Outreach Privacy Notice

Recraft Inc.

Last modified: September 21, 2026

Effective as of: September 21, 2026

1. Introduction

1.1 Scope. This Outreach Privacy Notice (“Notice”) describes how Recraft, Inc. (“Recraft”, “we”, “us”, or “our”) handles personal information about people we contact, and people who approach us, in connection with creator programs, collaborations, partnerships, sponsorships and other business opportunities. It applies whether we obtained your details from a publicly available source or you gave them to us directly, for example by completing an application form we have published.

1.2 Who is responsible. Recraft, Inc., 450 Townsend St, Ste 100, San Francisco, CA 94107, United States, is the controller of the personal information described in this Notice. Recraft AI Limited, our United Kingdom subsidiary, is an establishment through which we carry out our activities. Personnel employed by Recraft AI Limited process personal information on behalf of, and under the instruction of, Recraft, Inc.

1.3 What this Notice does not cover. This Notice does not apply to your use of the www.recraft.ai website or our services, which is described in our Privacy Policy at https://www.recraft.ai/legal/privacy. If you create an account with us, that policy will apply to your use of the service. This Notice also does not apply to personal information we process about job applicants and candidates, which is described in our Applicant Privacy Policy at https://www.recraft.ai/legal/hiring-privacy, or to personal information processed under our Data Processing Addendum at https://www.recraft.ai/legal/dpa or under the data protection terms of another written agreement.

1.4 Why we provide this Notice. Where we obtained your personal information from a source other than you, we provide this Notice under Article 14 of the EU General Data Protection Regulation and the UK GDPR. Where you gave us your personal information directly, we provide it under Article 13 of those regulations. It also serves as our notice at collection for the purposes of United States state privacy laws.

1.5 Personal information. In this Notice, “personal information” has the same meaning as “personal data” under the EU and UK General Data Protection Regulations. If we store personal information together with non-personal information, we will treat that combination as personal information.

2. Information Gathering

2.1 Information we collect from public sources. Where we have identified you as someone we would like to contact, we collect a limited amount of information relating to your professional or business activity. This includes your name or the professional name you use, a business or professional email address, and the address of a professional profile, page or website associated with you. It also includes information relating to your professional activity, such as the field or industry you work in, the nature of the work you publish or promote, the organization you are associated with where applicable, and the professional interests indicated by information you have made public.

2.2 Information you provide to us. If you complete an application or expression of interest form we have published, we collect the information you enter into that form. This may include your name, email address, Discord identifier, social media links, portfolio link, country of residence, and audience size. We also collect the content of your communications with us, including any reply you send us and any preference you express about being contacted.

2.3 Sources. Where we did not collect your personal information from you, it was obtained from publicly available sources. These may include publicly accessible professional or business profiles, business or professional websites and their published contact pages, publicly accessible directories, listings, articles or industry publications, and information lawfully provided to us by a business partner or through an introduction. Where we contact you, we will tell you in that first message where we found your details.

2.4 Special category information. We do not seek or intentionally process special category data as defined by Article 9 of the EU GDPR and UK GDPR, such as information revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, health, sex life or sexual orientation. We do not use any such information to decide who to contact.

2.5 Information we infer. The information we hold relates to professional activity. We do not attempt to infer protected characteristics, and we do not use any such inference in our outreach.

3. Information Use

3.1 Business outreach. To contact you about our products, a creator program, a potential partnership, collaboration or other business opportunity that we believe may be relevant to your professional activity.

3.2 Assessing relevance. To consider, on the basis of publicly available professional information, whether a business opportunity is likely to be relevant to you, and to prioritize our outreach accordingly.

3.3 Managing applications and correspondence. To assess an application or expression of interest you submit to us, to respond to you, to continue a conversation you have engaged with, and to send a limited number of follow-up messages where you have not replied.

3.4 Respecting your preferences. To record that you have asked not to be contacted, so that we do not contact you again. We keep the minimum information necessary to honor that request.

