Privacy Policy

1.Who we are

Craftly ("we", "us") runs craftly.one, the store addresses at <store>.craftly.one, the dashboard and the Craftly plugin. For privacy questions or requests, email [email protected].

For store owners' accounts and our own plan billing, Craftly decides how data is used (we are the controller). For the orders players place in a store, the store owner is the seller and decides how that data is used; Craftly stores and processes it on the owner's behalf so the store can work.

2.What we collect

3.How we use it

Under UK GDPR we rely on: performing our contract with you; our legitimate interests in running a secure and reliable service; and legal obligations such as keeping financial records. Players' order data is processed for the store owner to perform their sale.

• To run the service: show stores, take orders, deliver purchases through the plugin, and keep you signed in.
• To bill for paid plans and keep financial records.
• To keep the service secure, prevent abuse and fraud, and investigate problems.
• To contact store owners about their account, important changes and support requests.

4.Who we share it with

We never sell personal data. We share it only where the service needs to:

• The store owner: they see the orders placed in their store, including username, edition and email.
• Stripe and PayPal: they process store payments for owners and Craftly plan payments for us, under their own privacy policies.
• mc-heads.net: player head images are loaded from this service using the Minecraft username, so your browser contacts it when a store shows a player's head.
• mcsrvstat.us: a store's public server address is sent to this service to show how many players are online.
• Authorities, when the law requires us to.

5.Cookies and browser storage

Craftly uses only cookies that are needed for the service to work, so we don't show a cookie banner. There is no advertising or analytics tracking.

6.Keeping data safe and backed up

We protect data with HTTPS, hashed passwords, encrypted payment credentials and restricted access to our servers. We back up the database before every update to the service so it can be restored if something goes wrong.

We work hard to keep data safe, but no system is completely secure. If a breach affects your personal data, we will tell you and the relevant authorities as the law requires.

7.How long we keep it

• Account and store data: while your account is open. When you ask us to close it, we delete your account and stores.
• Orders: for as long as the store exists and as needed for delivery, disputes and legal record-keeping.
• Plan billing records: as long as tax and accounting law requires, typically six years in the UK.
• Backups: kept for a limited time, then replaced by newer ones. Deleted data can stay in a backup until it is replaced.

8.Your rights

Under UK GDPR you can ask to access, correct or delete your personal data, to restrict or object to how we use it, and to receive it in a portable format. Email [email protected] and we'll reply within one month.

Players: for an order in a store, you can also contact the store owner, since they are the seller. We will help them answer your request.

If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to sort it out first.

9.International transfers

Stripe, PayPal and the other services above may process data outside the UK. Where they do, they use legal safeguards such as standard contractual clauses.

10.Children

Many Minecraft players are young. Players under 18 should have a parent or guardian's permission before buying, and stores should not ask players for more information than the order needs. If you believe a child has given us personal data without permission, email [email protected] and we will delete it.

11.Changes to this policy

We will update this policy when the way we handle data changes. The date at the top shows the latest version, and we will tell store owners about significant changes.