Privacy Policy
Last updated: September 20, 2026
This policy explains how Craftway ("we") handles personal data in the Craftway service. Studios use Craftway to share job progress with their clients via a private link.
Who is the controller
For a studio's account and the jobs it manages, the studio is the data controller and we act as a processor on its behalf. For the account itself (the studio's login), we are the controller. Contact: [email protected].
What we collect
- Account: email address and a hashed password.
- Jobs: the job titles, stages, ETAs and photos a studio enters, and any file a client uploads when approving.
- Usage: a "link opened" timestamp per job (no IP or personal identifier stored).
- Technical: a single strictly-necessary session cookie to keep you signed in. We do not use tracking or advertising cookies.
How we use it & legal bases
To provide the service (performance of a contract), to secure it and prevent abuse (legitimate interests), and, where applicable, billing (contract) and compliance (legal obligation).
Processors we use
Hosting/backups, email delivery, payment processing (Stripe), and the studio's chosen project tool (e.g. Trello) when connected. These process data only to provide their part of the service.
Retention
We keep data while the account is active. Deleting a workspace (Setup → Danger zone) removes it and its jobs, photos and uploads. Backups are retained for a limited window (by default 14 days) and then expire, so deleted data may persist in backups until that window passes.
International transfers
Data may be processed in the country where our hosting/processors operate, under appropriate safeguards where required.
Your rights
Subject to law, you may request access, correction, export, or deletion of your data, and object to certain processing. Account owners can delete their whole workspace themselves (Setup → Danger zone) and turn off photo/upload storage (Setup → Privacy). For other requests, contact [email protected].
Cookies
Only a strictly-necessary session cookie (to keep you signed in) and a local preference to remember you dismissed the cookie notice. No analytics or ad cookies.