Privacy policy

The controller for Craftbase's own processing described in this policy is Craftbase GmbH, Schorndorfer Straße 137, 71638 Ludwigsburg, Germany, represented by its managing director Kim Dominik Hintz.

You can send privacy enquiries and requests concerning your rights to support@craftbase.de. This general support address also handles privacy enquiries.

This policy covers craftbase.de, communications with Craftbase, and Craftbase's own processing in connection with the service at app.craftbase.de and the Craftbase mobile applications. Personal data is information relating to an identified or identifiable individual.

Craftbase acts as controller where it determines its own purposes and means, for example for prospective customer communications, contract administration, billing, and the security measures required for those activities.

For business content managed by a customer in Craftbase, the customer generally determines the purposes of processing. Craftbase acts as processor under Article 28 GDPR. Where the customer processes data on behalf of a third party, Craftbase may act as a further processor. The DPA and its annexes govern this processing, instructions, assistance, and subprocessors.

This policy does not replace the privacy information that a customer must provide to its employees, clients, or other affected individuals.

Where you are personally a party to a contract, or request steps before entering into one, necessary processing is based on Article 6(1)(b) GDPR. If you are a contact person for a business, business communications are generally based on Article 6(1)(f) GDPR; the legitimate interest is establishing and managing the relationship with that business.

Processing required by law is based on Article 6(1)(c) GDPR. Voluntary consent provides a basis under Article 6(1)(a) GDPR. Where Article 6(1)(f) GDPR applies, the interests and rights of the individuals concerned are taken into account.

Data primarily comes from your submissions, messages, contract and payment activities, or technical access to the service. Business contact information may also be supplied by your organisation, an authorised contact, or an appointment booking you initiated.

The information required for an enquiry, registration, or contract administration depends on the relevant activity. Without it, the corresponding service may not be available. Optional information and consent to advertising or optional analytics are not prerequisites for contacting Craftbase in general.

Accessing the website involves processing technically necessary connection and access data. This may include IP address, time, requested address or file, HTTP method and status, data volume, referrer, and browser, device, and operating-system information.

This processing enables delivery, stability, protection against misuse, and investigation of technical faults. It is based on Article 6(1)(f) GDPR; the legitimate interest is the secure and reliable operation of the website. Recipients are providers entrusted with hosting and technical operational support.

Access data is retained only as needed for its operational and security purposes. Information needed to investigate a specific incident may be preserved separately for that purpose; this retention ends afterwards unless another legal basis applies.

Craftbase uses Google Cloud and Firebase for technical operations, including Firebase Hosting, Firebase App Hosting, Cloud Run, Firebase Auth, and Firebase Data Connect. Google receives the data required for each service and is engaged as a subprocessor for customer data under the DPA.

Germany, particularly Frankfurt, is the principal data location for core data configured for that region. This does not apply universally to every service: hosting delivery, authentication, support, technical metadata, and further subprocessing may involve other locations.

When you contact Craftbase by email, telephone, or form, Craftbase processes your name, business contact details, company information, messages, and communication data needed to handle the enquiry. Support requests may also require technical information and content you provide to describe a fault.

The purposes are handling your enquiry, providing advice and support, and maintaining a record of communications. Article 6(1)(b) GDPR applies to enquiries concerning your own contract; Article 6(1)(f) GDPR generally applies to business contacts and other enquiries, reflecting the interest in appropriate business and support communications.

Recipients are the relevant Craftbase staff and providers used for communications and customer management. Access to customer data for a specific support case is limited to what is necessary and authorised under the DPA. Please do not send passwords or sensitive information that is not needed.

Enquiry data is kept for handling and necessary follow-up. Further retention requires a specific contractual, evidential, or statutory purpose; otherwise, the data is deleted.

Craftbase uses HubSpot to manage prospective and existing customer relationships. The intended functionality includes CRM, forms, and email communications. Processing depends on the contact channel you use and the functions enabled for it; recording a contact in the CRM does not automatically subscribe that person to marketing emails.

HubSpot receives the contact and communication data needed for those functions. Embedded forms may also generate technical connection data. Optional website tracking and individual measurement of email opens or clicks are distinct from handling a message and require their own legal basis.

Where you subscribe to newsletters or automated marketing emails, Craftbase processes your contact details, communication preferences, and necessary consent evidence to send them through HubSpot. Consent-based sending relies on Article 6(1)(a) GDPR. An enquiry or registration alone is not blanket consent to advertising.