3.5 Record-keeping and compliance. To keep records demonstrating that we handled your information lawfully, and to comply with our legal obligations, including those relating to electronic marketing.

4. Legal Bases for Processing

4.1 Legal bases. If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases.

4.2 Our legitimate interests. We rely on our legitimate interests under Article 6(1)(f) of the EU GDPR and UK GDPR in identifying and approaching businesses and professionals about relevant business opportunities, in assessing whether an opportunity is likely to be relevant to you, and in keeping records of how we obtained and handled your information. We have assessed those interests against your interests, rights and freedoms, taking into account that the information we use relates to your professional activity and is publicly available, that our contact is limited in volume, and that you may ask us to stop at any time. You can ask us for more information about that assessment, and you can object to the processing, as described in Section 9.

4.3 Your consent. We rely on your consent where you submit an application or expression of interest form to us, and where applicable electronic marketing law requires your prior consent before we may send you a message. Where we rely on your consent, you can withdraw it at any time. Withdrawing consent does not affect processing already carried out.

4.4 Compliance with a legal obligation. We rely on compliance with a legal obligation for record-keeping required by applicable data protection and electronic marketing law, and to establish, exercise or defend legal claims.

4.5 Automated processing and profiling. We use automated tools, including artificial intelligence systems, to help us identify people whose professional activity may be relevant to a business opportunity, to prioritize our outreach, and to help draft the messages we send. This involves the automated evaluation of publicly available information about your professional activity, which is a form of profiling. We do not make decisions about you that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing, within the meaning of Article 22 of the EU GDPR and UK GDPR. You can object to this processing at any time, as described in Section 9.

5. Information Sharing

5.1 Service providers and subprocessors. We share your information with the service providers that process it on our behalf under written terms and only for the purposes we specify. For the purposes described in this Notice, these are our email delivery, cloud hosting and storage, productivity and collaboration, internal messaging, and artificial intelligence infrastructure providers. A current list of our service providers is available at https://www.recraft.ai/subprocessors.

5.2 Other companies in our group. We share personal information with other companies in our corporate group, including Recraft AI Limited, for the administration and operation of our business.

5.3 Professional advisers, authorities and legal claims. We may disclose your information to our professional advisers, and where required by law, court order or a lawful request from a public authority, or to establish, exercise or defend legal claims.

5.4 No sale or cross-context behavioral sharing. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not provide your information to any third party for that party’s own marketing purposes.

6. International Data Transfers

6.1 Where we process. Recraft, Inc. is established in the United States and Recraft AI Limited is established in the United Kingdom. Personal information we collect is processed in the United States and in other countries where we or our service providers operate.

6.2 Safeguards. Where personal information is transferred out of the European Economic Area, the United Kingdom or Switzerland, we rely on one or more of the following safeguards: an adequacy decision, where the recipient is located in a country recognized as providing an adequate level of protection; or the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Agreement or Addendum and the Swiss equivalent where applicable. The safeguard applicable to each of our service providers is identified in our subprocessors list.

6.3 More information. You can request further information about the safeguards we use, including a copy of the relevant safeguard, by contacting help@recraft.ai.

7. Information Protection

7.1 Security measures. We hold personal information on access-controlled systems and apply physical, business and technical security measures to safeguard it, including encryption of data in transit and at rest, role-based access control applied on a least privilege basis, single sign-on and multi-factor authentication, logging and monitoring, and a documented incident response plan. Our service providers are assessed before onboarding and are required to maintain standards no less protective than our own.

7.2 Security breaches. Where a security breach affecting your personal information occurs, we will notify you, and where applicable the relevant supervisory authority, in accordance with applicable law and without undue delay.

8. Data Retention

8.1 If you do not respond or decline. We normally retain the personal information described in Section 2 for up to 12 months after our last message to you, so that we can demonstrate how we obtained it and that we handled it lawfully. After this period it is securely deleted or anonymized, unless longer retention is required by law. The record described in Section 8.3 is kept separately.

