Drael terms of service: no company, no law, no forum

Drael's terms of service never say who sells Drael. The seller is "the operator", with no company name, registration, address, governing law or forum. The same page makes you pay the operator's legal defence, caps its liability at three months of fees and refunds in account credit. We would not sign that for professional work.

Data collected on 9 and 10 November 2026 from Drael's terms (last changed 29 October 2026), privacy page and refund policy, and from NotHoly pricing. This is our reading as practitioners. It is not legal advice, and your counsel should read the same pages.

#The clauses in one table

The page describes itself as "Short on purpose: what follows is what binds either side." What it leaves out is most of what a contract is for.

Topic	What Drael's terms say	What that means for you
Who the seller is	"the operator"	Nobody to name in a contract, a complaint or a court filing
Governing law and forum	Nothing	You find out where and how to dispute after the dispute starts
Third-party claims	"you take responsibility for it, including the reasonable cost of defending it"	You pay the operator's lawyers
Liability cap	"what you paid in the three months before the claim"	At most three blocks of subscription
Warranty	"as it is and as available"	No promise it runs, is correct or fits any purpose
Nature of the output	"Nothing Drael says is legal, medical, financial or security advice"	The seller of an exploit-writing tool disclaims security advice
Refunds	"The remedy is credit on the account"	No money back through the payment method
Suspension	"without notice when the case calls for it"	Credit on an account closed for a breach is not refunded
Changes	Shown in the product; "Using Drael after that means accepting the new version"	No notice period

#Who the operator is

We do not know, and the terms do not say. Across the terms, the privacy page and the refund policy, in English and in Portuguese, there is no company name, no registration number and no postal address. The contact is [email protected] and a Discord server. The "Help" link in the public footer redirects to the sign-in screen.

A seller is free to be small. A seller that will not identify itself is a different matter, because every remedy a customer has starts with knowing whom to address. NotHoly's terms name the holder by CNPJ, with governing law and venue.

#You pay the operator's defence

The clause reads: "You cover us for what you do. If someone makes a claim against the operator because of how you used Drael or what you did with an answer, you take responsibility for it, including the reasonable cost of defending it."

Set that beside how the product works. Drael's server runs the code, fetches the page and queries the breach databases. If a third party complains about that traffic, the claim arrives at the operator and the terms send it to you, legal fees included. You would be indemnifying a party whose name you were never given.

#The three-month cap

In the other direction the exposure is small: the operator's "total liability to you for anything to do with Drael is limited to what you paid in the three months before the claim". On Pro that is at most three blocks, R$ 597 / US$ 210.

The clause interacts badly with the annual plan. Someone who paid for a year eight months ago paid nothing in the previous three months. We do not know how the operator would apply it, and with no governing law or forum in the text there is no obvious place to ask. The pricing post has the plan numbers.

#Refunds in credit, and a closure clause

The refund policy says: "The remedy is credit on the account, spendable on anything the product does, rather than money sent back down the payment method it came from." It adds that local law applies where it gives more. Usage that was delivered is not refunded "even if you did not like" the answers.

The same page plans for the product shutting: "A closure of the product counts as broken; ask and the time is credited." Credit in a closed product is worth what the product is worth that day.

#What the legal pages say against each other

Drael's legal and technical pages disagree in three places, and a buyer should ask about each.

The privacy page says "There is no AI vendor in the path and nothing you ask goes to a third party's API." The tools documentation says "generate_image is cash at a provider per attempt", the refund policy lists provider_unavailable, and the limits page mentions "an upstream serving side that meters by the minute". The privacy page itself says the breach lookup "sends the identifier you asked about to the lookup service and the databases it consults".

The terms say "We cannot read your history." The privacy page says "While you are using Drael, the server holds your key in memory", and that the encryption "protects what is stored, not a conversation while it is happening".

The terms tell you "The exact figures are on the plan page." There is no plan page: /pricing returns 404 and the nav link is an anchor on the home page.

There may be explanations for all three. The OWASP LLM Top 10 still lists "Unclear T&Cs and data privacy policies of the model operators" as a supply-chain risk (LLM03), and these pages fit the description.

#What a company's counsel will look for

A client's lawyer reviewing a tool looks for a counterparty, a governing law, a data processing agreement under GDPR article 28 or the LGPD, named subprocessors and a breach notice clause. Drael's pages have none of them, and with no email on the account there is no address to notify.

The IBM Cost of a Data Breach 2026 release puts the global average breach at US$ 4.99 million. Against that, a cap of US$ 210 and an unnamed seller is not a risk transfer we would approve.

#Where each fits

Drael's terms fit a throwaway chat account where nobody will need to find the seller or bring a claim. NotHoly's terms name the holder by CNPJ, with a governing law and a venue, which is what a client's counsel looks for first; NotHoly still has no published DPA and no SOC 2 or ISO 27001, listed on the trust page. If your work never reaches a contract, neither set of terms matters; once it does, an unnamed operator is the one that ends the review.

#Frequently asked questions

#Is Drael safe to use?

We cannot judge its servers. In our view its contract is unsafe for professional use: the seller is unnamed, and third-party claims and defence costs fall on you.

#Is Drael trustworthy if the operator has no name?

A seller that does not identify itself gives you nothing to hold it to. That is our reason for not trusting it with client work.

#Which law governs the Drael terms of service?

The terms do not say. They name no governing law and no forum.

#Does Drael give refunds?

In account credit. The policy says credit is the remedy "rather than money sent back".

#Does NotHoly have a DPA?

Not a published one, and we hold no SOC 2 or ISO 27001. The trust page lists what we do have, and the enterprise page is where to ask.

#Verdict

Drael's terms protect the operator and identify nobody. They ask you to indemnify an unnamed party, accept a cap of three months of fees, take refunds in credit and agree to changes by continuing to use the product. That is acceptable for a throwaway chat account and not for anything a client depends on. Why professionals do not run engagements on Drael applies this to a vendor review, and NotHoly pricing starts at US$ 5.