Privacy Policy

Kraffsy is operated by Equatris LLC, a company organized under the laws of the State of Wyoming, USA, with a registered address at 30 N Gould St #49134, Sheridan, WY 82801. We serve users globally, including in the United States, the European Economic Area, the United Kingdom, and Türkiye. If you have questions about this policy or our privacy practices, contact us at support@kraffsy.com.

We collect several categories of information. Account and profile data: your email address, name, interface language, and timezone, stored in your account profile; your password is handled directly by Supabase Auth, our authentication provider, and we never see it in plaintext, and we do not currently offer social sign-in or two-factor authentication. Billing data: subscription payments are processed by Stripe, which acts as merchant of record, so we do not collect or store your full card number; we retain your subscription status, plan, invoice metadata, and billing currency, and Stripe and its payment partner Link issue receipts and invoices for your subscription on our behalf. Wallet data: top-ups to your Kraffsy wallet arrive by bank transfer at our bank, Mercury; for each transfer we receive the sender's name, the amount, the date and the transfer's description, and we keep your wallet balance and history. Company details: the company name, contact name, address and tax ID you enter in Settings, which we print on your receipts. Production orders: for each order you send to production, the recipient's name and shipping address, the order's items and the receipt we issue for it. Content you provide for generation: product identifiers (SKUs) and related details; for each product, an inspiration image you upload; and any text or reference images you add when editing a design — this content is used solely as an input to generate your designs and mockups. Generated assets: the AI-generated designs, mockups, images, and videos we create for you are stored privately in Cloudflare R2, our cloud storage provider, with short-lived, access-controlled links. Etsy shop data: when you connect your Etsy shop, the listing, shop and order data described in Your Etsy Shop Connection below. Usage and technical data: device and browser information, log data, and error and performance diagnostics. Cookies: we use essential cookies needed to keep you signed in and to operate the service; see our Cookie Policy for details.

We use your information to operate the Kraffsy platform and the design-and-mockup generation pipeline; with your connected Etsy shop, to publish your listings and to manage your orders, send them to production and follow their shipping; to process payments and manage your subscription, credit balance and wallet — including matching the bank transfers you send to your wallet — and to issue receipts; to provide customer support; to maintain the security of the service, prevent abuse, and enforce rate limits; to comply with our legal obligations; and to send you transactional service email, such as billing receipts, order and shipping updates, and account notifications.

If you are located in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases: performance of a contract, to provide the service you have signed up for; our legitimate interests, such as keeping the service secure and improving it; your consent, where we specifically ask for it; and compliance with our legal obligations.

We do not sell your personal data. We share information with service providers who process it on our behalf, under contractual confidentiality and data-protection obligations: Supabase (authentication and database hosting), Vercel (application hosting), Inngest (background job processing), Cloudflare R2 (private storage for your uploads and generated assets), Upstash (rate limiting), Stripe and Link (payment processing, tax and receipts for subscriptions — Stripe acts as merchant of record for subscriptions), Mercury (our bank, which receives wallet top-ups by bank transfer), Resend (transactional email delivery), Sentry (error and performance monitoring), Podbul, Inc. (73 Verdi St, Farmingdale, NY 11735, USA; printing and shipping orders), and third-party AI providers that process your generation inputs solely to analyze, generate, upscale, and refine your designs and mockups. When you send an order to production, we share its details and the recipient's name and shipping address with Podbul, our production partner, only so it can make and ship that order; for some products, Podbul may use other production providers it works with, including providers outside the United States, such as in the EU or UK, which receive the details needed to make and ship those products. See Your Etsy Shop Connection below. We may also disclose information where required by law, regulation, or legal process.

Connecting your Etsy shop is required to add products and use credits in Kraffsy. This section explains how we handle Etsy data. You connect by approving Kraffsy's access on Etsy's own authorization page (OAuth), so we never see your Etsy password. Kraffsy then accesses only what Etsy Listing and Order management need: the listing data we create or update for you, the shop settings needed to publish those listings (such as shipping profiles, return policies and shop sections), and the order details Etsy provides. We do not request buyers' email addresses. Each order you send to production carries its recipient's name and shipping address. We use this data only to publish your listings, manage your orders, send them to production and follow their shipping — and only for your shop.