8.2 If you apply to us and we do not proceed. Where you submit an application or expression of interest and we do not go on to work together, we retain the information you provided for up to 12 months from the date of your application, so that we can respond to queries about our decision and keep a record of how we handled your information.

8.3 If you ask not to be contacted. We keep a suppression record containing only the contact details necessary to recognize you and the fact that you asked not to be contacted. We keep this for as long as we carry out outreach, because it is the only way to ensure we do not contact you again, and we keep no more than is needed for that purpose. A suppression record is not used for marketing, and retaining it is how we respect your objection rather than a further use of your information.

8.4 If a business relationship begins. If we go on to work together, the information relating to that relationship will be retained under the arrangement we agree with you and under our Privacy Policy. The records of our original outreach remain subject to Section 8.1.

9. Your Rights

9.1 Asking us to stop contact. You can ask us to stop contacting you at any time, wherever you are located, and we will. The rights described below depend on where you live.

9.2 European Economic Area, United Kingdom and Switzerland. You have the following rights: the right to object at any time to our processing of your personal information, and where you object to processing for direct marketing purposes we will stop without exception; the right of access, to request a copy of the personal information we hold about you, including information about its source; the right to rectification, to correct inaccurate or incomplete information; the right to erasure; the right to restrict processing; and the right to data portability, where applicable. You also have the right to lodge a complaint with your local supervisory authority, as described in Section 11.

9.3 California and other United States states. Depending on your state of residence, you may have the right to know what categories of personal information we collect, why we collect it, and how it is used and shared; the right to correct inaccurate personal information; the right to delete your personal information, subject to legal and business requirements; the right to opt out of the sale or sharing of personal information, noting that we do not sell or share it as described in Section 5.4; and the right not to be discriminated or retaliated against for exercising your privacy rights. If we decline your request, you may appeal that decision by contacting help@recraft.ai.

9.4 Other jurisdictions. Where local law gives you rights in relation to your personal information beyond those described in this Notice, we will honor those rights to the extent they apply to you.

10. Exercising Your Rights

10.1 How to contact us. To exercise the rights described above, or if you have a question or concern, please contact us at help@recraft.ai and we will try to address or resolve it. To stop receiving messages from us, you may also use the unsubscribe link in any message we send you, or reply to that message and tell us. We may need to verify your identity before we act on your request. We do not charge a fee, and exercising your rights will not result in you being treated less favorably. We will respond within the period required by applicable law. If we are unable to resolve your request, Section 11 explains how to complain.

11. Complaints

11.1 Contact us first. If you are unhappy with how we have handled your personal information, please contact us first at help@recraft.ai. We will acknowledge your complaint and respond substantively within 30 days.

11.2 United Kingdom. If you are in the United Kingdom and you remain dissatisfied, you can complain to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom, or through ico.org.uk.

11.3 European Economic Area and Switzerland. If you are in the European Economic Area, you can complain to the supervisory authority in the country where you live or work. If you are in Switzerland, you can complain to the Federal Data Protection and Information Commissioner. Complaining to a supervisory authority does not affect any other legal remedy available to you.

12. UK Representative

12.1 UK Representative. Recraft AI Limited, a United Kingdom subsidiary of Recraft, Inc., acts as Recraft’s establishment in the United Kingdom for the purposes of the UK GDPR. You can contact Recraft AI Limited at 450 Townsend St, Ste 100, San Francisco, CA 94107, United States, or at help@recraft.ai.

13. Changes

13.1 Review and changes. We may need to change this Notice from time to time. Any updates will be posted online with an effective date. When we make material changes, we will take reasonable steps to notify you by any means we consider appropriate.

14. Contact Us

14.1 How to reach us. You can get in touch by emailing us at help@recraft.ai. You can also write to us at Recraft, Inc., 450 Townsend St, Ste 100, San Francisco, CA 94107, United States.