This Privacy Policy explains how Craft with AI ("we", "us", "our") collects, uses, shares and protects personal data when you visit craftwithai.chat, use the application at app.craftwithai.chat (the "Service"), or receive an email or WhatsApp message that a business sent to you through the Service.
Craft with AI is a platform on which businesses build their own CRM workspace and message their customers. This means we act in two roles: as the controller of data about our own visitors and account holders, and as a processor of the data that businesses store in their workspaces about their customers. Section 3 explains the difference and what it means for you.
1. Who we are
Craft with AI operates the website craftwithai.chat and the Craft with AI application. For any question about this policy or about your data, write to contact@craftwithai.chat.
2. Data we collect
Account and profile data
When you create an account we collect your name, email address, password (stored as a one-way hash), and, if you sign in with Google, the name, email address and profile picture that Google shares with us. We also record the workspace you belong to, your role in it, and your plan.
Content you create in the Service
Pages, fields, records, files, automations, templates, notes and messages you create in your workspace, and the instructions you type into the AI assistant that builds and edits your workspace.
Payment data
Subscriptions are handled by Stripe. We receive your plan, billing status, and a customer reference. We never see or store your full card number.
Contact and support data
What you send us through the contact form, by email, or in support conversations, including your name, email address, company and message.
Usage and device data
Log data such as IP address, browser type, pages visited, actions performed, timestamps and error reports, collected directly by our servers and through the analytics tools described in section 8. Sign-in sessions are logged for security purposes.
3. Data businesses store about their customers
A business that uses the Service ("Workspace Owner") stores information about its own customers, subscribers, leads or contacts in its workspace, for example names, phone numbers, email addresses, subscription dates and notes. For that data:
- The Workspace Owner is the controller and decides what is collected and why. Their own privacy policy applies to that data.
- We process it only to provide the Service to the Workspace Owner, under their instructions, and we do not use it for our own marketing.
- If you are a customer of a business that uses Craft with AI and want to access, correct or delete the data it holds about you, contact that business first. You can also contact us (section 13) and we will pass your request on or, where we are able to, act on it directly.
4. WhatsApp and email messaging
Workspace Owners can set up automations that send messages to their customers, for example a reminder a few days before a subscription expires.
Messages are sent through the WhatsApp Business Platform operated by Meta Platforms. To provide this we process, on behalf of the Workspace Owner:
- the recipient's phone number and the values placed into an approved message template (such as a first name or an expiry date);
- delivery information returned by Meta: whether a message was sent, delivered, read, or failed, and the reason for a failure;
- replies the recipient sends to the business's WhatsApp number, including the message text and the sender's WhatsApp profile name, which are shown to the Workspace Owner;
- an opt-out list of numbers that asked not to be messaged.
To stop receiving WhatsApp messages from a business, reply STOP to any of its messages. The number is added to that business's opt-out list immediately and no automation will message it again. Reply START to opt back in.
WhatsApp messages are transmitted and stored by Meta under Meta's own terms and privacy policy, available at whatsapp.com/legal/privacy-policy. Only pre-approved message templates can be sent by automations. We do not use Facebook Login to collect data about you, and we do not receive any data from your Facebook or Instagram profile.
Automation and notification emails are delivered through Brevo. We process the recipient's email address, the message content, and delivery events (sent, delivered, bounced, opened where the recipient's mail client reports it). Every marketing-style email contains an unsubscribe link.
5. How we use data
- To provide the Service: create and secure your account, run your workspace, execute the automations you configure, send the messages you ask us to send, and show you delivery results and replies.
- To power AI features: the instructions you give the AI assistant, together with the structure of your workspace, are sent to an AI provider to generate the requested configuration. They are not used to train the provider's models.
- To operate and improve the Service: monitor performance, fix errors, understand which features are used, and plan improvements.
- To communicate with you: service announcements, security notices, responses to your requests, and, with your consent where required, product news.
- To bill you: manage subscriptions, vouchers and invoices.
- To protect the Service and comply with the law: prevent abuse and fraud, enforce our terms, and meet legal obligations.
6. Legal bases
Where data protection law requires a legal basis, we rely on: the performance of our contract with you (providing the Service); our legitimate interests in running, securing and improving the Service; your consent, for optional cookies and marketing communications, which you can withdraw at any time; and compliance with legal obligations.
7. Who we share data with
We do not sell personal data. We share it only with service providers that help us run the Service, under contracts that limit what they may do with it:
| Provider | Purpose |
|---|---|
| DigitalOcean | Hosting of the application and its database |
| Netlify | Hosting of this website and the application front end |
| Cloudflare | Storage of files uploaded to workspaces |
| Meta Platforms (WhatsApp Business Platform) | Delivery of WhatsApp messages and receipt of replies and delivery reports |
| Brevo | Delivery of transactional and automation emails |
| Stripe | Payments and subscription billing |
| Sign in with Google, and Google Analytics for site and product measurement | |
| OpenAI | Processing of AI assistant requests |
| Meta Platforms (Meta Pixel) | Advertising measurement on this website, only if you accept advertising cookies |
We may also disclose data when required by law, to protect the rights and safety of users or the public, or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to your data.
8. Cookies and analytics
We use strictly necessary cookies to keep you signed in and remember your choices, Google Analytics to understand how the site and the Service are used, and, only if you accept them, advertising cookies (Meta Pixel) to measure our ad campaigns. Details, retention periods and how to change your choice are in our Cookie Policy, which you can also reopen from the footer of any page.
9. How long we keep data
- Account data: for as long as your account exists, then deleted within 30 days of a deletion request or account closure, except where we must keep it for legal or billing reasons.
- Workspace content: until the Workspace Owner deletes it or closes the workspace.
- Message logs, delivery reports and replies: for as long as the workspace exists, so the business can see what was sent and answered. Raw webhook events from Meta are deleted after 90 days.
- Opt-out lists: for as long as the workspace exists, so a number that asked not to be messaged stays excluded.
- Security and sign-in logs: for a limited period needed to detect and investigate abuse.
- Billing records: for the period required by tax and accounting law.
10. Security
Data is encrypted in transit (HTTPS) and stored with providers that encrypt data at rest. Access is restricted by role, passwords are hashed, webhook traffic from Meta is verified by signature, and administrative actions in a workspace are recorded in an audit log. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and the relevant authorities as the law requires.
11. International transfers
Our providers store and process data in data centres that may be outside your country, including in the European Union and the United States. Where required, transfers are protected by standard contractual clauses or equivalent safeguards offered by the provider.
12. Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, receive a copy in a portable format, restrict or object to certain processing, and withdraw consent. You can also complain to your local data protection authority. To exercise any of these rights, contact us as described in section 16. We will answer within 30 days.
13. How to request deletion of your data
Account holders: send an email to contact@craftwithai.chat from the email address on your account with the subject "Data deletion request". We will confirm receipt, delete your account and the personal data linked to it within 30 days, and send you a confirmation when it is done. Data we must retain for legal or billing reasons is kept only for as long as the law requires and is then deleted.
Customers of a business that uses Craft with AI: contact that business directly, since it controls the data it stores about you. You can also email us at the address above with the name of the business and the phone number or email address concerned; we will forward your request to the business and, where we act on their behalf, delete the data on their instruction. To stop WhatsApp messages immediately, reply STOP to any message.
14. Children
The Service is intended for businesses and is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
15. Changes to this policy
We may update this policy from time to time. When we do, we will change the "Last updated" date at the top of this page and, for significant changes, notify account holders by email or in the Service.
16. Contact
Craft with AI
Email: contact@craftwithai.chat