craaft privacy & data

Machine Republic (Pty) Ltd (“we”, “us”) operates the Service.

Account information: your name, email address, and a hashed password.

Email delivery data: when we send transactional email (mention notifications, invitations, password reset), the recipient address, subject and message are processed by Resend on our behalf.

Billing data: handled by Paddle, our Merchant of Record. We receive your subscription status, plan, and an opaque customer identifier.

Usage data: minimal server logs (request paths, timing, status codes, anonymised IP) used to operate and debug the Service.

Our public website pages (not the app) use Plausible, a cookieless analytics service, to count visits, the pages and referring sites they come from, and clicks through to sign up.

Provide the Service: sign you in, render your boards, deliver notifications you've opted into.

Bill you for the plan you've chosen.

Diagnose problems and improve reliability.

Communicate with you about your account and material changes to the Service.

Account and content data are kept for as long as your account is active.

When you delete your account, we remove personal data from primary storage within 30 days and from backups within 90 days.

When you delete your account, we remove personal data from primary storage within 30 days and from backups within 90 days.

Some records are kept longer when required by law: invoices and tax records for up to 7 years; security logs for 90 days.

Some records are kept longer when required by law: invoices and tax records for up to 7 years; security logs for 90 days.

Our infrastructure runs on Google Cloud Platform in the region we've chosen for the workspace.

we rely on the Standard Contractual Clauses or equivalent transfer mechanisms.

Paddle (paddle.com): payment processing, tax compliance, subscription management.

When you delete your account, we remove personal data from primary storage within 30 days and from backups within 90 days.

Access the personal data we hold about you.

Correct inaccurate data.

Export your data in a portable format (JSON or CSV, from each board's settings).

Delete your account and your data.

Object to or restrict certain processing.

Withdraw consent where we relied on it.

Lodge a complaint with your local data-protection authority.

We don't sell personal data, and we don't share it with advertisers.