Privacy policy

01In short

02Who is responsible

The controller under the General Data Protection Regulation (GDPR) is:

pragtex GmbH
Bodanstrasse 58, 88048 Friedrichshafen, Germany
Managing director: Manfred Mayer-Rieger
Email: info@pragtex.com · Phone: +49 152 3367 4951

For anything about your data, write to info@pragtex.com. See the imprint for our full company details.

03Visiting craeft.org

When you open a page on craeft.org, your browser sends our host, Cloudflare, the information any website receives: your IP address, the page you asked for, the time, your browser and operating system (the user agent) and the page you came from, if any. Cloudflare uses it to deliver the page, keep the site available and protect it against attacks. We keep short technical logs of these requests, for up to 7 days, to find and fix errors.

Legal basis: our legitimate interest in running a secure, working website (Art. 6 (1) (f) GDPR).

craeft.org opens in German if your browser says it prefers German (the language setting it sends with every request), and in English otherwise; the setting is read to choose the page, not stored. If you pick a language with the switcher, the site sets one cookie, user_locale, holding only “en” or “de”, for a year, so it keeps to your choice (legal basis: § 25 (2) no. 2 TDDDG, as it's needed for the setting you asked for, and our legitimate interest in showing the site in your language, Art. 6 (1) (f) GDPR). Otherwise it sets no cookies and stores nothing in your browser. It has no analytics, no advertising, no social media plugins and no embedded videos or maps. Its fonts are served from our own site, not from Google or another font service. See the cookie policy.

04Signing in to Craeft

The editor at app.craeft.org is for people a customer has invited. You sign in with your email address: Cloudflare Access sends you a one-time code, and once you enter it, sets a sign-in cookie that lasts 24 hours.

We process:

• your email address, which identifies you throughout Craeft;
• the organisations and sites you belong to, and your role on each (editor, publisher, admin);
• invitations sent to or by you.

We don't ask for your name or a password, and we don't store your IP address with your account.

Legal basis: providing Craeft under the contract with you or the organisation that invited you (Art. 6 (1) (b) GDPR), and our legitimate interest in keeping accounts secure (Art. 6 (1) (f) GDPR). Without an email address, we can't sign you in.

05Using the editor

When you ask Craeft for a change, we process:

• Your requests and the conversation: what you type or say, the editor's replies, and which part of the page you pointed at.
• Images you add: we resize and re-encode them, which removes hidden metadata such as a phone photo's location, and delete our copy after 7 days.
• Screenshots of the page before and after a change, for the review before publishing, deleted after 7 days.
• Drafts and changes: each draft is a branch in your site's GitHub repository, and each change is a commit. Commits record the email address of the person who made and published the change, so they stay part of the repository's history.
• The activity log: who did what and when (for example, asked for a review, published, reverted).
• Usage records: for each AI request, the model, the amount of text processed and its cost, so sites can see and cap their spending.

Legal basis: providing Craeft (Art. 6 (1) (b) GDPR), and our and our customers' legitimate interest in a traceable, reviewable record of changes to their websites (Art. 6 (1) (f) GDPR).

06AI and voice

To make a change, Craeft sends your request, the conversation so far and the relevant parts of your website to an AI language model. The request goes through Cloudflare's AI Gateway, which logs each call with the site, the draft and your email address so that usage can be traced and capped, and on to OpenRouter, which routes it to a model provider. Normally each site uses its own OpenRouter account; in that case, OpenRouter processes the request under that customer's own agreement with OpenRouter.

If you speak a request, your recording is transcribed by a speech recognition model running on Cloudflare (Workers AI). We don't store the audio. If you have replies read aloud, the reply text is turned into speech the same way.

The AI suggests changes; people decide. Nothing Craeft writes reaches a live website until someone allowed to publish has reviewed and published it. We make no decisions about you based solely on automated processing (Art. 22 GDPR).

07Organisations and notifications

Admins can invite people, give them roles and see the activity log for their sites. Craeft can email you when a draft is ready for review, when a publish is live, or when someone is waiting for you; you can choose which emails you get. We keep a copy of each notification email for 90 days. Organisations can connect their own Cloudflare and OpenRouter accounts; we store the access keys for these encrypted.

08Your website's visitors

Craeft adds a small kit to a connected website. On the live site it only adds the address people use to open the editor; ordinary visitors get the page exactly as before, and Craeft collects nothing about them. The editor itself only runs on private previews, behind sign-in. For people who have signed in to edit, the kit remembers this in the browser (see the cookie policy).

09When we act for our customers

A customer's website and repository can contain personal data, for example names on a team page. When Craeft reads or changes that content, we do so on the customer's behalf and on their instructions: the customer is the controller and we are their processor (Art. 28 GDPR). Customers can ask us for a data processing agreement at info@pragtex.com.

10Service providers

We use these companies to run Craeft. They process personal data only on our instructions or, where stated, under the customer's own agreement with them.

We pass personal data to authorities only where the law requires us to.

11Transfers outside the EU

The providers above are based in the USA, so personal data may be processed there. Where a provider is certified under the EU–US Data Privacy Framework, the transfer relies on the European Commission's adequacy decision (Art. 45 GDPR); otherwise, it relies on the European Commission's standard contractual clauses (Art. 46 (2) (c) GDPR). You can ask us for a copy of the safeguards that apply.

12How long we keep data

Where tax or commercial law requires us to keep records (for example invoices), we keep them for the legally required period, usually six to ten years.

13Security

All connections to craeft.org and the app are encrypted (HTTPS). Everyone signs in, sees only the sites their role allows, and every action is logged. Access keys for connected accounts are stored encrypted. The editor never runs on the live version of a website.

14Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• have it corrected (Art. 16) or deleted (Art. 17);
• restrict how we process it (Art. 18);
• receive it in a portable format (data portability, Art. 20);
• object at any time, on grounds relating to your situation, to processing based on our legitimate interests (Art. 21);
• withdraw any consent you have given, with effect for the future (Art. 7 (3)).

To use any of these rights, write to info@pragtex.com. If your data is part of a customer's website or organisation, we may pass your request to that customer, as they decide about it.

15Complaints

You can complain to a data protection authority, in particular in the EU country where you live or work. The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart, Germany
www.baden-wuerttemberg.datenschutz.de

16Changes to this policy

We update this policy when Craeft or the law changes. The date at the top shows the latest version. If a change affects how we use data you've already given us, we'll tell signed-in users before it takes effect.