Advertising Craftbase's own similar services to existing customers without separate consent is considered only where all requirements of section 7(3) of the German Act Against Unfair Competition (UWG) are met. The data protection basis is then Article 6(1)(f) GDPR, reflecting the legitimate interest in this limited existing-customer advertising.

You can withdraw consent at any time for the future and object to direct marketing, including through the unsubscribe option in the message or by emailing support@craftbase.de. Objection to direct marketing under Article 21(2) and (3) GDPR requires no explanation.

Unsubscribing ends the corresponding marketing use. Consent evidence and a necessary suppression record may be kept for the limited purposes of meeting proof requirements and preventing unwanted future messages. Individual open or click tracking requires its own legal basis; consent to receive emails does not automatically cover it.

The website's demo buttons currently open the external website cal.com. The booking service is not embedded. Connections to the external service occur only when you open it; the operator's privacy information explains its processing.

Where Craftbase receives booking data, names, company and contact information, appointment details, and matters you raise are processed to prepare, conduct, and follow up on the requested conversation. Article 6(1)(b) GDPR applies to steps before your own contract, or Article 6(1)(f) GDPR to business contacts.

Appointment data is retained for the meeting and necessary follow-up. If a business relationship follows, its retention criteria apply; data is deleted when no further purpose remains. Booking alone authorises neither newsletter sending nor recording a conversation.

Registration and sign-in take place at app.craftbase.de. Craftbase processes account, authentication, contact, company, and contract data needed to create accounts, authenticate users, manage access and plans, conclude contracts, and communicate. Necessary security and usage logs are also processed.

Necessary processing for individuals who are contract parties is based on Article 6(1)(b) GDPR. Business contacts and secure administration of the business relationship generally fall under Article 6(1)(f) GDPR. Statutory retention and evidence rely on Article 6(1)(c) GDPR where the specific obligation requires them.

Recipients are relevant Craftbase staff and providers used for authentication, operations, customer management, and billing. The customer determines individual users' permissions within its account through the available roles.

Account data is needed to use the service and manage the business relationship. Contract and evidential records may be kept afterwards for legal obligations or the pursuit or defence of specific claims. Ending application access therefore does not automatically delete all billing records.

Depending on enabled features, customers manage master data, contacts, projects and jobs, tasks, scheduling and working hours, absences, messages, quotes, invoices, and other documents. Individuals concerned may include employees, trainees and interns, including minors, contacts, clients, suppliers, and others recorded by the customer.

For this processing on the customer's behalf, the customer determines permitted purposes, legal bases, and permissions. Craftbase processes the data under documented instructions and the DPA, not for its own advertising or data trading. Rights requests concerning these records should generally go to the relevant customer; Craftbase assists under the DPA.

The absence feature may record sickness-related absence and therefore a limited health reference. Diagnoses and other special categories of data are not intended uses without a separate agreement and appropriate safeguards. Location or GPS processing requires a corresponding agreed feature that is actually enabled.

Issued invoices and documents are not silently overwritten or deleted while the service is used. These integrity safeguards do not establish unlimited retention after the contract ends; return and deletion follow the DPA and the criteria below.

Craftbase uses Stripe to bill and process payments for its own subscriptions. This does not cover payments between Craftbase customers and their clients. Stripe receives the information required for each payment and also processes certain data for its own obligations, including fraud prevention and legal requirements.

Payment details may be collected directly through Stripe's payment interface. Craftbase processes payment references, status, and invoice information needed for contracts, billing, and allocation. Scope and recipients depend on the chosen payment method; banks and other payment providers may be involved.

The OpenAI API is used for plan-dependent AI features. Processing occurs only when actively used or appropriately configured by authorised users. It involves the text, speech and audio inputs, images, or document content selected for the specific feature and necessary technical request data, not automatically a business's entire dataset.

Customer instructions and the DPA govern data processed on the customer's behalf. An AI provider may process customer data only after valid engagement as a subprocessor. Craftbase does not permit customer data to train its own generally available models or third-party models. Beta features require the designated voluntary opt-in.

AI output may be incorrect or incomplete and must be reviewed by a competent person before use. Using AI does not replace the responsible person's decisions and accountability. Processing locations and deletion depend on the specific API service and agreed terms, not solely on the location of Craftbase's database.

Sentry supports error diagnostics and performance measurement for the website and application. Processing may include error reports, technical events, loading and response times, and information about affected devices and program execution. The recipient is the provider engaged for Sentry.

