Privacy Policy

During registration and use of the Platform, we collect the following. Your first and last name, email address, country, and date of birth are needed to open an account — without them we cannot register you; your phone number and avatar are optional; a delivery address is needed to place an order.

• First and last name — for account identification
• Phone number — optional. If you give it, it is shown to a seller you order from so the order can be delivered (Section 5.1), it is passed to Western Bid when you pay by card (Section 5.3), and after your account is deleted it is kept together with your email address to prevent re-registration (Section 6.3)
• Email address — for login, account verification (one-time password), and notifications
• Country and city — to display relevant delivery options and content
• Date of birth — required, used to confirm you are at least 18 years old
• Avatar — optional, profile photo
• Shipping address — full address for receiving orders (full name, phone, email, country, city, address, postal code)
• Unit of measurement — the metric system, which is the only one the Platform currently supports
• Language preference — your chosen interface language, used to localise the Platform
• Contact Us submissions — name, email, phone number where you give one, message, and optional photos submitted via the Contact Us form. Available to both authenticated and unauthenticated users. For unauthenticated users, the IP address is used to enforce the daily submission limit
• Notices and complaints — if you notify us of illegal content or of an intellectual-property infringement (Terms of Service, Sections 7.8 and 8.3): your name and contact details, the links concerned, your explanation and the statements in the notice, and our decision. For an intellectual-property notice we send the seller a copy, including your contact details; for other notices we do not tell the person concerned who made them unless the law requires it
• Seller information — if we ask a seller to confirm who they are (Terms of Service, Section 4.5): identity and business details and the evidence the seller sends us. We do not keep identity documents: they are used only for that check and deleted within 30 days (Section 7.11)
• Your acceptance of our legal documents — which version of the Terms of Service and of this Privacy Policy you accepted, when you accepted it, and the language you were shown. We are required to be able to demonstrate this, and it is also how we know whether to ask you to review an updated document (Section 10)
• Reviews — when you review an item you bought, or (as a seller) review a buyer: the star ratings, the written comment, and any photos and video you add; a seller's reply to a review; and anything you submit in a review dispute — the reason, your explanation and photos, or your response and photos. Reviews of products are published (Section 5.6)
• Reports and appeals — when you report an order, a shop, or a product, or appeal a suspension or ban (Section 7 of the Terms of Service): the reason you choose, your description, any photos you add, and the messages and photos you exchange with our moderators. If a report is made about you and we ask you for information, the messages and photos you send us in reply. Who can see them is set out in Section 5.7
• Custom requests — when you ask a seller to make something to order (Section 6.8 of the Terms of Service): the title and description you write, any images you attach, which of that seller's items you point at, and the timeframe you ask for. If the seller declines, the reason they give. We do not ask for, and the request does not carry, your contact details — the seller gets those only when you contact them yourself or place an order. Who can see a request is set out in Section 5.1

• Shop name, description, and location (country, city)
• Banner and logo photos
• Social network links
• Messenger contacts (Telegram, Viber, WhatsApp) — optional
• Payment details for manual payment (bank transfer or Payoneer details) — stored securely and shown to the buyer only after an order is placed
• Payment-partner credentials (Western Bid) — stored encrypted and never shown to anyone, including buyers
• Return address
• Order processing schedule, delivery profiles, cancellation and return/exchange policy

• Photos, videos, and descriptions of products listed by sellers
• Variations, personalisation options, and order instructions
• Order history — statuses, tracking numbers, prices, payment method
• Buyer shipping address is shared with the seller after an order is placed
• Which order and order item each review belongs to — only the parties to a completed order can review it
• For each report: a copy of the order, shop, or product it refers to, taken when the report is filed so the record survives if that item is later changed or deleted (for an order, its number, total, status, and date and the names of the buyer and the shop); the names of the parties as they were at the time; who at Craftic handled the report and every action taken on it; its outcome; and, where it led to a suspension or ban, a link between the two

