service providers acting on our behalf to protect information and use it for authorized purposes. Some third parties, including payment and advertising companies, may also process information under their own privacy policies.

We do not sell personal information, and we never will. We do not sell or share plaintiff information, private prompts, or results, and we do not use them for advertising. Website activity disclosed to advertising providers may constitute sharing or targeted advertising as described in Section 5, and you can opt out.

7 How Long We Keep Information

We retain personal information for as long as reasonably necessary to provide the Services, fulfill the purposes described in this Policy, meet legal requirements, and resolve disputes.

Retention depends on the type of information. Account information is generally kept during the customer relationship and for necessary administration afterward. Billing records are retained for applicable accounting, tax, and dispute requirements. Drafts, plaintiff details, and saved work follow the agreed service retention schedule and applicable firm instructions. Website and diagnostic records are retained for measurement, troubleshooting, and security purposes. Content used for AI training is retained as described in Section 4.

Our general retention periods are: account and firm information for the life of the account and up to 12 months after closure; billing and transaction records for 7 years; drafts, plaintiff details, and saved work until the firm deletes them or 30 days after the subscription ends, matching the export period in our Terms of Use; website analytics for up to 14 months; error and session-replay diagnostics for 90 days; and encrypted backups, which rotate within 90 days. We keep information longer where a legal hold, dispute, or statutory requirement applies.

When information is no longer needed, we delete it or properly deidentify it, subject to applicable legal requirements. Information in backups may remain until the scheduled backup rotation, with access and use restricted.

8 Security and International Processing

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. No electronic service can guarantee complete security.

Information is processed and stored in the United States. If we later process information elsewhere, we will update this Policy and use appropriate safeguards for international transfers.

9 Your Privacy Choices and Rights

Depending on applicable law, you may have the right to access your personal information, receive a portable copy, request correction or deletion, opt out of sale, sharing, or targeted advertising, and withdraw consent.

Submitting a request. Email afiorilla@codraftai.com with the subject line "Privacy request". Describe your request and provide enough information for us to locate the relevant records. We may verify your identity before responding to an access, correction, or deletion request. You do not need to create an account to exercise your rights. Authorized agents may submit requests with proof of authority where permitted by law.

Information supplied by a law firm. If your request concerns plaintiff information supplied by a firm, we may need to coordinate with that firm to respond. We will tell you if the firm must handle the request and will assist as required. You can still contact us directly about information we use for our own purposes.

Responses. We acknowledge applicable access, correction, and deletion requests within 10 business days and generally respond within 45 calendar days. If an extension is permitted and needed, we explain it within the initial response period. We process opt-outs as soon as feasible and within the applicable deadline, including 15 business days for covered California requests.

Appeals. If we deny a request, we explain our decision. You may appeal by replying to our decision or emailing afiorilla@codraftai.com with the subject line "Privacy appeal" within 60 days. We respond within 45 calendar days, or sooner if required, and explain how to contact the appropriate regulator if your appeal is denied.

Requests are generally free, subject to exceptions permitted by law. We do not unlawfully discriminate against you for exercising privacy rights. Deleting information essential to a feature may affect that feature.

Facebook connection data. To delete the information we received when a Facebook account was connected to the Services, disconnect it on the Ad Campaigns page, remove PledWell from your Facebook account under Settings & Privacy › Settings › Apps and Websites (Meta then sends us an automated deletion request and gives you a confirmation code), or contact us using the details in Section 14. Step-by-step instructions are at codraftai.com/legal/data-deletion.

Marketing and alerts. Use the unsubscribe link in marketing emails to stop receiving them. Manage requested alerts on the Alerts page of your account. Essential account, security, and billing messages may continue. Cookie and advertising choices are described in Section 5, and AI-training practices are described in Section 4.

10 California Privacy Rights

These disclosures supplement the Policy for California residents, including professional business contacts, where the CCPA applies.

Sections 2, 3, 6, and 7 identify information, sources, purposes, recipients, and retention criteria. The relevant California categories are identifiers; customer-record information such as contact/billing details; commercial information; internet/electronic activity; approximate geolocation; professional information; marketing inferences; and account credentials qualifying as sensitive personal information. Plaintiff information is limited to the basic details and general facts described above.

The table below describes our practices for the preceding 12 months and, because the Services are newly launched, the practices that apply as firms subscribe. Service providers are the hosting, AI-processing, document-generation, email-delivery, payment, and diagnostics companies described in Section 6.

We do not sell personal information and have not sold or shared personal information in the preceding 12 months. Once Google Analytics and Meta Pixel are enabled, website activity and marketing identifiers will be shared with those providers for advertising measurement and targeting, which California law treats as sharing; you can opt out through the Your Privacy Choices link, and we honor Global Privacy Control. We do not knowingly sell or share information of individuals under 16.

Applicable rights include knowing categories and specific pieces collected and disclosed, correction, deletion, sale/sharing opt-out, limiting sensitive-information use where that right applies, and nondiscrimination. Sections 5 and 9 explain how to exercise these rights, including through an authorized agent or qualifying opt-out signal.

We use account-access information only for authentication, security, and other purposes permitted without a right to limit, so no separate limit option is offered.

For applicable California Shine the Light requests relating to third-party direct marketing, contact afiorilla@codraftai.com. Accessible formats are available through that address.

11 Additional U.S. State Privacy Rights

Residents of Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia may have additional rights where the relevant law covers the business, data, and request. Statutes differ in their business thresholds, exemptions, and treatment of commercial relationships.

Depending on the statute, rights may include access, deletion, portability, correction, or opting out of sale, targeted advertising, or certain consequential profiling. These rights are not identical in each state. Section 9 describes requests and appeals, and Section 5 describes qualifying universal opt-out signals. We do not use these Services to make consequential automated decisions about individuals' employment, credit, housing, insurance, or eligibility for essential services.

Connecticut. Personal data in prompts, responses, and uploaded materials may be used to train large language models as described in Section 4. The update month/year appears above. We provide required notice and consent-withdrawal opportunities for material retroactive changes.

Minnesota and Oregon. Where applicable, you may request a list of specific third-party recipients. Minnesota also provides rights to explanations, correction of inaccurate inputs, and reevaluation for covered consequential profiling; our statement above describes the present scope.

Delaware. Where applicable, you may request categories of third-party recipients.

Maryland. Where Maryland law applies, we limit collection and use to information permitted for the disclosed purpose and honor applicable privacy requests through Section 9.

Texas and Nebraska. We apply obligations relevant to our business, including any that remain under a small-business exemption. We do not sell sensitive personal data.

Rhode Island. We do not sell personal information to any third party. The active contact for privacy matters is afiorilla@codraftai.com.

Nevada. We do not sell covered information as Nevada defines a sale. Nevada residents may still submit a verified request to afiorilla@codraftai.com; we respond within 60 days, with a permitted 30-day extension and notice.

12 Children

The website and Services are intended for adult professional users and are not directed to children. If you believe we have improperly collected a child's information, contact afiorilla@codraftai.com. Basic plaintiff details concerning a minor, if supplied by a firm, remain subject to applicable protections.

13 Changes to this Policy

We update the effective and last-updated dates when this Policy changes. We provide notice of material changes and obtain new consent where required. A Policy update that materially broadens the AI-training practices in Section 4 applies only to content submitted after the update takes effect.

14 Contact Us

For questions, privacy requests, appeals, or an accessible version of this Policy, contact:

PledWell, Inc.
29 Chase Road, PO Box #234
Scarsdale, New York 10583
afiorilla@codraftai.com