Last updated: 3 October 2026
This policy explains what personal data CraftRoq (“we”) collects when you use www.craftroq.com (the Store), portal.craftroq.com (the Portal) and our WordPress plugins, why we collect it, and your choices. We are based in India. For privacy questions or requests, email [email protected].
What we collect
When you buy or create an account
- Name, email address and billing address.
- Order details: products, plan, price, order and refund history.
- Payment status. Card and bank details go straight to the payment provider — we never receive them.
When you use the Portal
- Your email address, to send one-time sign-in links and license emails.
- Security logs: sign-in times, IP address and browser, used to protect your account.
When a CraftRoq Pro plugin is activated on a site
- The site’s domain and the IP address of the server it runs on.
- The plugin, WordPress and PHP versions.
- Activation and license-check dates.
Plugins send this to portal.craftroq.com to activate, check and update licenses. They do not send content from your site or any data about your site’s visitors.
When you contact us
- Your email and anything you include in your message.
When you browse the Store
- Essential cookies for the cart, checkout and sign-in.
- If you accept cookies: first-party cookies that record how you found us (for example a search engine or a campaign link). These are linked to your order, never shared with advertisers. See the Cookie Policy.
- Standard server and security logs (IP address, browser, pages requested) kept by our hosting and security providers.
Why we use it
| Purpose | Legal basis |
|---|---|
| Processing orders, issuing and renewing licenses, delivering downloads and updates | Performing our contract with you |
| Sending license keys, receipts, renewal reminders and security notices | Performing our contract with you |
| Detecting fraud, payment disputes and license-key sharing; protecting accounts | Our legitimate interest in keeping our service secure |
| Keeping accounting and tax records | Legal obligation |
| Understanding which sources bring customers (order attribution) | Your consent — only if you accept cookies |
| Answering support requests | Performing our contract, or our legitimate interest |
We do not sell your personal data, and we do not use it for advertising profiles.
Who we share it with
Only service providers who help us run CraftRoq, under their own privacy and security commitments:
- Hostinger — hosting for the Store and Portal.
- Cloudflare — content delivery and security (all traffic passes through Cloudflare).
- Our email provider — to deliver sign-in links, license and order emails.
- Payment providers — to take payments and issue refunds.
We may also disclose data where the law requires it. Some providers process data outside India; where that happens we rely on their contractual safeguards.
How long we keep it
- Orders and invoices: as long as tax and accounting law requires.
- License and activation records: for as long as the license exists, then for a reasonable period to handle renewals, refunds and disputes.
- Security audit logs: up to 12 months.
- Payment webhook logs: up to 90 days.
- Support emails: as long as needed to help you, then deleted or anonymised.
Your rights
Depending on where you live (including under India’s Digital Personal Data Protection Act, 2023 and the EU/UK GDPR), you can ask to access, correct, export or delete your personal data, object to or restrict certain uses, and withdraw consent at any time. Email [email protected] from the address on your account. We may need to keep some records — for example invoices — where the law requires it. You can also complain to your local data protection authority.
Security
We protect your data with encrypted connections, hashed license keys, two-factor authentication for staff and other measures described on our Security page.
Children
Our services are for businesses and professionals and are not intended for children under 18.
Changes
We will update this page when our practices change and revise the “last updated” date. If a change is significant, we will tell customers by email.