• Technical data — device type, browser, operating system
• IP address — for security and fraud prevention, to work out the approximate country you are visiting from, and to rate-limit requests that anyone can make (one-time-code requests, Contact Us submissions). Your IP address is never sent to a geolocation provider: the country lookup runs against a database held on our own servers (Section 5.3). That country decides two things: whether you are shown the cookie banner (Section 8.3), and whether you can use the Platform at all — access is refused from the sanctioned and embargoed locations listed in Section 2.4 of the Terms of Service and, by Craftic's own decision for now, from the United Kingdom (also listed there). The result is used for that decision and is not stored against your account
• Session data — authentication tokens (AWS Cognito)
• Activity logs — Platform actions for error detection and fraud prevention
• Web-server logs — your IP address, the address you requested, and the time, kept for 30 days for security and fault-finding
• Marketing attribution — if you arrive on Craftic through one of our advertisements or campaign links, the campaign parameters in that link (utm_source, utm_medium, utm_campaign, utm_content, utm_term) are kept in your browser for up to 90 days and, if you go on to create an account, stored once on that account. It tells us which campaign brought a person to Craftic. It contains no information you typed and does not directly identify you, but once it is stored with your account it is personal data; it is never overwritten by a later visit, and we do not share the copy we keep with anyone (the tools in Section 5.3 do receive the address of the page you arrive on). This only happens while Marketing is switched on for you (in the EEA and Switzerland, only after you accept it — Section 8.3); otherwise nothing is kept and nothing is stored on your account

• AWS Cognito — authentication and session management
• AWS SES — delivery of email messages (OTP, notifications)
• AWS S3 — storage of uploaded files (photos, videos)
• AWS DynamoDB — short-lived storage of one-time codes and of the counters that rate-limit requests
• Western Bid — the result of a card payment: our order number, whether it succeeded, and the amount

• Registration, login, and OTP-based authentication
• Displaying and filtering products based on the buyer's country
• Order processing — passing the shipping address to the seller, tracking statuses
• Determining delivery type (domestic or international) based on the user's country
• Displaying units of measurement (currently metric only)
• Publishing reviews, calculating product, shop, and buyer ratings, moderating reviews, and deciding review disputes
• Handling reports and appeals — reviewing them, asking the parties for information, deciding them, and applying the outcome to the account, shop, product, or review concerned
• Checking who sellers are when the law or our payment partner requires it, and applying the country restrictions in Section 2.4 of the Terms of Service

• Sending OTP codes for login and action confirmation
• Notifications about order statuses and updates
• Sending payment details or instructions to the buyer after an order is placed (for non-instant payment methods)
• Sending automatic 72-hour unpaid order reminders to both buyer and seller while an order remains in unpaid status
• Review notifications — when a review is left about your product or about you, when a seller replies to your review, when a review is disputed, and when a dispute is decided — and a reminder three days before the 30-day window to review a completed order closes, which is not sent if you have already left your reviews
• Report notifications — to the person who made a report, when it is received, when its status changes, and when it is decided; and to the reported party, when we ask it for information and when the report is decided
• Statements of reasons when we block content or restrict an account, and our replies to notices and appeals (Terms of Service, Section 7)
• Responding to support requests

• Detecting and preventing fraud and abuse
• Limiting OTP request frequency (brute-force protection)
• Keeping the Platform safe and enforcing our Terms of Service — including limiting how many reports an account can file, identifying reports that misuse the reporting system, and taking a party's earlier reports, warnings, suspensions, and bans into account when deciding a new report
• Complying with legal requirements when applicable requests are received

• Analysing technical errors and failures
• Understanding how the Platform is used; where analytics is switched on for you, these events may be linked to a pseudonymous account identifier (Section 8.2)

• Craftic may at its sole discretion select and feature product photos on the Platform's official social media pages without additional approval from the seller — based on the licence granted upon content upload (Section 8.1 of the Terms of Service). Sellers may not demand that a specific product be featured.
• Measuring which advertising campaigns bring people to Craftic, so we can tell what our advertising spend actually achieves (Section 2.4, marketing attribution).

After an order is placed, the seller receives access to:

• Your delivery address
• Your name, email address, telephone number (if you gave one), profile photo (if you set one), and country, as they are in your profile when you order
• Order details — products, variations, personalisation, quantity

Sellers do not have access to your payment card details or to the rest of your profile.

Sellers are responsible for what they do with this data. A seller receives it as an independent controller, not on Craftic's behalf. Our Terms of Service require sellers to use it only to fulfil your order and to meet their legal duties, not to market to you without your agreement, and to keep it secure (Terms, Section 4.7). You can exercise your rights over that data directly against the seller. Sellers are, for now, located in Ukraine (Section 6.4).

A seller also sees the reviews buyers leave on its products and, when you order from that seller, your buyer rating and the reviews other sellers have left about you (Section 5.6).

If you send a seller a custom request, that seller sees your name and profile photo (if you set one), what you wrote, the images you attached and the items of theirs you pointed at. It does not give them your email address, your phone number or your address. If they take the request on, we email you the contact details that seller has chosen to publish, so you know where the conversation continues; that conversation happens between the two of you, away from Craftic, and we do not see it.

Separately from any order, a seller can see aggregate statistics about their own shop — how many times their shop page and their products were opened over a chosen period, and how many of those visits resulted in an order. These figures are counts only. They are derived from the analytics data described in Section 5.3 and contain nothing that identifies an individual visitor: a seller cannot tell who viewed their shop, and cannot connect a visit to a person or to an account. Only visitors for whom analytics is switched on are counted (Section 8.3), so these figures are lower than the shop's real traffic.

Buyers can see a shop's public information. Seller messenger contact details are only visible to authenticated users.

To operate the Platform, we use the following third-party services. Each has its own privacy policy, and where data goes outside the EEA the safeguards are in Section 6.4.

• AWS Cognito — authentication and session management (aws.amazon.com/privacy)
• AWS SES — delivery of email messages
• AWS S3 — file storage (photos, videos)
• AWS DynamoDB — short-lived storage of one-time codes and rate-limit counters
• MaxMind GeoLite2 — the database we use to work out the approximate country an IP address is in, so we know whether to show you a cookie consent banner (Section 8.3) and whether access is refused from a restricted location (Terms of Service, Section 2.4). We download the database and query it on our own servers: your IP address is never sent to MaxMind, and MaxMind receives no data about you. This product includes GeoLite2 data created by MaxMind, available from maxmind.com
• DigitalOcean — application servers and database hosting (digitalocean.com/legal/privacy-policy). Our web servers also keep access logs — IP address, the address requested, and the time — for 30 days
• Western Bid, Inc. (Florida, United States) — card payments (PayPal / Stripe). When you pay by card, our server prepares a payment form and your browser sends it to Western Bid. It contains your first and last name, email address, telephone number (if you have one), and delivery address, the names of and links to the items, the amount, our order number, and the seller's Western Bid merchant ID. Western Bid says in its own terms that it acts as merchant of record for the charge, and it is a controller in its own right of the data it handles for the payment, verification, and fraud prevention; it stores that data in the United States and passes it to PayPal, Stripe, banks, and others as needed. After the payment it tells our server, in a server-to-server message, the order number, the result and the amount. Craftic never receives or stores your card details. Paying by card is optional wherever the seller offers another payment method (westernbid.com/privacy-policy)
• PayPal and Stripe — reached through Western Bid when you pay by card; they receive what you enter on their pages and apply their own privacy policies
• Slack — internal alerts for our team. When an error occurs, a message goes to a private Slack workspace that only our team can read. It contains the error text, the identifiers of the account, shop, or order concerned and, for an unexpected error, technical details of the request: its address, your IP address, and your browser and device identification. It never contains passwords, sign-in tokens, or cookies (slack.com/trust/privacy/privacy-policy)
• Datadog — logging and observability (EU region). No longer receives data from the Platform as of September 9, 2026; the entry is retained here because logs sent before that date remain subject to Datadog's own retention (datadoghq.com/legal/privacy)
• PostHog — product analytics and error logging (EU region hosting). From visitors for whom analytics is switched on (Section 8.3) it receives the address and title of the pages you view, your clicks — which it records automatically (autocapture), except on the pages listed in Section 8.2 — and other usage events, and device and browser information; and, when you are signed in, your account ID, so that your activity can be linked together. We do not use PostHog's session recording (replay). Separately, and on the basis of our legitimate interest in keeping the Platform working rather than on consent, it also receives technical error and operational logs: the address and method of the request, error text, the account's identifier where there is one, and technical details such as your IP address and browser identification. Sensitive data (tokens, payment details, one-time codes) is redacted before any log is sent (posthog.com/privacy)
• Google Analytics 4 (GA4) — website traffic and marketing-attribution analytics, operated by Google Ireland Limited. Receives the same category of data as PostHog, from visitors for whom analytics is switched on, except the search words you type; when you are signed in it also receives your account ID. Data may be processed in the United States (policies.google.com/privacy)
• Meta Pixel and Meta Conversions API — advertising measurement for our Facebook and Instagram ad campaigns, operated by Meta Platforms Ireland Limited. Receives the address of the pages you view and Platform events from visitors for whom marketing is switched on (Section 8.3). When you place an order, we additionally send a purchase confirmation (the Conversions API "Purchase" event) directly from our servers, containing a hashed (pseudonymised) form of your email address — which Meta can match to a Meta account — the Meta identifiers stored in your browser (_fbp and _fbc), your IP address and your browser's user agent. This purchase confirmation is sent only when Marketing is switched on for you. These are used only to match the purchase to a Meta account and to the advertisement that led to it; we never send your email address to Meta in readable form. Craftic does not use Meta's advanced matching, and the search words you type are not sent to Meta. Some of this data is routed through a gateway endpoint operated by Meta before reaching Meta's own systems. Data may be processed in the United States. Craftic and Meta Platforms Ireland Limited are joint controllers for the collection of this data on our site and its transmission to Meta: under Meta's controller addendum we are responsible for asking for your consent and for telling you about that collection and transmission, and Meta is responsible for its own use of the data once it has it, including answering requests about it. You can use your rights against either of us (facebook.com/privacy/policy)
• Professional advisers and a successor operator — our lawyers, accountants, and similar advisers, under a duty of confidentiality; and any company to which the operation of the Platform is transferred (Terms of Service, Section 14.4), which takes over this Policy with the data.

AWS, DigitalOcean, PostHog, and Slack process data on our instructions under data-processing terms, and we remain responsible for the data we entrust to them. Western Bid, PayPal, Stripe, Google, and Meta also handle data for their own purposes under their own privacy policies, which we do not control. When passing data to these services, we act solely based on the operational needs of the Platform.

We may disclose data if required by law, court order, or a request from an authorised government body — including Ukrainian law-enforcement and other public authorities, and authorities of other countries where the request is lawful and we are bound to comply. In such cases we will attempt to notify you unless prohibited by law.

Craftic's moderators can see every review and every review dispute.

• Reviews of products are public. Anyone who opens a product page or a shop page — signed in or not — can see the reviewer's first name, their profile photo, the ratings, the comment, the photos and video, when the review was published, and the seller's reply. The reviewer's last name, email address, and order details are not shown
• Reviews of buyers are not public. A seller's review of a buyer is shown only to that buyer and to sellers with whom the buyer places an order, together with the buyer's rating — the average score and the number of such reviews from all sellers — and the reviews themselves, with the name of the shop that wrote each. Other buyers and visitors never see it
• Review disputes — the reason, explanation, photos, and response submitted in a dispute are seen by the two parties to the review and by Craftic's moderators. The decision is shared with both parties; the moderator's internal notes are not. Photos submitted in a dispute are never public
• A review removed after a dispute is no longer shown publicly and no longer counts toward any rating; both parties can still see it, together with the decision, in their account. A review hidden by moderation is shown only to its author

Craftic's moderators and administrators can see every report and appeal, both message threads, and the record of how each was handled. Each party's thread with our moderators is private — neither party ever sees the other's.

• If you make a report, the party you report never sees your description, your photos, your messages, or your name. If we contact that party or decide the report, it sees the reason for the report, a summary of the complaint written by our moderator, any request we make of it and its deadline, and the outcome. Where a report concerns an order, that party knows who is on the other side of the order and may therefore be able to work out who made the report. You see the status of your report and whether action was taken, but not which action
• If a report is made about you, you see it only once we ask you for information or decide it; a report we close without contacting you is never shown to you. What you send us in reply is seen by our moderators and administrators, never by the person who made the report
• Moderators' internal notes on a report are not shared with either party

Everything we store ourselves is stored in Frankfurt, Germany — inside the European Economic Area:

• AWS (region eu-central-1, Frankfurt) — authentication, files (photos, videos), email delivery, one-time codes
• DigitalOcean (region FRA1, Frankfurt) — application servers and the main database

Craftic itself is operated from Ukraine, so the small number of people who run the Platform access that data from Ukraine in order to operate and support it. Access is limited to what each person needs to do their job. AWS and DigitalOcean are companies whose parent companies are in the United States; they act for us under data-processing terms, and Section 6.4 explains the safeguards. The third-party services listed in Section 5.3 may process data elsewhere, on the terms described there.

The Platform is accessible at craftic.shop.

• HTTPS encryption for all traffic
• OTP-based verification for sensitive account actions
• Payment details (a seller's Payoneer address, bank transfer details, and Western Bid credentials) are encrypted when stored and never exposed to unauthorised parties
• Direct access to file storage is restricted; public content (product photos, shop banners and logos, review media) is shown on the Platform according to its visibility settings
• Industry-standard security headers and policies applied across the Platform

• Active account — data is retained for as long as the account is active
• After account finalisation — personal profile data is erased at once: name, date of birth, shipping address, avatar, preferences, favourites, notification settings, and marketing attribution. All active sessions are revoked
• Email address and phone number — kept in a deactivated record for two years after account deletion, then erased. If the account was banned, they are kept for as long as the ban remains in force. The purpose is to stop anyone — in particular someone we have banned, or who is using deletion to get around a ban — from registering again with the same details; they are not used for anything else
• Order records — the name and contact details you gave for an order, the delivery details, the items, prices, status history, and the payment method are kept for three years after the order ended (completed, cancelled, or returned) — longer while a dispute, complaint, claim, or legal duty about it is open — and then erased or anonymised. We keep them to answer disputes and claims, to prevent fraud, and so that the seller's records and ours agree. They are not erased when your profile is erased
• Shop records — a closed shop's information (its description, contact and return details, delivery and payment settings) is kept for three years after the shop closes, and then erased. The shop's credentials for our payment partner (Western Bid) are the exception: they are deleted when the shop is closed
• Moderation records — where content is blocked for breaching our Terms, we keep a copy of that content as it stood at the time, together with the reason, the date, and who made the decision, for three years after the decision (for a ban that remains in force, for as long as it does). They are the record of the decision and of any appeal, are kept after the content or the account is deleted, and are used for no other purpose
• Reports and appeals — the report or appeal, its reason, description, photos, and messages, the copy of the order, shop, product, or review it refers to, the names of the parties as they were at the time, the moderators' internal notes, the outcome, and the record of who handled it and every action taken, are kept for three years after the report is closed, on the same basis as moderation records (they survive the content or account concerned being deleted, and are used for no other purpose)
• Reviews — published reviews, sellers' replies, and their ratings, photos, and videos are kept after the author's account is deleted, because they form part of other users' orders and of product, shop, and buyer ratings. When your profile is erased, reviews you wrote stop showing your name and profile photo. Reviews removed after a dispute or hidden by moderation are kept as the record of that decision. You can ask us to remove personal information from the text of a review you wrote (Section 7.10)
• Review disputes — the reason, explanation, photos, response, decision, and the moderator's internal notes are kept for as long as the review they concern, as the record of the decision
• Record of your acceptance of our legal documents — the version, date, and language of each acceptance is kept for as long as the account exists and for three years after it is deleted. It is the evidence of what you were shown and accepted, and is used for no other purpose
• Marketing attribution — erased with the rest of your profile when your account is finalised. The copy held in your browser expires after 90 days on its own, is deleted the moment you withdraw marketing consent, and can be cleared at any time by clearing this site's data
• Contact Us submissions — kept for two years after we have answered your enquiry, including where you wrote to us without an account
• Logs — web-server access logs are kept for 30 days; error and operational logs for up to 90 days
• Analytics data — event data held by PostHog and Google Analytics is kept for no longer than 14 months

Deleted data can remain in encrypted backups for up to 30 days; we do not use backups for anything else. Deleted files (such as photos) may also remain in content-delivery-network and browser caches for a short time after deletion. Where the law requires us to keep something for longer — for example to answer a lawful request from an authority — we keep it only for that purpose.

