Effective date: 5 July 2026 Version: 2.0 Data Fiduciary: Singapuram Hariesh Kumar, an individual carrying on business as a sole proprietor under the trade name "Craftolin" Principal place of business: Gopal Nagar, Malkajgiri, Hyderabad, Telangana 500047, India
1. Status of this Policy
1.1 This Policy forms part of, and is incorporated into, the Terms and Conditions, and supplements the Privacy Policy.
1.2 It should be read together with the Data Deletion Policy and the Account Deletion Policy.
1.3 Capitalised terms have the meaning given to them in the Terms and Conditions and the Privacy Policy.
2. Governing Principle
2.1 In accordance with section 8(7) of the Digital Personal Data Protection Act, 2023, personal data is retained only for so long as is necessary for the purpose for which it was collected, and thereafter only where retention is necessary for compliance with Applicable Law.
2.2 Craftolin retains personal data for so long as:
(a) the account to which it relates remains active;
(b) it is necessary for the provision of the Platform;
(c) it is necessary to comply with a legal, tax, accounting, or regulatory obligation;
(d) it is necessary to establish, exercise, or defend a legal claim, or to resolve a dispute; or
(e) it is necessary to detect, investigate, or prevent fraud or abuse.
3. Retention Periods
| Category of data | Retention period | Purpose of retention |
|---|---|---|
| Account and profile data — name, email address, telephone number, address, profile photograph | While the account remains active | Provision of the Platform |
| Partner business profile and Listings | While the account remains active | Operation of Listings |
| Requirements and Orders, including denormalised transaction snapshots and Delivery Details carried onto the Order | Retained after completion for record-keeping | Dispute resolution, record-keeping, legal compliance |
| Reviews and ratings | Retained to preserve the integrity of the counterparty's reputation record | Marketplace integrity |
| In-application notification log | Until deleted by the user or the account is closed | Service history |
| Push notification tokens | Until the device unregisters, the token becomes invalid, or the account is deleted | Delivery of notifications |
| Saved event data | While the account remains active, or until deleted by the Customer | Generation of reminders |
| Images held in object storage | While the associated Listing or profile exists | Display of content |
| Records of complaints and of enforcement action taken | Retained for so long as necessary for investigation, and thereafter as required by Applicable Law | Compliance with grievance obligations and cooperation with authorities |
3.2 The Platform does not presently implement automatic time-based expiry of records. Retention is determined by account activity and by deletion requested by the user, save for technical housekeeping such as removal of invalid push tokens.
4. Deletion Cascades
4.1 Where an account is deleted, dependent records linked by cascade are removed with it. These comprise the Partner business profile, Listings and their images, wishlist entries, saved events, event reminders, push notification tokens, and in-application notifications.
4.2 Transactional records comprising Orders, Requirements, and reviews reference a user without cascade, in order that the counterparty retains a complete and consistent record of its own transactions. Such records are anonymised rather than erased, so that the personal data of the departing user is removed while the counterparty's record remains intact.
4.3 Further particulars are set out in the Data Deletion Policy.
5. Backups
5.1 The database is backed up nightly to encrypted, access-controlled storage. The seven most recent nightly snapshots are retained; older snapshots are cycled out automatically.
5.2 Personal data that has been deleted may therefore persist within backup media for a period of up to seven days before the relevant backups are cycled out.
5.3 Backups are used solely for the restoration of the service following a failure. They are never used to repopulate a deleted account, and no deleted account is restored from a backup.
5.4 Where a restoration from backup is necessary, Craftolin will re-apply any deletion that had been effected before the restoration.
6. Preservation for Investigation and Legal Hold
6.1 Craftolin may retain personal data beyond the periods stated in clause 3 where:
(a) it is required to do so by Applicable Law, or by an order, notice, or direction of a court or a government agency;
(b) the data relates to an account that is the subject of a report of fraud or unlawful conduct, or of an ongoing dispute or investigation; or
(c) the data is required to establish, exercise, or defend a legal claim.
6.2 Where an account is the subject of such a matter, Craftolin may preserve the account and its associated records, including Listings and images, and may decline a request for deletion until the matter is resolved. Clause 19.3 of the Terms and Conditions applies.
6.3 Data preserved under this clause is retained only for so long as the purpose of preservation subsists, and is thereafter deleted or anonymised in accordance with this Policy.
7. Security of Retained Data
7.1 Retained personal data is subject to the security safeguards described in clause 10 of the Privacy Policy.
8. Contact
8.1 Enquiries concerning retention should be addressed to support@craftolin.com. Complaints are acknowledged within twenty-four hours and disposed of within fifteen days, in accordance with the Support and Contact Policy.