Privacy Policy

Overview & Core Philosophy

Welcome to Crafteto ("Crafteto", "we", "our", or "us"). We provide an e-commerce merchant studio and utility suite designed to empower independent creators, print-on-demand designers, and storefront operators.

We believe that privacy is not just a legal checkbox—it is an engineering choice. Traditional web platforms ingest your files, store them on remote cloud servers, and process them outside of your direct control. Crafteto is built on a foundation of local, client-side execution. This means our merchant utilities process images, design files, text, and financial calculations directly inside your personal web browser sandbox.

This Privacy Policy describes how we collect, use, disclose, and safeguard your personal information when you visit our website at crafteto.com, register for an account, subscribe to our premium services, or use our tools.

In-Browser File Processing & Zero File Storage

Our 20 in-browser utilities execute via client-side JavaScript and the native HTML5 Canvas API:

• No Image Uploads: Photos, artwork, logos, and digital product assets dropped into our tools are read directly from your device's memory into the browser engine. They are never transmitted over the internet to our web hosts or cloud storage.
• No AI Model Training: Because your creative designs, product photography, and high-resolution files never touch our servers, they are never cataloged, scanned, or used to train artificial intelligence or machine learning models.
• Instant Memory Clearance: When you refresh the webpage or close your browser tab, all cached operational data within the browser memory is instantly and permanently cleared.

Information We Collect

While our production tools process your files locally, we collect minimal operational information necessary to maintain account security, authenticate sessions, and deliver subscription benefits:

A. Information You Provide Directly

• Account Credentials: When you register for a Crafteto account, we collect your chosen username, email address, and a cryptographically hashed password.
• Customer Support Correspondence: If you contact our support desk at hello@crafteto.com, we collect your email address, name, and any correspondence records to resolve your inquiry.

B. Information Collected Automatically

• Server Logs: Like most websites, our hosting provider may keep standard server logs (IP address, browser type, pages requested, and timestamps) for security and troubleshooting.
• Theme State: Your preference for Dark Mode or Light Mode is stored locally in your browser's localStorage to maintain visual consistency without server tracking.

C. Third-Party Services

• PayPal: processes all Pro subscription payments (see Section 4).
• Hosting & Email: our web host stores the site and account database; our email provider delivers account and support emails.
• Script CDNs: some tools load open-source libraries from cdnjs.cloudflare.com and cdn.jsdelivr.net. Your browser connects to these services, which receive your IP address and browser details. Your files are never sent to them.

PayPal Payments & Financial Security

Crafteto offers an optional paid membership ("Crafteto Pro"). All payments are processed by PayPal.

When you subscribe to Crafteto Pro:

• Checkout on PayPal: you approve the subscription with PayPal, using your PayPal balance, bank account or card.
• Stored Metadata: to manage your membership we store only your PayPal subscription ID, subscription status (e.g. Active or Cancelled), billing interval, next billing date, and the email address of your PayPal account.
• Billing Notifications: PayPal notifies our server when a payment succeeds, fails, or a subscription is cancelled. Each notification is verified with PayPal before it is accepted.

PayPal handles your payment information under its own policy. Please review the PayPal Privacy Statement.

Cookies & Local Browser Storage

Crafteto avoids tracking cookies, invasive third-party ad pixels, and data brokers. We utilize only essential browser storage mechanisms:

• Authentication Cookies: When you log into your Crafteto account, standard WordPress authentication cookies (e.g., wordpress_logged_in_*) are set via encrypted HTTP-only flags to preserve your session.
• Local Storage (localStorage): We utilize the crafteto_theme key inside your browser's local storage to prevent screen flicker when loading your preferred dark or light appearance. No personally identifiable information is stored in local storage.
• CSRF Security Tokens: WordPress nonces (short-lived security tokens) are used during sessions to prevent Cross-Site Request Forgery attacks.

Data Retention & Security Standards

We maintain high technical standards to safeguard account data:

• Encryption in Transit: All communications between your web browser and our website are encrypted with HTTPS (TLS).
• Password Hashing: Passwords are never stored in plaintext. They are salted and hashed using industry-standard modern hashing algorithms.
• Account Retention: We retain your basic user profile (username, email, subscription metadata) for as long as your account remains open. If you request account deletion by email, your credentials and associated metadata are deleted from our live database. Payment records held by PayPal are kept by PayPal under its own retention rules.

European Union & UK Privacy Rights (GDPR)

If you reside within the European Union (EU) or the United Kingdom (UK), you have rights under the General Data Protection Regulation (GDPR) and the UK GDPR / Data Protection Act 2018.

The data controller is Crafteto. We process account data to provide the service you signed up for (contract) and to keep the site secure (legitimate interests).

Your rights include:

• Right of Access: You may request a machine-readable copy of the personal data we maintain about your account.
• Right to Rectification: You may ask us to correct inaccurate details. You can change your password yourself from the member dashboard.
• Right to Erasure ("Right to be Forgotten"): You may request the permanent deletion of your Crafteto account and associated customer records.
• Right to Restrict or Object: You may object to the processing of your data where our processing relies on legitimate interests.
• Right to Data Portability: You may request your account registration and billing history in a standard structured format.

To exercise any of these rights, email our privacy team directly at hello@crafteto.com. We respond to verified requests within 30 days. You also have the right to complain to your local data protection authority.

California Privacy Rights (CCPA / CPRA)

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents are entitled to specific consumer protections:

California residents have the right to request disclosure of categories of data collected, request deletion of personal information, and exercise their privacy rights free from discriminatory treatment.

Children's Privacy Protection

Crafteto is an e-commerce business utility suite designed for adult merchants, store operators, and creators. We do not knowingly solicit, collect, or process personal data from children under 16 years of age. If we discover that a minor under 16 has created an account without parental consent, we will delete that account immediately.

Updates to This Policy

We may update this Privacy Policy periodically to reflect changes in our tools, payment processing regulations, or statutory legal obligations. When adjustments occur, we will update the "Last Updated" date at the top of this document. Material changes will be highlighted on this page.

Contact & Inquiries

If you have any questions, compliance requests, or inquiries regarding this Privacy Policy or our client-side architecture, please contact our data team: