Privacy Policy

1. Introduction

At Craftology ("Craftology," "we," "us"), operated by ICVR LLC, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use craftology.io and the Craftology platform (the "Service"). It also explains your rights and how to exercise them. Please read it carefully.

2. Who We Are (Controller)

ICVR LLC is the controller of your personal data. You can contact us at:

• Email: privacy@craftology.io
• Postal address: ICVR LLC, 501 S Beverly Dr., Beverly Hills, CA 90212, USA
• EU representative (GDPR Art. 27): Contentment GmbH, Englbergweg 24b, 84036 Landshut, Germany. UK representative: not applicable at this time; we are in the process of appointing one
• Data Protection Officer: not appointed; privacy contact above

3. Information We Collect

• Account information — name, email address, password.
• Content — the prompts, uploads, and creative work you generate or store (“User Content”). For creative and studio users this often includes highly sensitive material such as character bibles, story and script material, look-development assets, likeness references, unreleased media, and generated assets. We treat this material as confidential and among the most sensitive data we hold, and protect it accordingly — even where it is not “personal data” in the narrow sense of privacy law.
• Payment information — processed by our payment provider; we do not store full card numbers.
• Usage and device data — log data, IP address, device and browser information, interactions.
• Communications — messages you send us.
• Waitlist information — your email address, waitlist position, and referral activity when you join the waitlist.
• Cookies and similar technologies — Website analytics, Session recording (Hotjar) & Advertising pixel (Meta), for more details and consent mechanism see our Cookie Policy.

4. How We Use Your Information, and Our Legal Basis

We process personal data for the purposes below. Under the GDPR, each purpose has a legal basis:

Where we rely on legitimate interests, we balance those interests against your rights and you may object (Section 8).

5. AI Processing and Model Training

Craftology uses AI models to generate content from your inputs. The prompts and content you submit are processed to deliver outputs to you and may be shared with our AI inference subprocessors solely to provide the Service. We do not use your private User Content to train our own or third parties' AI models without your explicit, opt-in permission. We do not subject you to decisions producing legal or similarly significant effects based solely on automated processing without a lawful basis and appropriate safeguards (GDPR Art. 22). Outputs may carry machine-readable AI-generation and provenance markings; see the Content Policy.

Provenance records. If you generate a provenance record (an "Asset Birth Certificate"), we record and store the associated generation metadata — the prompts and input files you used, the model applied, and a reference to the resulting Output — so you can view or export how the asset was created. Where your prompts or inputs contain personal data, that data forms part of the provenance record.

6. Data Retention

We keep personal data only as long as necessary for the purposes above:

• Account data: for the life of your account, then deleted or anonymized within 90 days of closure.
• User Content: until you delete it or close your account, subject to short-term backup retention of up to 30 days.
• Payment/billing records: as required by tax and accounting law (typically 7 years).
• Logs: typically 12 months.
• Waitlist data: until you create an account, ask us to remove you, or the waitlist closes.
• Provenance records (“Asset Birth Certificate”): a provenance record is tied to its asset and to your account. It is retained for as long as you keep the associated asset or account, so the record stays available to you. When you delete the asset or close your account, the associated provenance record is deleted or anonymized on the same schedule as the underlying User Content (within 90 days), except that we may retain a provenance record for longer where (a) you have exported or shared it (that copy is outside our control), (b) it is subject to a legal hold or required by law, or (c) it is needed to resolve a dispute, enforce our terms, or support a rights-management or audit obligation you have asked us to maintain. We do not retain provenance records for our own independent purposes after the asset is deleted. When you exercise a deletion or erasure right under Section 8, we apply that right to the personal data in the associated provenance record on the same basis.

7. How We Share Information

We do not sell your personal data. We share it only with:

• Subprocessors that help us run the Service — see our Subprocessors.
• Professional advisers, authorities where required by law or to protect rights and prevent fraud.
• A successor in the event of a merger, acquisition, or asset sale, subject to this Policy.
• Providers of analytics, advertising, waitlist, and email services used on our website (such as Google, Hotjar, Meta, and Viral Loops), as described in our Cookie Policy.

Meta Pixel. Where the Meta Pixel is active on our website, ICVR LLC and Meta Platforms Ireland Ltd. are joint controllers for the collection of data through the Pixel and its transmission to Meta. We are responsible for informing you and, where required, obtaining your consent; Meta is responsible for its subsequent processing. You can exercise your rights with either of us. See Meta's Controller Addendum and Privacy Policy.

Business customers may enter our Data Processing Addendum.

8. Your Rights

Depending on where you live, you have the right to: access, rectify, erase, restrict processing, object to processing (including direct marketing), data portability, and to withdraw consent at any time. You also have the right to lodge a complaint with your supervisory authority (in the EU/UK) or applicable regulator. To exercise any right, email privacy@craftology.io. We will respond within the timeframes required by law (generally one month under GDPR).

California residents (CCPA/CPRA) have rights to know, delete, correct, and opt out of "sharing"/"sale"; we do not sell personal information. Our website uses the Meta Pixel, which may constitute "sharing" for cross-context behavioral advertising. You can opt out at any time using the methods described in Section 6 of our Cookie Policy, or by enabling Global Privacy Control, which we honor.

9. International Data Transfers

We are based in the United States and may process data outside your country. Where we transfer personal data from the EU/UK to a country without an adequacy decision, we use appropriate safeguards such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, with supplementary measures as needed. Contact us for a copy of the relevant safeguards.

10. Data Security

We implement appropriate technical and organizational measures — including encryption in transit and at rest, access controls, logging, and personnel confidentiality — to protect your data. See our Trust Center and Technical & Organizational Measures ("TOMs") published at craftology.io/security-measures. No method of transmission or storage is completely secure.

We treat your creative User Content — including prompts, references, unreleased scripts and media, look-development assets, and generated output — as highly confidential, and apply the same technical and organizational safeguards to it as we do to personal data, regardless of whether it constitutes personal data under applicable law.

11. Data Breaches

If a personal data breach is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours where required, and affected users without undue delay where the risk is high.

12. Cookies and Tracking

We use cookies and similar technologies as described in our Cookie Policy, and obtain consent for non-essential cookies where required.

13. Children's Privacy

The Service is not intended for children. We do not knowingly collect data from children under 13 (United States) or under the applicable digital-consent age (13–16) in the EU/UK. If you believe a child has provided us data, contact privacy@craftology.io and we will delete it.

14. Changes to This Policy

We may update this Policy and will revise the "Last updated" date; material changes will be notified as required.

15. Contact Us

Questions or requests: privacy@craftology.io.