CLEAR TERMS. SHARED TRUST.

Privacy policy

Last updated: October 30, 2026

Static preview policy. No real payments or accounts are created in this version. The operating entity, registered address and support mailbox must be confirmed before the live service opens.

These terms describe the intended CraftAI marketplace workflow.

Data we collect

We collect account information such as name, email address, password hash, role and profile; seller portfolios and specialist profiles and project quotes; transaction references, order details, messages, deliveries, disputes and reviews; contact form submissions; and essential session and security information. We do not store complete card numbers. Stripe collects payment, identity, business and tax information through its own hosted flows. Google sign-in, when enabled, provides your verified email and basic profile.

How and why we use data

We use data to provide accounts and marketplace services, process orders and subscriptions, support payment protection, investigate disputes, communicate with you and meet legal obligations. Our legal bases, where relevant, include contract performance, legal obligations, legitimate interests in security and service integrity, and consent for optional cookies.

Third parties and international transfers

We share necessary payment information with Stripe and sign-in information with Google when you choose Google sign-in. Buyers and sellers can access information needed for their shared orders; public seller profiles, services and published reviews are visible to visitors. Hosting providers may process data for us. Providers may operate internationally; applicable transfer safeguards must be in place where required. We do not sell personal information.

Cookies

Essential cookies maintain sign-in sessions and secure Google OAuth state. Your cookie preference is saved locally in your browser. No analytics or advertising cookies are installed by this delivery. If optional analytics is added, it must remain disabled until you select Accept. Reject keeps non-essential cookies disabled. You can reopen cookie preferences from the footer or the Cookie Policy page.

Retention and security

We retain data only as needed for the service, dispute handling and applicable accounting or legal requirements. Passwords use salted password hashing; the Cloudflare deployment uses PBKDF2-SHA256. Access to orders is limited to the parties and authorized administrators. No system guarantees absolute security. Contact us to request deletion or learn the retention period for your circumstances.

EEA and UK rights

Where GDPR or equivalent law applies, you may request access, correction, deletion, restriction or portability of your personal data and object to certain processing. You may withdraw consent at any time and complain to your competent supervisory authority. Some requests may be limited by legal recordkeeping obligations.

California rights

California residents may request information about the categories and specific personal information we collect, request correction or deletion, and exercise applicable rights to opt out of sale or sharing and limit use of sensitive information. We do not sell personal information or share it for cross-context behavioral advertising. We will not discriminate against you for exercising your rights.

Requests and contact

Send privacy requests to the support contact shown on our Contact page once the live service opens from your account email. We may request proportionate identity verification and respond within applicable legal deadlines. This service is intended for adults and does not knowingly collect children’s data.