Privacy Policy

Last updated: September 28, 2026

This policy explains how PE Stolovych Mykhailo ("we"), the operator of CraftWay, handles personal data in the CraftWay service. Companies use CraftWay to share order progress with their clients via a private link.

Who is responsible

For the orders a company manages in CraftWay — including anything about its clients — the company is the data controller and we act as its processor, under the data processing terms in our Terms of Use. For the company's own account (sign-in email, billing relationship) we are the controller. Contact: [email protected], Kyiv, Ukraine.

If you received an order link from a company, please contact that company about your data first; we'll help them respond.

What we collect

• Account: the company name, team members' email addresses and hashed passwords.
• Orders: what a company enters for its clients — order titles (which may include a client's name), stages, dates, photos and notes — and the client's taps on approval buttons.
• Usage: a "link opened" timestamp per order, to show the company that the client has seen it. We don't store the visitor's IP address or any identifier with it.
• Security logs: our servers keep short-lived technical logs (IP address, time, page requested) to protect the service and fix problems.
• Billing: for Pro subscribers, the email, country and subscription status Paddle sends us — never card details.

How we use it & legal bases

To provide the service (performance of a contract), to secure it and prevent abuse (legitimate interests), for billing (contract), and to meet legal obligations. We don't sell personal data or use it for advertising.

Service providers (sub-processors)

These companies process data on our behalf, only to run their part of the service:

• DigitalOcean — hosting of the app, database and uploaded photos.
• Cloudflare — network security, DNS and content delivery; all traffic to CraftWay passes through it.
• Resend — delivery of account emails (verification, password reset, invites).
• Cloudflare R2 — off-site backups.
• Paddle — our online reseller and Merchant of Record: checkout, payments, invoices and tax. Paddle collects payment details directly under its own privacy policy.
• Trello (Atlassian) — only if a company connects its Trello board; we then read that board's lists and cards and comment on cards.
• Google — only if a company connects Google Sheets; we then access just the one spreadsheet it picks or that we create for it (Google's per-file drive.file access) to keep client links in sync.
• Microsoft — only if a company connects Excel ("Connect Microsoft"). Microsoft has no per-file permission, so the access we request (Files.ReadWrite) covers files the signed-in account can open — but we only ever open the one file the company picks, to read its rows and write back the client link, a CraftWay ID and the client's response.

We'll update this list before adding a new sub-processor.

Google Sheets connection

If a company connects Google Sheets, CraftWay's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We request access only to the single spreadsheet the company selects or that we create for it (the drive.file scope) — never the rest of their Google Drive — and use it solely to keep order stages and client links in sync. On the Setup page, the file picker loads a script from Google (apis.google.com) so the company can choose a file; that happens only on that page, only while connecting.

Excel (Microsoft) connection

If a company connects Excel, CraftWay signs in with Microsoft and requests the Files.ReadWrite permission. Microsoft offers no per-file scope for this, so that permission technically covers files the signed-in account can open — but CraftWay only ever opens the single workbook the company picks (or that we create for it) to read its rows and write back the client link, a CraftWay ID and the client's response. We never browse or read the rest of their OneDrive or SharePoint.

Retention

We keep data while the account is active. Deleting a company (Setup → Danger zone) permanently removes it with all its orders, photos, notes, team members and integrations. Backups are kept for 14 days and then expire, so deleted data can remain in a backup until that window passes. Security logs are kept for a short period and then rotated.

International transfers

Our providers may process data outside your country (for example in the EU or the US). Where the law requires it, transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

Your rights

Subject to law, you may request access, correction, export, or deletion of your data, object to or restrict certain processing, and complain to a data-protection authority. Company owners can delete their whole company themselves (Setup → Danger zone) and turn off photo storage (Setup → Privacy). For anything else, contact [email protected] and we'll respond within one month.

Cookies and local storage

• session (cookie, essential) — keeps you signed in; ends when you log out.
• lang (cookie, 1 year) — remembers the language you picked.
• theme and cookie-ack (your browser's local storage) — remember light/dark mode and that you closed the cookie notice.
• Paddle — on the pricing page and for Pro subscribers, Paddle's checkout script may set its own cookies to process payments and prevent fraud.

We don't use analytics or advertising cookies.

← Back · Terms of Use · Refund Policy