Q: Draper AI privacy, GDPR, own AI agents and automatic subscriber welcome sequences?
Hi Raj, I reviewed §5.2 of your Terms and the privacy/AI policies before enabling Draper. It seems to access workspace-wide lists, campaigns and metrics, with data sent to external AI providers.
Could you clarify:
Can access be restricted to selected lists/campaigns? Which providers/regions process personal data, how long is it retained, and is it deleted when Draper is disabled?
Is EU-only processing available?
Can I connect my own AI agent through scoped, revocable API/MCP permissions, with approval before sending?
How can I automatically enrol new newsletter signups into a welcome sequence? I found drip sequences, but not a signup/list-join trigger. Is this supported or planned?
These are important for GDPR, client confidentiality and practical automation.
Raj_utobo
Oct 29, 2026A: Hey ZevsMatic, I’m so glad you’re interested in using Draper — we love it here at utobo. And thanks for your patience; I’ve been swamped with queries and back-to-back meetings and couldn’t get to this sooner.
Quick context first: Draper isn’t part of the AppSumo deal — it’s a separate feature. The advice version is free for everyone: Draper analyses your workspace and gives recommendations in chat. Letting it actually do the work — draft campaigns, send 1:1 outreach (with your approval), or run on autopilot — is on the paid Operator / Autopilot tiers. It runs on Google Gemini (a secure, enterprise-grade AI). Data is hosted in the US today; we’re part of the GO EU program and expect to add EU-based hosting as our enterprise base grows — so EU-only processing isn’t available yet, but it’s on the horizon.
On the specifics:
Restrict Draper to selected lists? Not today — it reads your whole workspace. You can cap which lists it acts on and approve every send (Operator tier), but not what it reads.
What’s sent / retention? Counts, metrics, your campaign and list content, and up to ~12 named “hot” contacts — not your full list. Turning Draper off stops further processing; stored data isn’t auto-deleted, but you can remove it yourself (delete a thread, remove a knowledge source). For a DPA, email hello@utobo.com.
Your own AI agent? Yes — our Claude MCP connector is read + draft only (never sends, so approval is built in), or use the REST API with granular, revocable keys (grant read/draft without send, optionally lock to one domain). Scoping is by capability/domain, not per-list.
Auto-enrol newsletter signups into a welcome sequence? Yes — live via Signup Forms: build a form, point it at a list + welcome sequence, and signups enrol automatically. Hosted page (any plan) or embed widget (higher tiers), single or double opt-in from your own domain. Please let me know if you have any other questions. Cheers!
Verified purchaser
Hi, any reason you skipped to reply on this and everyone else?
Verified purchaser
Thanks Raj, appreciated for the transparency and hope you also will solve the privacy for emails
Verified purchaser
Thanks Marcus — small first step already in: Unibox now has a toggle to import only emails from today onward (or all of them), so your older mail stays private. We’ll tackle the bigger privacy picture soon — I’ll keep you posted. If you’ve had a chance to explore utobo, I’d really appreciate a review on AppSumo 🙏 It will help us immensely.
Verified purchaser
Awesome to hear, much appreciated! This looks like a sustainable path for your startup.