Privacy Policy

Purpose

4. Why We Process This Data.

• to respond to your inquiries and take steps at your request before entering into a contract;
• to schedule business meetings, online sessions, and related communications;
• to provide services under concluded contracts and manage the contractual relationship;
• to operate, secure, and improve the public AI chat, including generating responses and monitoring performance;
• to collect feedback and improve the quality of our services;
• to manage invoicing, accounting, tax, and other legal obligations;
• to send newsletters and information about our services when you opt in (marketing consent checkbox on contact or booking forms) — you may withdraw that consent at any time by emailing us;
• to protect the site against abuse, spam, excessive automated traffic, and misuse;
• to debug, maintain, and improve the public service during development and operation; and
• to comply with legal obligations where they apply.

Legal Bases

5. Legal Bases.

• Responding to inquiries and pre-contractual steps — Article 6(1)(b) GDPR, where the request relates to a potential contract, or Article 6(1)(f) GDPR, based on our legitimate interest in responding to business requests.
• Delivering contracted services and managing client relationships — Article 6(1)(b) GDPR for individual clients, or Article 6(1)(f) GDPR for business contact persons.
• Invoicing, accounting, tax records, and statutory compliance — Article 6(1)(c) GDPR, compliance with legal obligations.
• Website operation, security, and fraud prevention — Article 6(1)(f) GDPR, based on our legitimate interest in website security.
• Non-essential cookies, analytics, or similar technologies — Consent, where required under Law no. 506/2004 and GDPR.
• Chatbot operation, security, and quality monitoring — Article 6(1)(f) GDPR, or Article 6(1)(b) GDPR where the interaction relates to a service request.
• Marketing communications, newsletters, and event invitations — Consent, or legitimate interest for business-to-business communications, with an opt-out available at any time.
• Establishing, exercising, or defending legal claims — Article 6(1)(f) GDPR, based on our legitimate interest in protecting our legal rights.

Processors

6. Service Providers.

The country where the website is hosted and data (CRM, chatbot, application servers) is stored is Germany.

We do not sell personal data. Technical service providers may include:

• Oracle Cloud Infrastructure (OCI), for site hosting and infrastructure operations.
• Anthropic, for processing public AI chat prompts and responses.
• OpenAI, for embedding and retrieval-augmented generation (RAG) used to ground public AI chat answers (prompts/query text may be sent for embedding lookup).
• Supabase, for application data services, retrieval workflows, and supporting backend features.
• Upstash (Redis), for anti-abuse rate limiting; request keys may include IP address and related technical identifiers.
• Namecheap Private Email or equivalent email infrastructure, for routing contact-form messages.
• Google Analytics (Google), for aggregated, consent-based website usage statistics.
• Microsoft Clarity (Microsoft), for consent-based usage analytics, including heatmaps and per-visitor session recording after you accept analytics. Recordings may capture page interactions; we mask sensitive form fields where practicable.
• CookieYes (optional), as a consent-management platform processor only when that CMP is enabled for an environment; the default site CMP is our first-party React banner.
• Zoom or similar platforms, for online meetings and sessions; these platforms process data under their own privacy policies, and we ensure any such processing complies with GDPR.

Retention

7. Data Retention.

We keep personal data only for as long as it is reasonably needed for the purpose for which it was collected. Retention periods and deletion practices vary by data category:

• Contact and booking leads — 2 years, deleted automatically on a daily job.
• Lead consent records — 2 years, deleted together with the associated lead (cascade deletion).
• Chatbot conversations — 90 days, deleted automatically on a daily job.
• Chatbot feedback, AI safety-filter rejections, AI usage telemetry, and chatbot funnel events — kept indefinitely at present; not yet on an automatic deletion schedule.
• Booking transcript files and their related CRM metadata — kept indefinitely at present (in practice, CRM metadata is generally cleared within 2 years alongside the associated lead); not yet on an automatic deletion schedule.
• Account and authentication data — kept until the account is deleted; no automatic deletion policy is currently in place.
• Emails received at hello@oracraft.com — kept until manually deleted.
• Cookie preference and consent records — up to 1 year, expiring automatically in your browser. See our Cookie Policy for details.
• Temporary in-browser chat session — cleared after a limited period of inactivity or when the browser tab is closed.
• Standard technical, security, and backup logs — kept for a limited operational period as part of normal system administration (typically no more than a few weeks), independent of the categories above.

You may request deletion of your data by contacting hello@oracraft.com.

Security

8. Security of Personal Data.

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. These measures may include access controls, confidentiality obligations, secure hosting arrangements, logging, back-up procedures, and security monitoring, taking into account the nature, scope, context, and risks of the processing.

International

9. International Processing.

ORAcraft is offered globally. Depending on the infrastructure and service providers involved (including Anthropic, OpenAI, Google, Microsoft, Supabase, Upstash, and Oracle Cloud), personal data may be processed in countries outside the European Economic Area. Where required under GDPR, we rely on appropriate safeguards such as an adequacy decision by the European Commission and/or the European Commission's Standard Contractual Clauses (SCCs) with our providers, together with any supplementary measures those providers document.

Cookies

10. Cookies and Similar Technologies.

We use optional analytics cookies and similar technologies (Google Analytics and Microsoft Clarity) to understand how the site is used, loaded only after you give consent through Cookie Settings. If you accept Marketing, we may also grant advertising-related Google Consent Mode signals (ad storage / personalization). We do not currently load third-party ad networks or set dedicated advertising cookies; campaign measurement signals stay off until you opt in. Full details are in our Cookie Policy.

Your Rights

11. Your Rights.

As a data subject under GDPR, you have the following rights regarding your personal data:

• Right of Access — request access to the personal data we hold about you, including how we use it and with whom we share it.
• Right to Rectification — request correction of inaccurate or incomplete data.
• Right to Erasure — request deletion of your personal data in certain circumstances, such as when it is no longer necessary for the purpose it was collected for, or when you withdraw consent.
• Right to Restrict Processing — request restriction in specific situations, such as when you contest the accuracy of the data or object to the processing.
• Right to Data Portability — request your data in a structured, commonly used, machine-readable format, and its transfer to another controller.
• Right to Object — object to processing based on our legitimate interests, or to processing for direct marketing purposes.
• Right to Withdraw Consent — where processing is based on your consent, withdraw it at any time; this does not affect the lawfulness of processing carried out before withdrawal.
• Automated Decision-Making and Profiling — you have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects you. We do not carry out such processing through this website.

To submit a request, contact us at hello@oracraft.com. We will respond without undue delay and, in any event, within one month of receipt, unless a longer period is needed and subject to applicable legal requirements.

If you are not satisfied with our response, you may contact the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) and submit a formal complaint here.

Contact

12. Updates and Contact.

We may update this Privacy Policy from time to time and will update the “Last updated” date at the top of this page. Privacy questions can be sent to hello@oracraft.com.