1. Scope of this policy
This policy applies to the Craftsheart product and this website. It covers what the product collects when you use it, why, how it is handled, and the rights you retain over it. It does not cover content stored inside third-party services you connect - those remain governed by the terms of the services in which they sit.
2. What we collect
2.1 Account and operational data
- Your name, work email, role, and company as you provide them at sign-up.
- Authentication events, timestamps of logins, IP addresses of sessions.
- Product usage telemetry - which screens are used, which features are triggered, error events.
2.2 Project data brought in through connections
- The files you connect to the engine - quotations, invoices, cost records, project briefs - and everything derived from them by the indexing and estimation systems.
- Estimates and quotations produced by the engine, and the outcomes recorded against them.
We do not collect any category of personal data beyond what is needed to operate the account. Marketing categories - browsing profile, interest inference, cross-site tracking - are not collected.
3. Why we collect it
- To run the product: an estimating engine grounded in your history cannot function without indexing that history. This is the primary purpose.
- To improve the product for your workspace: outcomes recorded on quotations feed the win-rate intelligence layer for your organisation, not any other.
- To support you: account and telemetry data is used to investigate errors, respond to support requests, and keep the platform running.
- To meet legal obligations: minimum records required for billing, taxation, and lawful requests.
Project data ingested from your connections is not used to train any cross-tenant machine learning system. Grounding for your estimates uses only the history from your own workspace.
4. Where and how it is stored
Data is stored on managed cloud infrastructure, in the region closest to your billing entity. All data is encrypted at rest using AES-256, and in transit using TLS 1.2 or higher. Encryption keys are managed through the infrastructure provider's key management service and rotated on a fixed schedule.
5. Who can access it
5.1 Inside your workspace
Access is scoped by role - estimator, sales, or finance. Every user of your workspace can only see what their role band exposes, and every access to sensitive records is logged.
5.2 On our side
Access by platform staff is restricted to a small operations group, gated by need, logged, and reviewed. We do not browse customer project data outside a support session initiated by you.
6. How long we keep it
While your account is active, data is retained as long as it is useful to the workspace. When an account is terminated, source files ingested through connections and derived extracts are purged within 30 days of the final invoice. Minimum records required for legal or accounting purposes are retained for the period the law requires.
7. Your rights over your data
- Request a machine-readable export of your workspace at any time.
- Correct any personal detail on file for you or another user in your workspace.
- Terminate the account and trigger the retention window described above.
- Object to specific processing activities where legally applicable.
Requests can be sent from the address associated with your workspace through the contact form on this site.
8. Third-party processors
We use a small number of third-party processors for infrastructure, transactional email, and payments. Each is bound by contract to handle data only for the specific purpose we've engaged them for, and each is reviewed for security posture before onboarding. A current list of subprocessors is available on request.
10. Changes to this policy
Substantive changes to this policy are communicated to workspace administrators before they take effect. Minor clarifications may be published without notice.