1. Data Controller Identification
The data controller responsible for the processing of your personal data on CraftyBot is Keepsake3d (Proprietor: Tom Van Geert), Lavendelstraat 21, 9120 Beveren-Kruibeke-Zwijndrecht, Belgium (KBO/BCE: 1032.478.391). Contact: [email protected].
2. Categories of Personal Data Collected
- Account Credentials: Email address, encrypted password hash, and unique Supabase user ID.
- Workshop & Profile Data: Business name, craftsman phone number, workshop postal address, VAT number, and banking details (IBAN/BIC) entered for quotation generator footers.
- Project & Stock Records: Material inventory items, cutting optimization dimensions, quotes, and planner task schedules.
- AI Query Telemetry & Usage Logs: Prompt token counts, completion token counts, AI model identifiers, and timestamp metadata for quota tracking and cost verification.
- Payment & Subscription Data: Stripe customer IDs, payment status, subscription tier, and transaction receipts (full credit card details are handled directly by Stripe and are never stored on our servers).
3. Purposes & Legal Bases for Processing (GDPR Art. 6)
Performance of Contract (Art. 6.1.b): Authenticating users, maintaining inventory records, processing AI calculations, generating quotes, and managing subscriptions.
Compliance with Legal Obligations (Art. 6.1.c): Preserving accounting records, transaction receipts, and tax documentation in compliance with Belgian fiscal law (7–10 year retention).
Legitimate Interests (Art. 6.1.f): Securing our cloud infrastructure, detecting fraudulent activity, preventing API abuse, and monitoring platform performance.
4. Sub-Processors & Infrastructure Providers
We partner with trusted service providers who process data strictly under Data Processing Agreements (DPAs) with Standard Contractual Clauses (SCCs) and GDPR safeguards:
Supabase Inc. — Database hosting, row-level security (RLS), and authentication (Frankfurt EU region).
Stripe Payments Europe, Ltd. — Payment gateway, subscription processing, and PCI-DSS compliant billing.
Vercel Inc. — Edge application hosting and SSL routing.
OpenRouter & AI Model Providers — Processing LLM prompts for workshop estimation and code RAG.
5. Data Retention Periods
We retain your active account data as long as your account is open. Upon account deletion, personal profile and workshop data are removed within 30 days, except where retention is required by statutory Belgian tax and accounting regulations.
6. Security Safeguards
We implement robust technical and organizational measures, including HTTPS/TLS 1.3 encryption in transit, Supabase Row-Level Security (RLS) ensuring strict tenant isolation, encrypted database storage, and secure authentication tokens.
7. Your Data Subject Rights under GDPR
Under Articles 15–22 of the GDPR, you have the following enforceable rights:
- Right of Access: Request a copy of all personal data held about you.
- Right to Rectification: Correct inaccurate or incomplete profile data directly via Settings.
- Right to Erasure ('Right to be Forgotten'): Request the deletion of your account and personal records.
- Right to Data Portability: Export your inventory and project records in structured formats (.xlsx, .csv, .json).
- Right to Restrict or Object: Object to specific processing activities based on legitimate interests.
Right to Lodge a Complaint: You have the right to file a formal complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit - GBA), Drukpersstraat 35, 1000 Brussels (www.gegevensbeschermingsautoriteit.be).
Belgian Data Protection Authority (GBA / APD)8. Policy Updates & Contact
We may update this Privacy Policy periodically to reflect technological or legal developments. For privacy inquiries or to exercise your GDPR rights, please email [email protected].
© 2026 Keepsake3d (Tom Van Geert). All rights reserved.