Confidentiality policy

Version in force on May 6, 2025

‍Welcome to Craft AI!
We know that your privacy is important and we are committed to protecting it. This privacy policy explains, in a clear and simple way, how we collect, use, and protect your personal data when you use our generative artificial intelligence services on our platform.


1. Who is collecting your data?
‍
1.1. Craft AI is the data controller
‍
Craft AI is the data controller responsible for the processing of your personal data. This means Craft AI is the entity that decides how and why your personal data is collected and used. Craft AI is a French company registered in Paris, under the number 811719715, whose head office is located at 34 rue Guersant, 75017 Paris (“we” or “us” or “Craft AI”).
Contact us: Using the accessible contact form hither. By mail: Craft AI, 34 rue Guersant, 75017 Paris, France.

1.2. Craft AI as a subcontractor
‍
If you use our services to process personal data in the context of your professional activities, you are the data controller and Craft AI is the subcontractor. This means that you decide how and why personal data is processed, and that we process that data on your behalf and according to your instructions in order to provide you with the Services.
The Privacy Policy only covers data processing that we carry out as a data controller. It does not apply to processing that we carry out on your behalf as a data processor, which is governed by our data protection agreement.
‍
‍
2. What data do we collect?
‍
2.1. Personal data that you provide to us directly

- Identity, account and contact data, when you create your account on our platform to use our Services;
- Payment and billing information, when you subscribe to our paid Services;
- Input and Output Data. This is the data that you provide to services to generate a result, such as your prompts or shared documents as well as the results. If you add personal data to your Input Data, we will have access to that personal data;

2.2. Personal data generated by your use of our Services
‍
When you use our Services, we automatically collect the following information:
- Security logs;
- Technical information such as your IP address for example;
- Output data. This is content generated by our Services based on your Input Data. If you include personal data in your Input Data, this personal data may be reproduced within the Output Data.

2.3. Personal data provided to us indirectly

Third-party content. When you use our web search tool, we may show content from third parties on our chatbot, such as links, thumbnails, or snippets. This content is displayed to help you better understand the Output Data. If you include personal data in your Input Data, that personal data may also appear in third party content.
‍
‍
3. Why do we use your personal data?
‍
We use your personal data to:
- To provide and improve our Services;
- Administer and secure our Services;
- Carry out marketing operations;
- Manage your commercial relationship with us;
- Settle disputes between Craft AI and you;
- Respond to your requests concerning your personal data.

If you want to know more about why we use your personal data, you can find more details below.

3.1. To provide and improve our Services
‍
For users acting as consumers:
- Craft AI account management: Create and manage your Craft AI account.
- Provide you with the Services on our chatbot, including: Generating Output Data and displaying third party content based on your Input Data. View the history of your conversations (Input Data, Output Data, and Third-Party Content).
- Provide you with the Services on the Craft AI Platform, including: Enabling you to train your models based on your data. Allow you to create artificial intelligence applications based on your models. Allow you to create and manage your agents. Allow you to control the operation of your applications in production and to debug if necessary by inspecting the logs.
- Technical Support: Respond to and manage your support requests, including the correction of errors or bugs related to your use of our Services.

Legal basis: The execution of the contract between you and Craft AI.
‍
For all users:
- Service improvement: generate aggregated and anonymous statistics on the use of the Services in order to improve their functionality and performance.

Legal basis: Our legitimate interest in continuously improving the Services.
‍
3.2. Administer and secure our Services
‍
We use your personal data for the following purposes:
- Security management: manage the security of our Services;
- Non-commercial communications. Communicate with you for non-commercial purposes, for example: To inform you of the temporary unavailability or disruptions of our Services; to send you important updates or information related to your Craft AI account or the Services.
- Management of cookies. Use cookies and similar technologies to improve your user experience.

Legal basis: Our legitimate interest in providing secure Services and ensuring a quality user experience. Your consent for cookies that are not technically necessary.

3.3. Carry out marketing operations
‍
We use your personal data for the following marketing activities:
- Newsletters (newsletters). Sending our newsletters containing updates and information about our Services.
- Development of prospects. Identify and manage potential business opportunities.
- Invitations to events. Invite you to our events and webinars.

Legal basis: Your consent, for the sending of our newsletters. You can withdraw your consent at any time by unsubscribing. Our legitimate interest, for the development of prospects and invitations to events, which helps us to promote our services and to develop our business.

3.4. Manage your business relationship with us
‍
We use your personal data for commercial management purposes:
- Contract management. Administer and manage our contractual relationship with you.
- Invoicing. Generate and send invoices for fees applicable to our services.
- Payment processing. We process your payments to ensure accurate and timely billing.

Legal basis: The execution of the contract between you and Craft AI. Comply with our legal obligations in terms of billing for our services.

3.5. Resolve disputes between Craft AI and you

We use your personal data for the following purposes:
- Dispute resolution: Investigating and resolving any disputes that may arise from your use of the services.
- Contract performance: To enforce our contract, including actions such as suspending your account.

Legal basis: Our legitimate interest in protecting and exercising our legal rights. The execution of the agreement between you and Craft AI.

3.6. Respond to your requests concerning your personal data
‍
We use your personal data to respond to your requests to exercise your rights over your personal data.

Legal basis: Our legal obligation to respond to your requests.


