Privacy Policy

1. Information We Collect

We collect information in the following ways:

Account Information

When you create an account through Clerk (our authentication provider), we receive your name, email address, and profile information. If you sign up using a social login provider (such as Google), we receive the basic profile information shared by that provider.

Order and Transaction Data

When you make a purchase, we collect shipping address, order details, and transaction records. Payment card information is processed directly by Stripe and is never stored on CraftCove servers.

Browsing and Usage Data

We collect information about how you use the Platform, including product views, search queries, pages visited, and interactions with features such as favorites and messaging. This data helps us improve the Platform and personalize your experience.

Communications

Messages sent through CraftCove's messaging system between buyers and sellers, as well as interactions with our AI-powered support chat, are stored to facilitate communication, provide support, and resolve disputes.

2. How We Use Your Information

We use the information we collect to:

• Process orders and facilitate transactions between buyers and sellers.
• Provide customer support, including our AI-powered support system and human agent escalation.
• Send order confirmations, shipping updates, and other transaction-related communications.
• Send notification emails (which you can customize or disable in your notification preferences).
• Improve the Platform through analytics, including product recommendations, search relevance, and user experience enhancements.
• Detect and prevent fraud, abuse, and violations of our Terms of Service.
• Comply with legal obligations and respond to lawful requests.

3. Information Sharing

We share your information only in the following circumstances:

• With Sellers: When you place an order, the seller receives your name and shipping address to fulfill the order. Sellers do not receive your email address or payment information.
• With Stripe: Payment information is shared with Stripe for secure payment processing. Stripe's privacy policy governs their use of your data.
• With Clerk: Authentication data is managed by Clerk. Clerk's privacy policy governs their handling of your account credentials.
• Legal Requirements: We may disclose information in response to a subpoena, court order, or other legal process, or to protect the rights, safety, or property of CraftCove, our users, or the public.

We do not sell your personal information to third parties. We do not share your data with advertisers or data brokers.

4. Data Storage and Security

Your data is stored securely using the following infrastructure:

• Application Data: Stored in Convex, a real-time cloud database with encryption at rest and in transit.
• Authentication: Managed by Clerk with industry-standard encryption, secure session management, and multi-factor authentication support.
• Payments: Handled entirely by Stripe, which is PCI DSS Level 1 certified. Payment card details never touch CraftCove servers.
• File Storage: Product images and user uploads are stored in Convex file storage with access controls.

While we implement commercially reasonable security measures, no system is completely secure. We encourage you to use strong, unique passwords and enable multi-factor authentication.

5. Your Rights

Depending on your location, you may have the following rights under applicable data protection laws (including the GDPR and similar regulations):

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data, subject to legal retention requirements.
• Right to Data Portability: Request your data in a structured, machine-readable format.
• Right to Restriction: Request that we restrict processing of your data in certain circumstances.
• Right to Object: Object to processing of your data for specific purposes, including direct marketing.

To exercise any of these rights, please contact us at privacy@craftcove.com. We will respond to your request within 30 days.

6. Cookies and Tracking

CraftCove uses the following cookies:

• Session Cookies: Managed by Clerk to maintain your authentication state. These are essential for the Platform to function.
• Analytics: We may use analytics tools to understand how the Platform is used and to improve performance. These are anonymized where possible.

We do not use third-party advertising cookies or cross-site tracking technologies.

7. Children's Privacy

CraftCove is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a person under 18, we will take steps to delete that information promptly.

8. International Transfers

CraftCove operates globally, and your data may be processed in countries other than your country of residence. Our service providers (Convex, Clerk, Stripe) maintain data centers in the United States and other jurisdictions. Where data is transferred internationally, we ensure that appropriate safeguards are in place in accordance with applicable data protection laws.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on the Platform or sending an email to the address associated with your account. The "Last updated" date at the top of this page indicates when the policy was most recently revised.

10. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

• Email: privacy@craftcove.com
• Support: CraftCove Support Page