Craflio

Privacy Policy

Effective date: 30 August 2026. This policy explains what personal data Craflio (“we”, “us”) collects, how we use it, and your rights. It applies to your use of the Service.

1. Who we are

Craflio is operated by a sole trader established in the Netherlands, who is the data controller for the personal data described here. For any privacy question, or to exercise the rights in section 7, contact team@craflio.com.

2. Data we collect

  • Account data: email address and authentication data, managed by our auth provider (Supabase).
  • Content you provide: prompts, uploaded images, designs, and listing text you create in the Service.
  • Connected-account data: when you connect a third-party sales or fulfilment marketplace, the access tokens and store/listing data needed to operate those integrations. Tokens are stored encrypted.
  • Billing data: subscription and payment status. Card details are handled directly by our payment processor (Stripe); we do not store full card numbers.
  • Usage and technical data: logs, device/browser information, and feature usage needed to operate, secure, and improve the Service.

3. How we use data, and on what legal basis

  • To provide, maintain, and secure the Service and your account, and to generate the design, manufacturing, and listing output you request — performance of our contract with you.
  • To process payments and enforce plan limits — performance of our contract and, for tax and accounting records, compliance with a legal obligation.
  • To keep the Service secure, prevent abuse, and improve how it works — our legitimate interests in running a safe and functioning service.
  • To send you service email about your account and plan — performance of our contract.
  • Website analytics on our public pages — your consent, and only if you give it.

4. Processors and third parties

We share data with service providers that process it on our behalf, only as needed to run the Service:

  • Supabase: database, authentication, file storage.
  • Vercel: application hosting and delivery.
  • Stripe: subscription billing and payments.
  • Runware: the AI image-generation and text models that produce the output you request.
  • Brevo: delivery of account and service email.
  • Etsy and Printify: the sales and fulfilment marketplaces you can choose to connect. Nothing is sent to them unless you connect an account and publish to it.
  • Google LLC: website analytics (Google Analytics) on our public pages, only if you consent to the optional analytics cookie (see the Cookies section).

We do not sell your personal data.

4a. Cookies and similar technologies

Strictly necessary (always on; legal basis: our legitimate interest in providing a service you asked for. They cannot be switched off because the Service does not work without them):

  • Authentication cookies (sb-*): keep you signed in.
  • activeStoreId: remembers which of your connected stores is active.
  • etsy_oauth_return: completes a marketplace connection you started.
  • craflio_consent: stores your cookie choice itself (6 months).

Optional analytics (off until you opt in; legal basis: consent): Google Analytics (_ga, _ga_*) on our public marketing and legal pages only, to understand which pages help. Nothing loads before you choose, declining is one click, and you can change your mind any time on our Cookie settings page, linked from the footer of every public page and from the cookie banner itself. Opting out removes the analytics cookies from your browser.

5. Content moderation

Prompts you submit are sent to our AI providers, who apply their own safety filtering and may refuse to generate output. We may also screen prompts and generated output ourselves, automatically or by review, to enforce our Acceptable Use Policy, and may block or remove content that breaches it. No decision that produces a legal or similarly significant effect on you is made by automated means alone; you can contest a block by contacting us.

6. Data retention

We keep personal data for as long as your account is active and as needed to provide the Service, then for a reasonable period afterwards to meet legal, accounting, or security obligations, after which it is deleted or anonymised. Invoicing records are kept for the seven years Dutch tax law requires.

Analytics data (only if you consented) is held by Google under their retention settings for our property, and your record of the cookie choice itself is kept so we can show what you agreed to and when.

7. Your rights

You have rights to access, correct, export, and delete your personal data, and to object to or restrict certain processing. Where processing rests on your consent, you can withdraw it at any time without affecting what was done before. You can export or delete your account data yourself from your settings, or contact us; we respond within one month, as the GDPR requires.

If you think we have handled your data wrongly, please tell us first so we can put it right. You also have the right to lodge a complaint with a data protection supervisory authority — in our case the Dutch Autoriteit Persoonsgegevens, or the authority where you live or work.

8. Security

We use technical and organisational measures including encryption of credentials, row-level tenant isolation, and access controls. No system is perfectly secure; we cannot guarantee absolute security.

9. International transfers

Some of the providers in section 4 process data outside the European Economic Area, including in the United States. Where that happens we rely on the European Commission’s Standard Contractual Clauses, or on an adequacy decision where one covers the provider, so your data keeps its protection when it travels.

10. Changes and contact

We may update this policy and will notify you of material changes. Contact for privacy questions or to exercise your rights: team@craflio.com.