Privacy Policy

Last updated: 6 September 2026

This policy explains how Craftivora Patterns handles personal information when you visit craftivorapatterns.com, buy digital products, contact us or connect a social account through Craftivora Patterns Social or Craftivora Social.

1. Information we process

Account information: your email address, password hash, account identifiers and any profile name, biography, image or billing information you provide. If you choose Google sign-in, we receive your Google account identifier, verified email address and basic profile information needed to create or recognise your account.

Orders and downloads: purchased products, order and payment references, amounts, payment status, delivery email address and download records. Stripe processes payment details; the shop does not receive or store your full card number or card security code.

Support and contributions: messages, attachments and reviews you submit. Reviews you choose to submit may appear publicly after moderation.

Shop preferences and activity: saved favourites, basket contents, consent choices and, when enabled with your consent, product views and other shop analytics.

Technical information: IP addresses, request information, session identifiers and security or operational logs needed to deliver and protect the service.

2. How and why we use information

We use account, order and support information to provide the services you request and fulfil our contract with you. We use information where necessary to meet accounting, tax and other legal obligations. We also use limited technical records to prevent abuse, investigate failures and protect the shop, based on our legitimate interests in operating a reliable and secure service.

Optional analytics and promotional email rely on your consent. Where you opt in, shop activity such as viewed products, favourites and basket contents may help us select relevant product suggestions, reminders or offers. You may withdraw consent without affecting the lawfulness of earlier processing. We do not use these suggestions to make decisions with legal or similarly significant effects.

3. Pinterest, Facebook and Instagram connections

The social integration is an administrative tool for authorised Craftivora operators. Visiting the shop or buying a pattern does not connect your social account.

When an operator chooses to connect Pinterest, Facebook or Instagram, the operator is redirected to that platform to authorise access. We do not ask for or store the operator's social-platform password. We receive the authorised account or page identifier, display name, granted permissions and access tokens; a refresh token and expiry information may also be stored. Tokens are encrypted in the application's database.

For Pinterest, the integration requests access to the connected account's basic information and its Pins and boards, and permission to create Pins. This supports publishing or scheduling Craftivora product content to a board selected by the operator. For Facebook and Instagram, the integration uses authorised page or business-account information to publish approved content. Draft text, images, selected destinations, schedules, publication status and platform post identifiers may be stored to operate these features.

Content that an operator publishes is transmitted to the selected platform and may become public under that platform's settings. We use connected-platform data to provide the authorised integration, not to sell it or build unrelated profiles. Social-account tokens are not used to train AI models.

Operators can disconnect an account in the social settings. This clears the locally stored access and refresh tokens for that connection. Access can also be revoked through the relevant platform's settings. Disconnecting does not remove posts already published on the platform; manage those posts directly on the platform. To request deletion of remaining connection records or stored drafts, contact us below.

4. Service providers and disclosures

We share information as needed with service providers that help operate the shop: Cloudflare for hosting, storage and security; Stripe for payments; and our configured email delivery service for transactional or consented promotional messages. If you choose Google sign-in or connect a social account, the relevant provider processes information under its own privacy policy. The shop may load fonts from Google, which receives the network information required to deliver them.

Authorised administrators may use AI services through OpenRouter or fal.ai to assist with content creation. Information included in such a request is sent to the selected provider to perform that task. Social authentication tokens are handled separately by the integration.

Information may also be disclosed where required by law or necessary to establish, exercise or defend legal claims. We do not sell personal information.

5. Cookies and browser storage

Essential cookies and browser storage support sign-in, basket contents, favourites and saved privacy choices. The sign-in cookie can last up to 30 days. Local browser preferences remain until they are replaced or you clear your browser's site data. The shop asks for a choice before optional analytics.

You can change cookie permissions in your browser and contact us to withdraw analytics or marketing consent associated with your account. Clearing site data resets the locally saved choice and may sign you out or clear your basket. Promotional emails include an unsubscribe option where applicable; you can also request an opt-out by email.

6. Retention and deletion

We retain account information while needed to provide your account, and order and payment records for applicable accounting, tax, refund and legal-claim requirements. Support records are retained while needed to resolve your request and related disputes. Security and activity records are kept only for as long as needed for their operational purpose. The period depends on the record's purpose and applicable obligations rather than a single period for all data.

Social tokens are retained while the connection is active and are cleared locally when it is disconnected. Some publication history and audit records may remain where needed to explain prior actions or resolve an issue. Expiry of a session or download link prevents further use of that credential but does not automatically erase the associated order or audit record.

Deleting your shop account disables access and removes its active login credentials. It does not automatically erase every related order, support or legal record. Contact us for a request covering remaining personal information; we will explain any information that must be retained.

7. International processing and security

Our providers may process information in countries outside your country of residence, including outside the European Economic Area. Where GDPR transfer rules apply, an applicable lawful transfer mechanism is required, such as an adequacy decision or standard contractual clauses. Contact us for information about the safeguards applicable to your data.

We use HTTPS, restricted administrative access and encrypted social tokens to help protect information. No internet service can guarantee absolute security.

8. Your choices and rights

Depending on applicable law, you may request access, correction, deletion, restriction of processing or a portable copy of your data, and object to processing based on legitimate interests. You can withdraw consent at any time and object to direct marketing. You may also lodge a complaint with your local data protection authority; in Italy this is the Garante per la protezione dei dati personali.

Send privacy or data-deletion requests to support@craftivorapatterns.com , using “Privacy request” or “Data deletion request” as the subject. Identify your account email and, for a social connection, the platform and account name. Do not send passwords, access tokens or full card details. We may need proportionate verification of your identity before acting. Where GDPR applies, we normally respond within one month and explain any lawful extension.

9. Updates

We may update this policy as the shop or its integrations change. The date above identifies the current version. Material changes will be communicated where required.