4. Cookies

4.1. What is a cookie?
‍
‍A cookie is a small text file that is temporarily stored on your device (such as a computer, tablet, smartphone, or any other type of device) when you access our website or our Services. These cookies allow us to distinguish you from other users, remember your preferences, and analyze how you interact with our Services in order to improve them. These cookies do not identify you directly, but they do offer you a more personalized web experience.

4.2. What types of cookies do we use?

‍These cookies are generally activated in response to your actions, such as configuring privacy settings, accessing your account, or information relating to a form that you have completed. These cookies do not collect or store any information that could identify you personally. During our first visit to our website or your first use of our services, a banner will ask you to accept or refuse cookies that are not strictly necessary for the functioning of the website, categorized by type of cookie. Under this banner, you will find a list of cookies that may be placed on your device. You have several options for controlling and managing cookies through this banner. Blocking cookies may affect your experience and limit access to certain parts of our website or services. You can change your cookie preferences at any time by clicking on the “Cookies” button at the bottom right of your screen. You can also change your cookie preferences directly from your browser.

‍Google Analytics Cookies: _ga, _gid, _gat, _gac_ <property-id>
Purpose: We use these cookies to quantify visits and measure the performance of our website.
Privacy policy: https://business.safety.google/adscookies/
Vendor: Google
Domain name: craft.ai ‍


5. How long do we keep your personal data for?
‍
We keep your personal data for as long as necessary for the purposes described in article 3 of this Privacy Policy. Sometimes we may keep them for longer if required by law or as part of legal proceedings. For example, here are the applicable data retention periods:

5.1. Data we use to provide and improve services

- Craft AI account data: for as long as you are registered and one year after deleting your account, in accordance with our legal obligations.
- On the chatbot: We keep your Input Data, Output Data and metadata in an identifying form until you delete your account.
- On the Craft AI Platform: We keep all data and models imported and generated with the Platform until you delete them from The Platform or delete your account.
- Technical support data: We keep your data until your support request is processed and for 5 years for archiving purposes.

5.2. Data we use to administer and manage the security of the services

- Security data: Security logs are kept for a rolling year.
- Cookies: As long as you consent to their use.

5.3. The data we use to manage your business relationship with us

- Contracts: duration of the contract and 5 years from the date of termination.
- Invoices: For 10 years from the end of the accounting year.

5.4. Data we use for marketing

- Contact data: until you unsubscribe from our newsletter.
- Identity and contact data of prospects: for 3 years from collection.
- B2B customer data: for the duration of the contract and for three years after the end of the contract.

5.5. Data used for dispute resolution

Until the end of the appeal period, provided that we may keep this data for longer for archiving purposes.

5.6. Data that we use to respond to your requests to exercise your rights

For the duration of the processing of the request and for the six (6) years following the request.


6. Who has access to your personal data?

We may transfer your personal data to the following parties, only to the extent that these parties need to know your personal data to carry out their mission:
- The members of our team. Authorized members of our teams who need access to perform their missions.
- Financial institutions. Banks and other financial organizations.
- Regulatory authorities. Such as the National Commission for Informatics and Freedoms (CNIL).
- Legal and professional services. Where appropriate, we may share data with competent courts, mediators, mediators, accountants, auditors, lawyers, bailiffs and debt collection agencies.

In addition, we may share some or all of your personal data with our suppliers. Before engaging with a supplier, we conduct audits to ensure that they meet our privacy and security standards, and we sign a specific data protection agreement with them. Our main suppliers are

Google Cloud Platform:
Purpose: Cloud infrastructure
Data location: France

Amazon Web Services:
Purpose: Cloud infrastructure
Data location: Ireland

S3NS:
Purpose: Cloud infrastructure
Data location: Netherlands

Scaleway:
Purpose: Cloud infrastructure
Data location: France
‍

7. Where is your personal data stored?

We have selected suppliers within the European Union who strictly adhere to data protection regulations (GDPR). All data is therefore stored within the European Union in the following countries: France, Ireland, Netherlands.

8. Your rights

You can exercise the following rights at any time:
- Right of access. You have the right to know whether we are processing your personal data. You also have the right to request a copy of this personal data and to obtain further information about how we handle your personal data.
- Right to rectification. You have the right to update or correct your personal data.
- Right to deletion. You have the right to delete and/or ask us to delete your personal data.
- Right to object. You have the right to object to the processing of your personal data. This right does not apply when we have a legal obligation to process your personal data.
- Right to withdraw your consent. You have the right to withdraw your consent to the processing of your personal data at any time.
- Right to the limitation of treatment. You have the right to ask us to freeze the processing of your personal data.
- Right not to be the subject of a fully automated decision. You have the right not to be subject to an automated decision (including profiling) and to appeal such a decision. Craft AI does not use profiling or automated decision-making in the context of the processing of personal data.
- Right to portability. You have the right to obtain and transfer your personal data to another entity.
- Post-mortem. You have the right to tell us how you want us to handle your personal data after your death.
- File a complaint. You have the right to file a complaint with the competent data protection authority, including the Commission Nationale de l'Informatique et des Libertés (CNIL). We will do everything we can to accommodate your requests.

You can exercise these rights: By using the accessible contact form hither. By sending us a letter to Craft AI, to the attention of the privacy team: Craft AI, 34 rue Guersant, 75017 Paris, France.


9. Update
‍
We may change this Privacy Policy from time to time as our services continue to evolve. Please be sure to review this privacy policy regularly.

Version effective on May 6, 2025