This policy explains what personal data CraftFile Studio collects, why, and what rights you have under the UK GDPR and the EU GDPR.
Who Is Responsible
The data controller is CONKAREX LTD · Registered in England and Wales · Company No 17539619 · 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. Contact: hello@craftfilestudio.com. We have not appointed a data protection officer; write to the email above for privacy questions.
EU representative: [EU representative to be appointed — name and contact will be published here]
What We Collect
- Order data: your name, email, billing country, items bought, order number, license tier, and download history.
- Payment data: processed by Stripe (cards, Apple Pay, Google Pay, Link). We receive confirmation, the last four digits of the card, and billing details, not the full card number.
- Account data: email and password hash if you create an account.
- Email list data: your email address and consent record if you join the free library or newsletter.
- Follow-up email data: if you buy from us, we may send you one follow-up email about similar products.
- Consent and IP records: the IP address and time recorded when you accept the checkout statement or give email consent, so we can prove what you agreed to.
- Support messages: what you send us.
- Technical data: IP address, device and browser details, and security logs, collected by our hosting provider and by cookies where you agree.
Why We Use It and Our Legal Basis
| Purpose | Basis |
|---|---|
| Deliver files, process orders, provide My Account | Contract |
| Tax, accounting, fraud checks | Legal obligation, legitimate interests |
| Answer support requests | Legitimate interests, contract |
| Send the free library and newsletter | Consent (double opt-in) |
| One follow-up email 3 days after a purchase about similar products | Legitimate interests (soft opt-in for existing customers), with an opt-out in every email and at checkout |
| Keep IP and consent records to prove your agreement | Legitimate interests (handling disputes and legal claims) |
| Functional cookies, where used | Consent |
| Anonymous site statistics (Google Analytics 4; processor: Google) | Consent |
| Protect the site from abuse, keep server logs | Legitimate interests |
With your consent we use Google Analytics 4 for anonymous statistics (see our Cookie Policy). We do not use marketing cookies.
Follow-up Email
After a purchase we send one follow-up email, 3 days later, about similar products. You can opt out at checkout and in every email with the unsubscribe link. Our emails do not use open or click tracking.
Who We Share It With
We use these providers:
- Stripe for payments. Stripe acts as an independent controller for payment processing and fraud prevention. It uses Stripe Radar, which makes automated decisions that can block a payment it considers risky. If a payment is declined this way, you can contact us and ask for a person to review it.
- Google (Google Analytics 4, Ireland; transfers to the United States under the EU-US Data Privacy Framework) for site statistics, only with your consent.
- Cloudflare (United States) for security, content delivery, and performance.
- Resend (United States) for sending order and marketing emails.
- Hetzner (Germany and Finland) for hosting and storage.
- Accountants and legal advisers where required.
We do not sell your data. Some providers are outside the UK and EEA, including in the United States. Where a provider is certified under the EU-US Data Privacy Framework or its UK Extension (the UK-US Data Bridge) we rely on it; otherwise we rely on standard contractual clauses, with the UK International Data Transfer Addendum for UK data.
How Long We Keep It
- Order and tax records: six years.
- IP address and consent records: two years, then the IP address is deleted. The order record itself stays for six years.
- Account data: until you delete your account, then up to 12 months to handle disputes.
- Email list: until you unsubscribe.
- Support messages: up to two years.
- Server logs: 30 days.
Your Rights
You may ask us to access, correct, delete, or restrict your data, to receive a copy in a portable format, and to object to processing. You have an absolute right to object to direct marketing, and we will stop at once. Where we rely on consent you can withdraw it at any time, for example with the unsubscribe link. Write to hello@craftfilestudio.com. We confirm receipt of your request within 30 days and reply within one month.
Complaints
You can complain to the Information Commissioner's Office (ico.org.uk) in the UK, or to the data protection authority in the EU country where you live, work, or where the issue happened. We would appreciate the chance to resolve it first. We confirm receipt of a complaint within 30 days.
Cookies
Our Cookie Policy explains which cookies we use and how to change your choices.
Age
The site is for people aged 18 and over. We do not knowingly collect data from anyone under 18.
Security
We use encrypted connections, access controls, and trusted processors. No system is perfectly secure, and we will notify you and regulators of a breach where the law requires.
Changes
We will update this page when practices change and note the date at the top.