Craftic is operated from Ukraine, and the European Commission has not adopted an adequacy decision for Ukraine. Where personal data leaves the EEA, this is how we deal with it:

• The people who run Craftic (Ukraine). They access data stored in Frankfurt from Ukraine, as our own staff (Section 6.1)
• Sellers (currently in Ukraine). When you place an order, your delivery and contact details go to the seller so that it can fulfil your order. We send only what the seller needs for that, and the transfer is necessary to carry out the order you asked for. Sellers are bound by our Terms of Service to use the data only for the order (Terms, Section 4.7)
• Western Bid, Inc. (United States). If you pay by card, the data in Section 5.3 goes to Western Bid, because it is necessary to carry out the payment you chose. You can avoid this by paying another way where the seller offers one
• Google, Meta, PostHog, Amazon Web Services, and DigitalOcean. They state that they take part in the EU–U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795). If that framework is invalidated or a provider is not covered by it, we rely on the standard contractual clauses in the provider's data-processing terms (Commission Decision (EU) 2021/914). Slack, used for our internal alerts, acts for us under its own data-processing terms

Under Ukrainian law, data may be sent abroad where you have given your unambiguous consent to the transfer or where it is necessary to perform a contract in your interest; that is the basis for the transfers to sellers and to Western Bid. You can ask us for a copy of the safeguards at support@craftic.shop.

You may request a copy of all personal data we hold about you, and information about where it came from, why we process it, and who receives it.

You can update most of your data directly in your profile settings. For corrections to other data, please contact support.

You may delete your account via your profile settings, subject to OTP verification. You may also ask us to erase other personal data we hold about you; we will, unless we must or may keep it — for example to meet a legal obligation or to establish, exercise, or defend legal claims. Account deletion does not automatically result in the deletion of all data — please refer to Section 6.3 for retention conditions.

When we correct or erase data we tell the recipients we disclosed it to (such as a seller), unless that is impossible or would take disproportionate effort; you can ask us who they are.

You may request that processing of your data be suspended in certain circumstances — for example, while we review a complaint about the accuracy of your data.

You may request your data in a structured, machine-readable format.

Where we process your data on the basis of our legitimate interest — security, fraud prevention, technical and operational logs, showing your buyer rating and reviews to sellers, keeping published reviews after account deletion, keeping the contact details of a deleted account for a limited time, and handling reports (Section 4) — you may object at any time, on grounds relating to your particular situation. We will stop unless we can show compelling legitimate grounds that override your interests, or the processing is needed to establish, exercise, or defend legal claims.

Where we process your data for direct marketing, you may object at any time and we will stop, with no exception and no need to give a reason.

Where we rely on your consent — analytics and marketing cookies, and any marketing emails we may send in future — you may withdraw it at any time. Cookie consent is withdrawn through the "Cookie settings" link in the footer, which is available on every page, to every visitor, in every country (Section 8.3). Withdrawing consent is as easy as giving it, and does not affect the lawfulness of anything done before you withdrew it.

We do not make decisions about you that produce legal effects or similarly significantly affect you by automated means alone, and we do not profile you for that purpose. The one exception is the automatic country check in Section 2.4 of the Terms of Service; if you think it is wrong, write to us and a person will review it. Where content is blocked or an account is restricted, the decision is made by a person, that person's reasons are sent to you, and you may challenge the decision — see Section 7 of the Terms of Service. A review dispute is also decided by a person, and both parties are told the outcome (Section 6.6 of the Terms of Service). Every report and every appeal against a suspension or ban is decided by a person; a moderator can only recommend a suspension or ban, which an administrator then decides, and an appeal is decided by a senior administrator. A suspension ends automatically at the time set in that person's decision. Your buyer rating is the average of the reviews sellers have left about you; Craftic does not use it to make any decision about you, and whether to sell to you remains each seller's own decision.

