Privacy Policy

Craftt is a brand of Venturise OÜ, a private limited company incorporated in Estonia and operating from Tallinn, Estonia. For the purposes of this policy, "we", "us", or "Craftt" refers to Venturise OÜ.

For privacy questions, reach us through the contact channels on /contact or by emailing hi@craftt.io.

When you book a discovery call, request the free audit, or contact us, we collect the information you submit: name, work email, company, role, and the message or workspace details you share with us.

When you visit craftt.io, we collect standard analytics data through our analytics provider (Google Analytics 4): IP address (anonymized), pages viewed, referring source, device and browser type, and time on page.

If you become a customer, we additionally collect billing information needed for invoicing, scope-of-work details, and the records and content you provide for the implementation work.

Contract performance: to deliver the services you have engaged us for (implementation work, the free audit, ongoing CRM management).

Legitimate interest: to respond to inquiries, improve the website, prevent abuse, and run aggregate analytics to understand which pages are useful.

Consent: where required, for example for non-essential cookies. You can withdraw consent at any time.

Legal obligation: where we are required by law to retain records (for example, tax and accounting obligations under Estonian law).

We use a small number of subprocessors to operate the business. Each is engaged under appropriate data-processing terms.

Vercel (United States): website hosting and edge serving. Receives the same data your browser sends when loading the site.

Google (Ireland / United States): analytics (Google Analytics 4) and the Workspace tools we use to run the business (Gmail, Calendar, Drive, Meet).

Cal.com (United States): scheduling for discovery calls. Receives name, email, and meeting metadata.

Attio (United States): the CRM we use internally. Stores contact details for inbound inquiries and existing customer records.

Stripe (Ireland / United States): invoice payment processing. Receives billing details needed to issue invoices and process payments.

We do not sell your personal data to third parties.

Our primary operations are run from Estonia. Several subprocessors store data in the United States or other regions outside the EEA.

Where data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses or equivalent transfer safeguards provided by the subprocessor.

Inquiry data (form submissions, call notes): up to 24 months from the last interaction, unless you become a customer.

Customer data: for the duration of the engagement plus 7 years to meet Estonian accounting and tax retention requirements.

Analytics data: aggregated and pseudonymized; retained per the analytics provider's defaults (currently 14 months in GA4).

You can request earlier deletion at any time, subject to legal retention obligations.

If you are in the EEA, UK, or Switzerland, you have the right to: access the data we hold about you, correct inaccurate data, request deletion, restrict processing, object to processing based on legitimate interest, and request portability of data you provided.

To exercise any of these rights, email hi@craftt.io. We respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority. In Estonia, that is the Andmekaitse Inspektsioon (aki.ee).

If you are a California resident under the CCPA/CPRA, you have the right to know what personal information we collect, request deletion, request correction, and opt out of "sale" or "sharing" of personal information. We do not sell or share personal information for cross-context behavioral advertising.

To exercise these rights, email hi@craftt.io. We will not discriminate against you for exercising them.

We use only essential cookies and analytics cookies. Essential cookies are required for the site to function. Analytics cookies (Google Analytics 4) are used to understand site usage in aggregate.

You can disable analytics cookies through your browser settings or by using a browser extension that blocks analytics scripts.

We may update this policy from time to time. The "last updated" date at the top will change when we do. Material changes will be highlighted on the page for at least 30 days.