Equatris LLC is the controller of your Kraffsy account data. For your buyers' personal data, we act as a service provider (processor) on your behalf: we process it only on your instructions and only to provide Kraffsy to you. We share an order's details and its shipping address with our production partner, Podbul, Inc. (Farmingdale, New York, USA), which prints and ships that order, only for that purpose; for some products, Podbul may have the order made by another production provider it works with, which may be outside the United States, including in the EU or UK. Etsy data is stored and processed with the providers that run Kraffsy — Supabase (database), Vercel (hosting), Inngest (background processing) and Sentry (error monitoring, which may capture limited technical details if something fails) — under the obligations described in Sharing & Sub-Processors. We never sell Etsy data or use it for advertising, we never contact your buyers, and we never use Etsy data to train AI models. If you bought from a shop that uses Kraffsy, please contact that shop with questions about your data; we will help it respond.

We keep Etsy data only while your shop is connected and only for as long as we need it for these purposes. We delete an order's buyer name and shipping address 90 days after the order is closed — delivered, cancelled, or its lost-package claim resolved, whichever applies — once the windows for reporting problems with it have closed, unless the law requires us to keep a longer record. You can disconnect your shop at any time from Settings in Kraffsy, or by removing Kraffsy's access in your Etsy account settings. When you disconnect, we stop accessing your shop, delete the access Etsy granted us, and delete the Etsy data we hold, including buyer names and shipping addresses, within 30 days, unless the law requires us to keep a record for longer. Deleting your Kraffsy account also disconnects your shop, and your Etsy data is then deleted in the same way.

We are based in the United States, and your information may be processed in the United States and in other countries where our service providers operate. Where we transfer personal data out of the European Economic Area, the United Kingdom, or other regions with data-transfer restrictions, we rely on appropriate safeguards, such as Standard Contractual Clauses, to protect your information.

We retain your account data for as long as your account remains active. You can delete your account at any time from Settings; this triggers a soft delete, and your data is kept for up to 30 days, during which you may restore your account, after which it is permanently deleted. After that we keep only a one-way hash of the email address the account was created with, so that the one-time initial credit grant isn't given to the same address again; it can't be turned back into your address. Generated designs, mockups, and packages are removed by automated retention processes in line with this policy. Etsy data is kept and deleted as described in Your Etsy Shop Connection above. The recipient's name and shipping address on a production order and its receipt are removed 90 days after the order is closed. Billing, wallet and receipt records may be retained for a longer period where required by law or by our payment processor.

If you are in the European Economic Area or the United Kingdom, data protection law (GDPR) gives you the right to access, correct, erase, or restrict the use of your personal data, to receive a copy of it in a portable format, to object to certain processing, to withdraw consent at any time, and to lodge a complaint with your local supervisory authority. If you are a California resident, the CCPA/CPRA gives you the right to know what personal information we collect, to access and delete it, to correct inaccuracies, and to opt out of the 'sale' or 'sharing' of personal information — we do not sell or share your personal information, and we will not discriminate against you for exercising any of these rights. If you are in Türkiye, Article 11 of the Personal Data Protection Law (KVKK) gives you the right to learn whether your personal data is processed, to request information about that processing, and to request correction or deletion of your data, among other related rights. To exercise any of these rights, contact us at support@kraffsy.com; many actions, such as updating your profile or deleting your account, are also available directly from Settings.

We protect your information using row-level security on our database so accounts can only access their own data, encryption in transit via HTTPS and HSTS, private object storage with short-lived, access-controlled links, secure httpOnly session cookies, and ongoing monitoring for errors and abuse.

Kraffsy is not directed to children, and we do not knowingly collect personal data from children under 16 in the European Economic Area or under 18 elsewhere. If you believe a child has provided us with personal data, please contact us at support@kraffsy.com so we can delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. When we make material changes, we will update the 'Last updated' date at the top of this page, and where appropriate we will provide additional notice. If a translation of this Privacy Policy conflicts with the English version, the English version prevails.

If you have questions about this Privacy Policy or how we handle your information, contact us at support@kraffsy.com or by mail at Equatris LLC, 30 N Gould St #49134, Sheridan, WY 82801, USA.