Most actions are available directly in your profile settings. For other requests, write to support@craftic.shop. We answer within one month of receiving your request (within 30 calendar days where Ukrainian law applies to it); where the GDPR allows, we may extend that period for a complex request and will tell you why. We do not charge for this, and we may ask you to confirm your identity before acting on a request about an account.

Under Ukrainian law you also have the right to know the sources and location of your data, the purpose of the processing, and who receives it; to make reservations limiting the processing when you give consent; and to know how any automated processing works.

If you are unhappy with how we have handled your personal data or a request, you can complain to us at support@craftic.shop; we acknowledge a complaint within 30 days at the latest (we aim for five working days — Section 11) and tell you the outcome without undue delay. If you are in the EEA, you also have the right to lodge a complaint with the data protection supervisory authority of the country where you live, where you work, or where you believe the problem happened. If you are in Ukraine, you may complain to the Ukrainian Parliament Commissioner for Human Rights (the Ombudsman) or go to court. You do not have to contact us before contacting them.

Wherever you live, we give you these core rights over your personal data: to know what we collect, use, and disclose; to access it and obtain a copy; to correct it; to delete it; to opt out of the "sale" or "sharing" of it, or of its use for targeted advertising; to appeal our decision on your request; and not to be treated worse for using your rights. We do not ask for special categories of personal data (such as data about your health or religion). We do process the financial data needed for payments: sellers' Western Bid credentials (stored encrypted) and the bank or payment details sellers choose to show buyers for manual payment. We do not store identity documents: if we ask a seller to confirm who they are (Terms of Service, Section 4.5), the documents are used only for that check and deleted within 30 days. Where the privacy law of your state or country applies to us it may give you more, and we comply with it.

• What we collect and why. In the last 12 months we have collected, from you, from sellers and buyers, and from your devices: identifiers (name, email address, account ID, IP address); customer records (delivery address, telephone number); commercial information (your orders); internet activity (pages you viewed, clicks, search words); approximate location (country, from your IP address); photos and videos you upload; and, for sellers, shop and payment-setup information. Sections 2 and 3 explain each and why we collect it; Section 5 lists who receives it; Section 6.3 says how long we keep it
• Sale, sharing, and advertising. We do not sell personal data for money. When the Meta Pixel and Google Analytics run, their operators receive data about your visit, which some laws treat as "sharing" for targeted advertising. To opt out, use the "Cookie settings" link in the footer (Section 8.3). We also honour a Global Privacy Control signal from your browser as an opt-out of Marketing (Section 8.3)
• How to use your rights. Write to support@craftic.shop, or ask an authorised agent to write for you. We will verify your identity, answer within the time in Section 7.10 (where a US state law applies, it allows 45 days, which can be extended once by a further 45 days, and we will tell you if we need that), and, if we refuse, explain why and how to appeal. Appeal by replying to our answer; you may then complain to your state's Attorney General or data protection authority

These are necessary for the Platform to function and are always active — they cannot be turned off:

• Authorization, Authorization-Refresh, Authorization-User — HttpOnly cookies (web) that keep you signed in and authenticate your requests. They stay in your browser until they expire — the first when your access token does, the other two after 7 days — or until you sign out
• theme (localStorage) — remembers your light/dark display preference. Never leaves your device
• craftic_recent_searches (localStorage) — your recent search queries, for the search bar's history dropdown. Never leaves your device; clearable at any time via the dropdown itself
• craftic_rows_per_page (localStorage) — remembers how many rows per page you chose for your order lists. Never leaves your device
• craftic_consent_choice / craftic_consent_region (localStorage) — remembers the cookie choice you make below, whether your visit needs the consent banner shown at all (Section 8.3), and the country your connection comes from (used to open the Platform in Ukrainian for visitors in Ukraine). They stay on your device; your current choice is sent to our servers with each request, as a short header, so that we know whether we may send analytics events from our servers (Section 8.4), but we do not store it
• NEXT_LOCALE (cookie) — remembers the language the Platform is shown in, set when a visitor in Ukraine is switched to Ukrainian. Kept for up to one year; it holds only the language code

