Privacy Policy

Information you give us:

• Account — your email address and a password, which is hashed and stored by our authentication provider. We never see your password.
• Creator profile — niche, platforms, audience, goals, experience level, content pillars and tone, if you choose to fill them in.
• Your work — the prompts, scripts and transcripts you enter, and any ideas, scripts, SEO sets, content plans, analyses and coach conversations you save.

Information collected automatically:

• Usage records — which tool was used and how many generations it consumed, so we can enforce your monthly allowance.
• Subscription status — your plan, renewal date, and cancellation state, received from our payment processor.
• Error and performance data — when something breaks, our monitoring tool records the error along with technical details such as browser, page, and a session identifier.
• Session replay — a sample of roughly one in ten sessions, and sessions where an error occurs, are recorded as a replay of on-screen activity so we can reproduce bugs. Replays capture what happens in the interface, including text you type into CraftX. They are retained by our monitoring provider and used only for debugging.

We do not collect or store your card details. Those go directly to our payment processor.

• To run the service — signing you in, generating output, and saving your work.
• To personalise results, using your creator profile and saved work as context.
• To apply plan limits and process your subscription.
• To find and fix faults, and to keep the service secure.
• To contact you about your account, billing, or material changes to the service.

We do not send marketing email unless you ask us to, and we do not sell or rent personal data to anyone.

CraftX relies on a small number of providers. Each receives only what it needs to do its job.

• Supabase — authentication and database hosting. Stores your account, profile, saved work and usage records. Hosted in the AWS Asia Pacific (Singapore) region.
• Anthropic — receives the prompt and relevant saved context when you use Creator Coach, in order to generate a reply.
• DeepSeek — receives the prompt and relevant context for Idea Studio, Script Studio, SEO Studio, Content Planner and Script Analyzer.
• Lemon Squeezy — merchant of record. Handles checkout, card processing, invoicing and tax, and sends us your subscription status.
• Sentry — error monitoring and session replay, as described above.
• Vercel — application hosting, which processes requests as they are served.

Several of these are outside your country, so your data may be processed abroad. We may add or change providers as the product develops, and will update this list when we do.

We may also disclose data if required by law, or to protect the rights and safety of our users.

When you generate something, your prompt and any relevant saved context are sent to the AI provider handling that tool. We instruct providers not to use this content to train their models, and their business terms reflect that. Providers may retain the request briefly for abuse monitoring under their own policies.

Please avoid entering passwords, financial details, health information, or anything else sensitive into a prompt.

• Account and saved work — until you delete the item, or delete your account.
• Usage records — retained so we can calculate monthly allowances and support billing questions.
• Error data and session replays — retained by our monitoring provider on a rolling window, typically 90 days or less.
• Payment and invoice records — retained by Lemon Squeezy for as long as tax and accounting law requires.

• Access and correction — your profile and saved work are visible and editable in the app.
• Deletion — deleting your account from Settings removes your profile, saved work and usage records. This cannot be undone.
• Export — every tool lets you copy or download its output. If you want a full copy of your data, email us and we will send it.
• Objection — if you would rather not be included in session replay sampling, email us and we will exclude your account.

Depending on where you live you may have further rights, including to restrict processing or complain to a data protection authority. Email craftxofficialbd@gmail.com and we will respond within 30 days.

Traffic is encrypted in transit. Passwords are hashed by our authentication provider and never stored in plain text. Every database query is scoped to the signed-in account, so one user cannot read another's work. No system is perfectly secure, and we will notify affected users promptly if a breach occurs.

CraftX is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will remove it.

We use cookies that are necessary for the service to work — chiefly to keep you signed in. We do not use advertising or cross-site tracking cookies. See our Terms of Service for how the service itself operates.

We will post any update here with a new date, and email you if the change is significant. Questions go to craftxofficialbd@gmail.com.