Privacy Policy

If you send us a message we keep it so we can reply. Our server logs requests for security and debugging. There is no analytics running, no advertising pixel, and nothing that follows you to another site. That is the entire picture.

We do not ask for and do not want special category data — health, beliefs, biometrics or anything comparable. Please do not put any of that in the form.

• —Contact form: your consent, given by ticking the box, plus our legitimate interest in replying to an enquiry addressed to us.
• —Newsletter: your consent, collected separately and confirmed by clicking a link in a confirmation email. Never bundled with the contact consent.
• —Server logs: our legitimate interest in keeping the site up and not being abused.

• —No analytics provider. No page-view tracking of any kind at present.
• —No advertising or retargeting pixels.
• —No selling or sharing of personal data, and no sharing for cross-context behavioural advertising.
• —No profiling and no automated decision-making.
• —No non-essential cookies — see the cookie policy.

If analytics is added later, this page and the cookie policy are updated before it goes live, and it sits behind a consent gate that blocks it until you agree. Loading the script first and asking afterwards is the common version of this, and it is not lawful.

Our hosting provider necessarily processes traffic in order to serve the site, and holds the server logs described above. Contact form submissions are delivered to an email inbox we control.

Nobody else. There is no CRM, no marketing automation platform and no enrichment service in the path. We will disclose data where the law compels us, and would tell you unless legally prevented.

• —A copy of what we hold about you.
• —Correction of anything inaccurate.
• —Deletion, unless we have an overriding legal reason to keep it.
• —A machine-readable export.
• —Withdrawal of consent at any time, without affecting anything lawful done before that.
• —Objection to processing based on legitimate interests.
• —Nomination of someone to exercise these rights for you, under the DPDP Act.

Email support@craftitstudios.com. We acknowledge within 5 working days and respond properly within 30 days. If something will take longer we will tell you before the 30 days is up, not after.

One thing we keep after a deletion request: a record that you asked not to be contacted. Deleting that too would mean you hear from us again next time, which is the opposite of what you asked for.

Abhishek Jha handles data queries and is the contact point under the DPDP Act, at founders@craftitstudios.com.

If we have not dealt with something properly you can complain to the Data Protection Board of India, or your own supervisory authority if you are in the EEA or the UK. We would rather you came to us first, but we will not get in your way.

This is a business service, not directed at children, and we do not knowingly collect data from anyone under 18. If we find that we have, we delete it.

If a breach affects your data and creates a risk to you, we will tell you and notify the relevant authority within the time the applicable law requires — 72 hours under GDPR, and as prescribed under the DPDP Act.

Questions go to support@craftitstudios.com. We answer them.