Technical fault analysis is distinct from optional observation of usage. Where a feature requires consent or a separate permission for access to a device, it may be used only under those conditions. Session Replay, which reconstructs a usage session, is a separate feature and is not the same as error diagnostics or performance measurement.

The public website currently activates no optional analytics or marketing trackers. The selected light, dark, or system display mode is stored under the key “theme” in the browser's Local Storage. It remains until changed or removed with browser data.

Storing or accessing information on a device is assessed separately under section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Consent is required unless a statutory exception applies to transmission or a strictly necessary function explicitly requested by the user. Subsequent processing of personal data also needs a GDPR legal basis.

Consent-dependent functions may be enabled only after the corresponding consent. Your choice about optional analytics or advertising is distinct from sign-in, contracts, and necessary security functions. Consent can be withdrawn for the future; previously lawful processing is unaffected.

You can remove browser data through your browser's settings, which may also remove saved preferences. Storage used for authentication and sessions in the application is distinct from the public website's display preference.

Where Google Analytics 4 (GA4) is used on the website or in the application following the corresponding consent, it serves statistical analysis of visits, interactions, and technical usage patterns.

Depending on the configuration actually approved, technical device and browser details, times, visited pages or views, events, and pseudonymous analytics identifiers may be processed and sent to Google. Names, email addresses, messages, and customer or document content must not be sent as analytics events. Pseudonymous data is not automatically anonymous.

Consent-based analytics relies on Article 6(1)(a) GDPR; device access requiring consent additionally relies on section 25(1) TDDDG. Using Craftbase must not be conditional on consent to optional analytics. Consent must be considered in the appropriate context for the website and mobile application respectively.

Analytics identifiers and event data may be retained only for the approved analytics purpose and its necessary duration. Withdrawal ends corresponding further collection; existing data is handled according to its legal basis and deletion criteria. A technical consent mode does not replace valid consent.

Access is granted to relevant people at Craftbase and providers needed for each purpose, particularly Google Cloud/Firebase, HubSpot, Stripe, OpenAI, and Sentry within the scope described. Not every provider processes every category of data or acts in the same data protection role.

Processors are contractually engaged under Article 28 GDPR. For customer data, the DPA's subprocessor provisions and annex apply. Other recipients may include banks, professional advisers, courts, or authorities where a specific legal basis or obligation exists.

Even with regional data storage, support, metadata, or further subprocessing can involve processing outside the European Economic Area. Such transfers are subject to Articles 44 et seq. GDPR. Depending on the recipient, an applicable adequacy decision or appropriate safeguards, particularly EU Standard Contractual Clauses with necessary supplementary measures, may be relevant.

You can request information about recipients and transfer safeguards applicable to a particular activity, and a copy of those safeguards, through support@craftbase.de. Confidential information and other individuals' rights remain protected.

Retention depends on the data category and specific purpose. Personal data is deleted or anonymised when the purpose ends and no other legal basis supports continued retention. Statutory evidence and protecting specific claims may justify further purpose-limited retention.

Under the DPA, restricted read and export access remains available for 30 calendar days after a paid contract ends. Customer data, including customer documents, is then deleted unless separate retention has been commissioned or a duty directly binding on Craftbase has been demonstrated.

The customer's retention duties do not by themselves authorise Craftbase to retain data. Customers must export necessary data in time. Technical backups are processed only for recovery and security and are overwritten according to the backup cycles defined for the relevant service.

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction of processing, and data portability. You can withdraw consent for the future at any time. For processing under Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation.

You may object to direct marketing at any time without giving reasons; this also covers profiling related to that marketing. Following such an objection, your personal data is no longer processed for those purposes.

Send requests concerning Craftbase's own processing to support@craftbase.de. Where necessary, identity is checked proportionately without requesting additional data without justification. For customer-managed business data, the relevant customer is generally responsible; Craftbase assists under the DPA.

You may complain to a data protection supervisory authority, particularly in the Member State of your habitual residence, workplace, or the suspected infringement. For a company based in Baden-Württemberg, the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg is the competent state authority.

Craftbase applies technical and organisational measures appropriate to risk to protect personal data against unauthorised access, loss, and unlawful alteration. These include appropriate access permissions, confidentiality, transmission protection, and operational, recovery, and security procedures. Contractual safeguards for customer data are described in the DPA's TOM annex.

This policy is updated when relevant processing changes. Its date indicates the information's revision, not consent to a contract amendment. Changes to consent-dependent processing replace neither necessary new information nor necessary consent.