LegalPrivacy Policy
Last updated October 2026.
Data controller
CraftKept is operated by JPJ Consulting Piotr Krupa, Marsa Street 22A/13, 80-299 Gdańsk, Poland (NIP 581-190-17-74). For the purposes of GDPR and other privacy laws, we're the "data controller" responsible for the personal data described in this policy — the entity that decides what's collected and why. Contact person: Piotr Krupa — reach us at hello@craftkept.com for any privacy question or to exercise any of the rights below.
Information we collect
- Account info: your email, password (handled by Supabase Auth — we never see or store it in plain text), your Etsy shop name if you give us one, your country and payout currency (required at signup — we can't calculate your Etsy fees correctly without them), and the currency you use for product costs.
- Your Etsy sales data: when you upload an Etsy Payments CSV, we read each order's number, date, currency, gross amount, and the fee breakdown Etsy already calculated. Never your buyers' names, addresses, or any other personal detail — Etsy's own payment export doesn't include them, so neither do we.
- Your product data: the product names, SKUs, and cost figures (material, labor, packaging) you enter — your own business information, not collected from anyone else.
- Billing information: handled entirely by Stripe. We never see or store your card number — only a reference ID and your subscription status, so we know your account is active.
- Contact form messages: if you write to us, we receive the name, email and message you submit.
How we use it
To calculate and display your fees, costs and profit; to work out the right fee categories and currency conversions for your country; to bill your subscription through Stripe and send related account/billing emails; and to respond when you contact us. We process this under our contract with you (providing the service you signed up for) and, for billing records, to meet our own legal obligations. We may also use your email to send you CraftKept's own product updates and marketing — based on our legitimate interest in telling existing users about the product — and every such email includes a one-click unsubscribe link. We don't sell or rent your data to anyone, and we don't use any automated decision-making or profiling that affects you.
Who we share it with
- Supabase — hosts our database and handles your login.
- Stripe — processes your subscription payment; they receive your card details directly, we never do.
- Zoho Mail — the inbox our contact form delivers to.
- Frankfurter / European Central Bank — a free public data source we query for historical currency exchange rates when converting your product costs between currencies; we only ever send a currency pair and a date, never anything about you.
- Google Fonts — loads the typefaces used on this site.
- Umami — cookieless website analytics (see "Cookies" below); it tells us things like which pages are visited and roughly how many people visit, never anything that identifies you personally.
- We don't share your data with any other company — including your email — for their own marketing or advertising purposes.
Cookies
- A login session cookie, so you stay signed in.
- A short-lived (10-second) notification cookie, used only to show a one-time confirmation message right after you save a change.
- We don't use advertising or tracking cookies. Our analytics (Umami) is cookieless by design — it counts visits and page views without setting any cookie or identifying you individually, which is why you won't see a cookie consent banner here: EU law only requires one for cookies that aren't strictly necessary, and we simply don't use any.
Import feedback (beta)
On the Import CSV page, you can optionally send us rows from your statement that our parser wasn't sure how to classify, to help us confirm how to read them correctly. This is entirely your choice — nothing is sent automatically. Before anything leaves your browser, product names, order and listing numbers, and the exact day are stripped out or replaced; we only ever receive the row type, amounts, currency, and the Etsy template text around them. We don't store your account, shop name, or email with this feedback — only if you explicitly check "write to me once this is confirmed" and enter an email do we keep that email, tracked completely separately from the anonymized rows.
Data storage & security
Your data is encrypted in transit (HTTPS) and at rest. Every query is scoped to your own account at the database level, so another seller can never see your imports, products or figures. We host with reputable cloud infrastructure providers rather than running our own servers.
Data retention
We keep your account data for as long as your account exists, including after a subscription lapses — so if you cancel and come back later, your past imports and product costs are still there. We don't quietly delete anything just because billing stopped. If you'd rather we deleted everything outright, see "Your rights" below.
Your rights
- Access — ask us for a copy of the personal data we hold about you.
- Rectification — ask us to correct anything inaccurate.
- Erasure — ask us to delete your account and everything in it (also known as the "right to be forgotten").
- Restriction — ask us to pause processing your data in certain circumstances.
- Objection — object to processing based on our legitimate interests, including marketing emails — unsubscribe via the link in any of them, or just email us.
- Portability — get your data in a usable format, or have it sent elsewhere. You can already do this yourself at any time, without asking, from the Tax Export page.
- Complaint — if you're in the EU, you can lodge a complaint with your local data protection authority; in Poland, that's the Prezes Urzędu Ochrony Danych Osobowych (UODO).
- Email us to exercise any of the rights above — we'll respond within 30 days, as GDPR requires. If you're in the EU or UK these are your rights under GDPR; we extend the same treatment to every seller regardless of where they're asking from.
International data transfers
Our infrastructure providers may process and store data outside your own country. Where that happens, we rely on their own standard safeguards — such as the EU's Standard Contractual Clauses — for transfers out of the EU/UK.
Children
CraftKept isn't intended for anyone under 18, consistent with our Terms of Service. We don't knowingly collect data from anyone underage.
Changes to this policy
If we make a material change, we'll email the address on your account before it takes effect.