Privacy Policy

Personal Information

When you create an account or use our services, we may collect:

• Identity Information: Full name, username, profile photo, date of birth
• Contact Information: Email address, phone number, mailing address
• Financial Information: Payment methods (processed securely)
• Verification Documents: Government-issued ID (for seller verification)
• Biometric Data: Facial recognition data (for account security features)

Marketplace-Specific Information

As a marketplace platform, we also collect:

• Seller Data: Shop details, product listings, inventory management, sales history
• Buyer Data: Purchase history, wishlist items, browsing behavior, saved searches
• Transaction Data: Order details, payment information, returns
• Reviews & Ratings: Both given and received, with timestamps
• Communications: Messages between buyers and sellers, support tickets
• Preferences: Language preferences, currency choices

Technical & Usage Data

We automatically collect information about how you interact with our app:

• Device Information: Device type, model, operating system, unique device identifiers
• App Usage: Features used, time spent, session duration, crash reports
• Location Data: GPS location (with permission), IP address, general location
• Network Information: Carrier, connection type, signal strength
• Performance Data: Load times, response rates, error logs

Sessions & Tracking Technologies

We use various tracking technologies:

Social Media & Third-Party Integrations

When you connect social media accounts or use third-party services:

• Social media profile information (when you choose to connect)
• Third-party authentication data (Google, Facebook, Apple Sign-In)
• Integration data from shipping carriers, payment processors
• Marketing platform data (email services, analytics tools)

Primary Service Purposes

Secondary Purposes

• Service Improvement: Analyzing usage patterns to enhance features
• Research & Development: Developing new features and services
• Analytics: Understanding user behavior and preferences
• Compliance: Meeting legal and regulatory requirements
• Dispute Resolution: Resolving conflicts between users

Automated Decision Making

We use automated systems for:

• Fraud detection and prevention
• Product recommendations and personalization
• Search result ranking
• Risk assessment for sellers

Limited Exceptions

We may only share your information in the following limited circumstances:

• Service Providers: With trusted third parties who help us operate our service, such as payment processors and shipping carriers, but only the minimum information necessary to complete the transaction
• Legal Requirements: When required by law, court order, or to protect our rights and safety
• Business Transfers: In case of merger, acquisition, or sale, user data may be transferred as part of the transaction

Security Measures

We implement multiple layers of security:

• Encryption: AES-256 encryption for data at rest and TLS 1.3 for data in transit
• Access Controls: Role-based access, multi-factor authentication for staff
• Monitoring: 24/7 security monitoring and intrusion detection
• Regular Audits: Quarterly security assessments and penetration testing
• Compliance: PCI DSS, GDPR, CCPA compliance measures

Data Breach Response

In the event of a data breach:

• We will notify affected users within 72 hours (as required by law)
• We will provide information about the breach and its impact
• We will outline steps taken to mitigate the breach
• We will provide recommendations for protecting your account

International Data Transfers

Your information may be stored and processed in:

• United States (primary location)
• European Union (for EU users)
• Other countries with adequate data protection laws

We ensure appropriate safeguards including Standard Contractual Clauses (SCCs) and adherence to Privacy Shield principles where applicable.

90-Day Retention Policy

At CraftCrest Marketplace, we follow a strict 90-day data retention policy:

• All user information is automatically deleted after 90 days of collection
• This includes personal data, transaction records, and usage information
• The deletion process is permanent and irreversible
• No backup copies are retained beyond the 90-day period

Exceptions to 90-Day Policy

The only exceptions to our 90-day retention policy are:

• Information required to be retained longer by law (e.g., tax records)
• Data involved in ongoing legal disputes or investigations
• Information that has been anonymized and no longer identifies you

Data Subject Rights GDPR/CCPA

You have the following rights:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your personal data
• Portability: Receive your data in a machine-readable format
• Restriction: Limit how we process your data
• Objection: Object to certain processing activities
• Withdraw Consent: Revoke consent for marketing

How to Exercise Your Rights

You can exercise your rights by:

• Using the privacy settings in your account
• Emailing us at craftcrmarket@gmail.com
• Submitting a request through our privacy portal
• Calling our privacy hotline

We will respond to your request within 30 days (or as required by law).

Privacy Controls

Parental Controls

If you are a parent or guardian:

• You can request deletion of your child's information
• You can restrict data collection for your child's account
• You can review and approve your child's public profile

Public Information

The following information is publicly visible:

• Your username and profile picture
• Your shop name and description
• Product listings and descriptions
• Reviews you give and receive
• Public collections and favorites

Content Rights

By posting content on CraftCrest:

• You grant us a license to display and distribute your content
• You retain ownership of your original content
• You represent you have the right to post such content
• You agree to our content guidelines and policies

Applicable Regulations

We comply with:

• GDPR: General Data Protection Regulation (EU)
• CCPA: California Consumer Privacy Act
• CPRA: California Privacy Rights Act
• PIPEDA: Personal Information Protection Act (Canada)
• LGPD: Lei Geral de Proteção de Dados (Brazil)

International Transfers

For international data transfers, we use:

• Standard Contractual Clauses (SCCs)
• Adequacy decisions where available
• Binding Corporate Rules (BCRs)

Notification Process

Specific Contacts

Response Times

• General inquiries: 3-5 business days
• Data subject requests: 30 days (extendable to 60 if complex)
• Urgent security matters: Immediate response