Effective date: 5 July 2026 Operator: Craftolin ("Craftolin", "we", "us", "our")
This policy explains how long Craftolin keeps personal data and why. Read with the Privacy Policy, Data Deletion Policy, and Account Deletion Policy.
1. Principle
We keep personal data only as long as needed to provide the service, comply with law, resolve disputes, and enforce our agreements.
2. What We Retain and For How Long
| Data | Typical retention | Reason |
|---|---|---|
| Account & profile (name, email, phone, address, avatar) | While the account is active | Provide the service |
| Partner business profile & products | While the account is active | Operate listings |
| Requirements & orders (incl. denormalised snapshots) | Retained for recordkeeping after completion | Dispute resolution, records, legal compliance |
| Reviews & ratings | Retained to maintain reputation integrity | Marketplace trust |
| Chat messages (Firestore) | Retained while accounts are active | Provide chat history |
| Notifications log | Retained until you delete them or the account closes | Service history |
| Push tokens (FCM) | Until the device unregisters, the token becomes invalid, or the account is deleted | Send notifications |
| Customer event data | While the account is active or until you delete the event | Reminders |
| Images (Cloudflare R2) | While the listing/profile exists | Display content |
The current system does not implement automatic time-based deletion (TTL). Retention is tied to account activity and manual deletion, except for technical cleanup such as removing invalid push tokens.
3. Deletion Cascades
3.1 When a user account is deleted, dependent records that are linked with cascade deletion (such as the partner profile, wishlist entries, customer events, event reminders, and push tokens) are removed with it.
3.2 Some transactional records (orders, requirements, reviews) reference users without cascade so that transaction history and the other party's records remain consistent. Where required, such records may be retained or anonymised rather than fully deleted. See Data Deletion Policy.
4. Backups
Data may persist in routine backups for a limited period after deletion before backups cycle out. 90 days
5. Legal Holds
We may retain data longer where required to comply with law, respond to lawful requests, or resolve disputes.
6. Contact
Questions about retention: john@gmail.com.