These load only if they are switched on for you (Section 8.3) — in the EEA and Switzerland, after you accept them; elsewhere, until you turn them off. They fall into two categories, Analytics and Marketing; the marketing-attribution item below belongs to Marketing:

• Analytics — PostHog (EU-hosted) and Google Analytics 4 set cookies and other identifiers (for example ones named ph_… and _ga) and record how the Platform is used: the pages you view, your clicks (PostHog records them automatically), and the features you use, so we can find and fix problems and improve the Platform. PostHog also receives the search words you type; they are not sent to Google Analytics or Meta. When you are signed in, they are linked to your account ID (a pseudonymous identifier), but not to your name or email address
• Marketing — the Meta Pixel sets cookies/identifiers (for example _fbp and _fbc) to measure the effectiveness of our advertising on Facebook and Instagram. These include a browser identifier and, if you reached us by clicking one of our advertisements, a record of that click. It also receives the address of the pages you view. Where you place an order, these identifiers are also included in the purchase confirmation we send from our servers, so that the order can be matched to the advertisement that led to it
• Marketing attribution — craftic_first_touch_utm (localStorage) records the campaign parameters of the link you first arrived through, so we can tell which advertisement brought you to Craftic (Section 2.4). It holds nothing you typed and does not directly identify you, but once it is stored with your account it is personal data. It stays on your device unless you create an account, and expires after 90 days. It is written only while Marketing is switched on for you, and is deleted immediately if you switch it off

Whatever your choice, Google Analytics and Meta are not used on your account pages, the sign-in and sign-up pages, the cart and checkout, or the Contact Us form. On those pages PostHog receives only the events we send ourselves (for example, that checkout was started or completed) and does not record your clicks automatically. The page addresses we send to Google Analytics and Meta leave out anything after the "?", except the campaign parameters described above and the ad-click identifiers (gclid, fbclid).

GA4 and Meta are both US-headquartered; where they process data from visitors in the EEA or Switzerland, the safeguards are described in Section 6.4. PostHog is EU-hosted.

If you are visiting from the EEA or Switzerland, you will see a consent banner on your first visit. Analytics and Marketing are both off by default until you choose to accept them, reject them, or customise each category separately.

If you are visiting from anywhere else, Analytics and Marketing are on by default and no banner is shown — you can turn either off at any time from the "Cookie settings" link in the footer. This is also how California residents can exercise their right to opt out of the sale/sharing of personal information ("Do Not Sell or Share My Personal Information"). If your browser sends a Global Privacy Control signal and you have not made a choice yourself, we treat it as a refusal of Marketing. We do not read "Do Not Track" signals.

The "Cookie settings" link is available to every visitor, everywhere, at any time.

We work out which of these applies to you from the approximate country of your IP address, looked up in a database held on our own servers (Section 5.3). If we cannot work out your country — the lookup cannot resolve your address, our service does not answer, or you use a VPN or proxy that hides your location — we show you the banner, and Analytics and Marketing stay off until you choose. If you believe you should have been asked and were not, use the "Cookie settings" link and set your preferences directly.

The required cookies in Section 8.1 stay active regardless of your choice — you can always sign in, place orders, and use the Platform normally. Declining Analytics or Marketing only stops those specific tools from loading.

When you withdraw consent, our own code stops sending events to the tool at once, but the tool's own script — which is already loaded in your browser — only stops completely the next time a page loads. Cookies it has already set stay in your browser until they expire or you delete them; you can clear them in your browser settings.

Server-side business records — such as when an order is created, an account is verified, or a moderation action is taken — are not cookies and are not affected by this choice. They are the Platform's own transactional record of your account's activity, kept under Sections 3 and 4 (contract performance / legitimate interest), not cookie consent.