Privacy Policy

Effective date: 5 July 2026 Data Fiduciary / Operator: Craftolin ("Craftolin", "we", "us") Privacy contact / Grievance Officer: john@gmail.com

This Privacy Policy explains what personal data Craftolin collects, why, how it is used and shared, and your rights. It is aligned with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 (DPDP Act) of India.

1. Scope

This policy covers the Craftolin customer and partner mobile apps (Android/iOS) and web applications, and the Craftolin backend services.

2. Data We Collect

2.1 Information you provide

• Account & identity: name, email address, phone number, role (customer/partner), and profile photo/avatar.
• Customer delivery profile: address line, street, city, state, PIN/ZIP code.
• Partner business profile: business name, description, business email, phone/WhatsApp number, business address (line, city, state, ZIP), social and web links (Instagram, YouTube, website), logo and profile images, and delivery-coverage settings.
• Product content (Partners): product names, descriptions, prices, categories, hashtags, delivery timelines, and product images.
• Requirements & orders: quantity, required delivery date, delivery city and PIN code, customization details, and event type; and, where you choose to share it, your phone number for contact.
• Important Events (Customers): event type, name, date, and notes you add for gifting reminders. This data is private to you and is never shown to Partners or any public surface.
• Reviews & ratings: ratings, review text, and delivery-time feedback.
• Messages: chat content you send to other users.

2.2 Information collected automatically

• Device push token (for notifications) and device platform (Android/iOS).
• App activity such as product views and wishlist actions.
• Order/transaction history generated through your use of the workflow.

2.3 Information from third parties

• When you sign in with Google, we receive your basic Google account identity (name, email, Google/Firebase user ID) from Firebase Authentication.

2.4 What we do not collect

• No precise/GPS location. Location values (city/PIN) are typed by you, not read from device sensors.
• No access to your contacts.
• No payment card or bank/financial account data (we do not process payments).
• No third-party analytics or advertising identifiers — the apps contain no analytics or ad SDKs.

3. How We Use Your Data

We use personal data to:

• create and manage your account and role;
• operate the request → order workflow, including contact sharing and the in-app agreement code;
• display product listings, partner profiles, search results, trending items, and similar-creator suggestions;
• enable in-app chat;
• send push and in-app notifications for workflow events, messages, and your event reminders;
• calculate ratings and partner performance metrics;
• store and serve images;
• provide partner subscriptions and limits;
• support, safety, fraud prevention, and to comply with law.

4. Legal Bases / Consent

We process your data based on your consent (given at sign-up and when you provide optional data such as contact sharing or events), to perform the service you request, and to meet legal obligations. You may withdraw consent (see §9), which may limit functionality.

5. Sharing and Disclosure

5.1 Between users: To complete a transaction, certain data is shared between Customer and Partner — for example, a Customer's name and (if shared) phone number to the Partner, and the Partner's contact details to the Customer once an order is In Progress.

5.2 Service providers (sub-processors): We share data with the providers needed to run the platform:

5.3 Legal: We may disclose data to comply with law, enforce our Terms, or protect rights and safety.

5.4 We do not sell your personal data.

6. International Transfers

Some providers (Firebase/Google, Cloudflare) may process data outside India. We take reasonable steps to protect such transfers.

7. Data Retention

We retain personal data for as long as your account is active and as needed to provide the service, resolve disputes, and meet legal obligations. Transaction records (orders, requirements, reviews) may be retained for recordkeeping. See Data Retention Policy.

8. Security

We use measures including token-based authentication (Firebase ID tokens verified server-side), secure transport, access-controlled storage, and direct-to-storage presigned uploads (our API never receives image bytes). No method is 100% secure, but we work to protect your data.

9. Your Rights

Subject to applicable law (including the DPDP Act), you may:

• access and correct your personal data (in-app profile editing; GET/PUT /me);
• withdraw consent for optional processing;
• delete your data / account — see Account Deletion Policy and Data Deletion Policy;
• manage notifications via device settings;
• raise a grievance with our Grievance Officer.

⚠️ Current limitation: an in-app self-service account-deletion flow is not yet available. Until it is, deletion requests are handled manually via the contact below. [ACTION REQUIRED — implement in-app deletion to meet Google Play and DPDP requirements.]

10. Children

Craftolin is intended for users 18 and older and is not directed at children. We do not knowingly collect data from minors.

11. Notifications and Communications

We send push notifications via Firebase Cloud Messaging and in-app notifications. These include workflow updates, new chat messages, and reminders for events you created (sent around 15 and 7 days before the date). You can disable push notifications in your device settings.

12. Changes

We may update this policy and will notify you of material changes in-app or by other reasonable means.

13. Contact / Grievance Officer

• Grievance Officer: Craftolin Support
• Email:
• Address:

We aim to acknowledge and resolve complaints within the timelines required by applicable Indian law.