Privacy Policy

Effective November 11, 2026. This Privacy Policy explains how AILABIKA SL (VAT ESB56298987, C/ Laguna, 11, 03184 Torrevieja, Alicante, Spain; "CRAFTALLER", "we", "us") collects, uses and shares information when you use https://craftaller.com (the "Site"). We are the data controller. The Site is offered in English and Polish and is intended for adults aged 18 and over.

What we collect

• Information you give us: the requests and messages you type into the assistant, the intents you add or remove, and the country you select.
• Device and usage information collected automatically: IP address, browser and device type, pages viewed, offers clicked, approximate location derived from your IP address, referring URL and campaign parameters (such as utm_* tags and advertising click identifiers).
• Identifiers: a cookie that stores your cookie choice and, only if you accept analytics, a randomly generated visitor cookie used to count unique visits and clicks.
• The product finder does not ask for your name, email address, payment details or account credentials, and needs no account. The club needs an account with your email address; see the club section below.

Storefronts are public

Each request you send creates a storefront: a page with its own link that shows your request, the assistant’s replies and the selected offers. Anyone with the link can open it, we may promote storefronts through advertising (for example Google Ads), and storefronts we promote may be indexed by search engines. Do not include your name, contact details or other personal information in your requests. To have a storefront removed, email us its link.

How we use information

• To provide the Site: understand your request, search the catalogue, build and publish storefronts and continue the conversation.
• To generate the assistant’s intents, replies and product notes. Your messages and the conversation so far are sent to Anthropic, PBC (Claude) as our processor; under its commercial terms Anthropic does not use this data to train its models.
• To find and show offers through our advertising partner Zyntent. To show offers available in your country, we send your IP address (or the country you choose) with each catalogue search.
• To count storefront views and clicks, decide which storefronts to promote and measure the advertising that brings visitors to the Site.
• To enforce usage limits, prevent abuse and comply with law.

How we share information

• Service providers acting on our instructions: hosting, AI processing (Anthropic; OpenAI for search over the experts’ memory), payments (Stripe) and email (Resend). They may only use the information to provide services to us.
• Analytics: only if you accept analytics, the Site loads PostHog (PostHog, Inc., United States) to measure pages viewed and clicks. PostHog receives the page address, the referring page, browser and device information and a random identifier; it is set to discard your IP address. PostHog acts as our processor.
• Advertising partner: every offer is a link through Zyntent. Catalogue searches include your IP address or chosen country and the search phrases built from your request. When you click an offer you are redirected to the merchant through Zyntent’s tracking link; Zyntent and the merchant receive your IP address and browser information as part of the redirect and are governed by their own privacy policies.
• Legal and safety: to comply with law, enforce our terms or protect rights, property or safety.
• Business transfers: as part of a merger, acquisition or sale of assets, subject to this policy.
• We do not sell personal information for money. Some US state laws may treat passing your IP address or click information to an advertising partner as "sharing"; see Your Privacy Choices.

Cookies and similar technologies

• consent — strictly necessary; remembers whether you chose "Accept all" or "Essential only" (12 months).
• theme — set only when you use the theme switch; remembers the light or dark theme you chose (12 months).
• vid — analytics, set only after you accept; a random identifier used to count unique visitors and clicks on storefronts (12 months).
• ph_<project key>_posthog — analytics by PostHog, set only after you accept; a random identifier kept in a cookie and in your browser’s local storage to recognise repeat visits (12 months). Removed when you choose "Essential only".
• Zyntent and merchants may set their own cookies when you click an offer and leave the Site.
• You can change your choice at any time via "Cookie settings" or "Your Privacy Choices" in the footer, and delete cookies in your browser.

The club: account, conversations and experts

• Account: your email address, used to send one-time sign-in links through our email provider Resend; the language you chose; your sign-in sessions.
• Payments for token packs are processed by Stripe. Stripe asks for your billing address to apply VAT. We receive the payment status, the amount and the VAT in it, a reference and the country of your billing address, which we keep with the payment for the tax records the law requires; we never receive your card details.
• What you keep in the club: your taste profile (axes and notes), your collection, your conversations with experts, reviews you choose to publish, your token balance and the experts you keep.
• To answer you, an expert receives your message, the recent conversation, your taste profile and collection. They are sent to Anthropic (Claude) as our processor and are not used to train its models. To find the expert’s memories closest to your message, the message is also sent to OpenAI (text embeddings) as our processor, which does not use API data to train its models either. Nothing from your conversations is added to the memory of an expert.
• Letters from the experts you keep are sent to your email address through Resend; you can stop them on the expert’s page.
• You can clear a conversation and change or delete your taste profile at any time.

Deleting your profile; how long club data is kept

Club data is kept while your profile is open. On your account page you can delete the profile: we email you a link, and the deletion happens only after you open it and confirm. Then your conversations, letters, taste profile, collection, reviews, expert requests and feedback are deleted at once, every sign-in session ends, and the profile can no longer be used or signed in to. Your email address, payments and token records stay, because we need them for refunds and accounting. To delete them as well, write to technical support at retuames@gmail.com: we remove your email address and keep payment records only as accounting law requires.

Your choices and rights

• Withdraw consent or opt out: use "Your Privacy Choices" in the footer. We also honor the Global Privacy Control (GPC) signal as an opt-out for that browser.
• Under the GDPR you have the right to access, rectify and erase your data, to restrict or object to processing, to data portability and to withdraw consent at any time. For the product finder we hold no account details, so tell us the storefront links or the approximate time of your requests; club members can write from the email address of their account.
• Requests and questions: email retuames@gmail.com. We respond within one month (45 days for requests under US state laws) and will not discriminate against you for exercising your rights.
• You may lodge a complaint with the Spanish supervisory authority (Agencia Española de Protección de Datos, www.aepd.es) or with your local authority, such as UODO in Poland or the ICO in the United Kingdom.

Legal bases (GDPR)

We are established in the European Union, so the GDPR applies to our processing. We rely on: performance of the service you request (processing your requests, catalogue searches, building and publishing storefronts); your consent for the analytics cookie (you can withdraw it at any time); and our legitimate interests in localising offers, securing the Site, preventing abuse, deciding which storefronts to promote and earning the commissions that keep the Site free, balanced against your rights. You may object to processing based on legitimate interests. Transfers to providers outside the European Economic Area, such as Anthropic in the United States, rely on the EU-US Data Privacy Framework where the provider is certified and otherwise on Standard Contractual Clauses.

State privacy notices (United States)

California (CCPA/CPRA) and other states with comprehensive privacy laws: we collect the categories described above (identifiers, internet activity, approximate geolocation, the content of your requests) for the purposes described, disclose them to service providers and may "share" IP addresses and click information with our advertising partner. We do not use sensitive personal information and do not knowingly sell or share the personal information of consumers under 16. You have the rights to access, delete, correct, obtain a copy and opt out of targeted advertising, sale and profiling.

Children

The Site is not directed to children and we do not knowingly collect their personal information. If you believe a child has provided information to us, contact retuames@gmail.com and we will delete it.

Retention

Conversation records are deleted 12 months after they are created. View and click records are deleted after 24 months. Storefronts stay online until we remove them or you ask us to remove one.

Security

We use HTTPS, access controls and least-privilege keys. No method of transmission is perfectly secure.

Changes and contact

We will post any changes on this page with a new effective date. Contact: AILABIKA SL, C/ Laguna, 11, 03184 Torrevieja, Alicante, Spain, retuames@gmail.com.