Craft Agent
Privacy Policy
1. Information We Collect
When you use Craft Agent, we collect information you provide directly, including:
- Account information: Email address, name, and the identifier from the sign-in method you use (Sign in with Apple, Sign in with Google, or email and password on the iOS and Android apps).
- Workflow data: Workflows you create, edit, import, and share within the app.
- Usage data and analytics: Execution logs, token usage, and performance metrics associated with your workflows.
- Device information: Device tokens for push notifications, device type, and operating system version.
- Voice and audio data: If you use Voice AI nodes, audio input and generated speech are processed in real time and are not stored on our servers after processing.
- User-generated content: Workflows you publicly share through our community marketplace, including titles, descriptions, and tags.
- Third-party integration data: When you connect services like Google Workspace, we store OAuth tokens securely and access only the data necessary to perform the actions you configure.
- Billing identifiers: For web purchases we receive Polar customer/order identifiers, the product purchased, and the email used at checkout. We do not store full payment card numbers.
2. Authentication
You can sign in with Apple, with Google, or with an email and password on the iOS and Android apps.
- Apple: Apple gives us a unique user identifier and, if you allow it, your name and email. We do not receive your Apple ID password. See Apple’s Privacy Policy.
- Google: Google gives us your Google account identifier, name, and email. We do not receive your Google password. See Google’s Privacy Policy.
- Email and password: We store your email and an Argon2 password hash. We do not store the password itself.
3. How We Use Information
We use the information we collect to:
- Provide, maintain, and improve our services
- Process your transactions, manage subscriptions, and send related billing information
- Send notifications about workflow executions, subscription reminders, credit balance alerts, and service updates
- Facilitate workflow sharing and community features
- Send technical notices, support messages, and promotional campaigns (with your consent)
- Respond to your comments and questions
- Monitor and prevent abuse of the platform
Where the UK GDPR or the EU GDPR applies, we use these legal bases:
- Contract: creating your account, running workflows, and providing the plan you bought.
- Legitimate interests: securing the service, preventing abuse, and keeping short operational logs. You can object where the law allows.
- Consent: optional marketing messages and Google Ads cookies. You can withdraw consent at any time. See our Cookie Policy.
- Legal obligation: records Polar must keep as merchant of record for tax and accounting.
4. Payments (Polar)
Web subscriptions and credit top-ups on craftagent.io are sold through our Merchant of Record, Polar (Polar Software Inc. / polar.sh). Polar processes payment, may charge applicable sales tax/VAT, and issues the customer receipt.
When you pay on the web, Polar may collect your name, email address, billing address, payment method details, and transaction identifiers in order to process the purchase. Polar’s use of that information is governed by Polar’s Privacy Policy. We receive confirmation of payment, Polar customer/order identifiers, the product purchased, and the email used at checkout so we can provision credits and manage your subscription.
We do not store full payment card numbers on our servers.
Purchases made inside the iOS or Android apps are billed by Apple or Google. Payment data for those purchases is handled under Apple’s Privacy Policy or Google’s Privacy Policy.
See also our Refund Policy.
5. Social Media & Messaging Integrations
Craft Agent allows you to connect third-party social media and messaging accounts. When you authorize an integration, we store OAuth tokens or bot tokens securely. We access only the data needed to run the workflows you configure. You can revoke any integration at any time through the respective platform’s settings or within Craft Agent.
Integrations may include Instagram (Meta), Twitter (X), Discord, Slack, Telegram, TikTok, GitHub, and Google Workspace (Docs, Calendar, Sheets, Meet). Use of those features is also subject to the provider’s own privacy policy.
We do not store your original media files on our servers. We only store the necessary tokens and metadata required to facilitate the automated workflows you create.
6. AI & Voice Services
Craft Agent integrates with AI model providers (primarily through OpenRouter) to process your workflows. Your prompts and workflow inputs are sent to third-party AI services for processing. You may also connect your own OpenRouter API key (Bring Your Own Key); this key is stored securely and encrypted at rest.
Voice AI features are powered by ElevenLabs. Audio data is transmitted to ElevenLabs for processing and is subject to ElevenLabs’ Privacy Policy. Audio is processed in real time and is not permanently stored on our servers.
7. Push Notifications
We may use Apple Push Notification service (APNs) and equivalent Android services to send notifications to your device. We store device tokens to deliver notifications about workflow activity, subscription reminders, credit balance, and occasional service updates. You can manage notification preferences in the app or on your device.
8. Workflow Sharing & Community
When you share a workflow publicly, its name, description, tags, and structure become visible. Other users may clone it. Sensitive data (API keys, OAuth tokens, and credentials) are automatically stripped before a workflow is shared or cloned. You can unshare a workflow at any time.
9. Webhooks & External Connections
When you configure a webhook or URL node, data from your workflow may be sent to external servers that you designate. We are not responsible for the privacy practices of those external services.
10. Data Storage & Security
Your data is stored on cloud servers. We use industry-standard encryption for data in transit (TLS) and at rest. OAuth tokens and API keys are encoded before storage. Temporary session data is stored with automatic expiration.
11. Data Retention
We retain your data for as long as your account is active. We reserve the right to delete account data and expire credits if an account remains inactive (no login or API usage) for a continuous period of 24 months. You can delete your account and associated data (including connected-account tokens) in the web app under Settings, or by emailing [email protected].
12. Children’s Privacy
Craft Agent is not directed at children. You must be at least 13, or older if the law where you live sets a higher age to use an online service. We do not knowingly collect personal information from anyone under that age. If you believe we have, contact [email protected] and we will delete it.
13. International Data Transfers
AdamCodes Ltd is the controller for account and workflow data. Some providers (including cloud hosting, Cloudflare, Apple, Google, Polar, OpenRouter, and ElevenLabs) may process data outside the UK or EEA. Where the UK GDPR or EU GDPR requires a transfer tool and no adequacy decision applies, we use the contractual safeguard that law requires, such as the UK International Data Transfer Addendum or EU Standard Contractual Clauses. Email [email protected] if you want the safeguard that applies to a specific provider.
14. Cookies
craftagent.io and app.craftagent.io use strictly necessary cookies (sign-in, security, and remembering your cookie choice) and, only if you accept, Google Ads cookies to measure campaigns. Details, a cookie list, and how to change your choice are in our Cookie Policy.
15. Your Rights
Where the UK GDPR or EU GDPR applies, you can ask us to access, correct, delete, or restrict your personal data, to receive a portable copy, and to object to processing based on legitimate interests, including direct marketing. You can withdraw consent for ads cookies and marketing messages without affecting sign-in. You can complain to the UK Information Commissioner’s Office (ico.org.uk) or to the supervisory authority where you live. Contact [email protected].
16. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes through the app or via email. Continued use after changes constitutes acceptance.
17. Contact Us
If you have questions about this Privacy Policy, please contact us at [email protected].