Privacy Policy

Scope of this policy

This Privacy Policy explains how CraftAutoFlow, operated by Nexavalan Tech Solutions (“CraftAutoFlow”, “we”, “us”), collects, uses, shares, and protects personal data when you visit our site, register as a Creator, or complete a purchase on a Creator store.

For your account and platform data, we act as a data controller: we decide why and how that data is processed. For a Buyer’s checkout details, we act as a data processor on behalf of the Creator whose store took the order; the Creator is responsible, as controller, for their own notices to their buyers.

Definitions

These words carry the same meaning wherever they appear in this policy.

Personal data

Any information that identifies or could reasonably identify a specific person.

Creator

A person or business with a CraftAutoFlow account that sells digital products.

Buyer

A customer who purchases a digital product from a Creator store.

Processing

Anything done with personal data: collecting, storing, using, sharing, or deleting it.

Subprocessor

A third party we engage to process personal data on our behalf, such as a payment or hosting partner.

Information we collect

We collect the following categories of information.

1. 3.1

   Identity data. Full name, email address, date of birth, and a government-issued ID, collected to open your account and to meet know-your-customer and anti-money-laundering obligations.

2. 3.2

   Financial data. Bank account details, mobile money numbers such as M-Pesa, billing address, and the transaction history tied to your Creator Wallet.

3. 3.3

   Technical data. IP address, device and browser type, operating system, approximate location derived from your IP address, and API access logs.

4. 3.4

   Buyer data. When a purchase is made on a Creator store, we process the checkout details the Buyer provides, such as name, email, payment token, and delivery information where relevant, strictly to complete and fulfill that order.

5. 3.5

   Support records. Messages, call notes, and attachments you send us when you contact support, kept to resolve your query and to improve our responses.

How we use your information

We use personal data for the following purposes.

1. 4.1

   Operating the platform. Creating and managing your account, running your store, and triggering automated fulfillment the moment a sale clears.

2. 4.2

   Payments. Settling transactions, calculating commission, processing payouts to your Wallet, and handling refunds or chargebacks.

3. 4.3

   Verification. Confirming your identity before releasing a payout, in line with anti-money-laundering law.

4. 4.4

   Security. Detecting and preventing fraud, abuse, and unauthorized access to accounts.

5. 4.5

   Communication. Sending transactional messages about your account and orders, responding to support requests, and, only where you opt in, sending product updates.

6. 4.6

   Improving the service. Analyzing aggregated usage to fix problems, harden infrastructure, and prioritize new features.

Our legal bases for processing

Where privacy law requires a stated legal basis, we rely on one of the following.

1. 5.1

   Contract. Processing needed to open your account and deliver the service you signed up for.

2. 5.2

   Legal obligation. Identity verification, anti-money-laundering checks, and financial record-keeping required by law.

3. 5.3

   Legitimate interests. Fraud prevention, platform security, and service improvement, balanced against your rights and never overriding them.

4. 5.4

   Consent. Marketing communications and non-essential cookies, which you can withdraw at any time without affecting the service you already use.

How we share information

We do not sell personal data. We share it only with these categories of recipients.

1. 6.1

   Payment and verification partners. Banks, mobile money operators including Safaricom’s M-Pesa, and card processors, so that funds move and identities are confirmed.

2. 6.2

   Cloud infrastructure providers. Hosting and content-delivery partners that run the platform and keep it available.

3. 6.3

   Creators. A Buyer’s checkout name, contact details, and order information are shared with the Creator whose product was purchased, so the Creator can provide support and fulfill the order.

4. 6.4

   Advisors and authorities. Auditors, insurers, regulators, and law enforcement, where the law requires disclosure or to establish, exercise, or defend a legal claim.

5. 6.5

   Business transfers. A successor entity in a merger, acquisition, or sale of assets, bound by protections equivalent to this policy.

Cookies and similar technologies

1. 7.1

   Essential cookies. Keep you signed in and preserve checkout state on a Creator store. The platform cannot function without these.

2. 7.2

   Analytics cookies. Help us understand how the platform is used, so we can find problems and prioritize improvements.

3. 7.3

   Your choices. You can accept or decline non-essential cookies from the banner shown on your first visit, and change that choice at any time in your browser settings.

International data transfers

CraftAutoFlow serves Creators and Buyers across borders, so personal data may be stored and processed outside the country where you live, including in facilities operated by our cloud infrastructure partners.

Where we transfer personal data internationally, we use recognized safeguards, such as standard contractual clauses, and we require subprocessors to protect data to a standard consistent with the Kenya Data Protection Act, 2019, and, where applicable, the EU General Data Protection Regulation.

Data retention

We keep personal data only as long as needed for the purposes described in this policy.

1. 9.1

   Identity and verification records. Kept for the period anti-money-laundering law requires, typically for seven years after an account closes.

2. 9.2

   Transaction records. Kept for up to seven years to meet tax and accounting obligations.

3. 9.3

   Marketing preferences. Kept until you unsubscribe or ask us to delete them.

4. 9.4

   Support records. Kept for a reasonable period after your query is resolved, in case of a follow-up or dispute.

Data security

We apply technical and organizational measures appropriate to the sensitivity of the data we hold, including encryption of data at rest, encrypted connections for data in transit, and access controls that limit who inside CraftAutoFlow can view financial or identity records.

No method of transmission or storage is completely secure. If a breach creates a real risk to your rights, we will notify affected individuals and the relevant regulator as required by law.

Your privacy rights

Subject to the exceptions and limits your law provides, you may have the right to access, correct, delete, restrict, or receive a copy of your personal data, and to object to or withdraw consent for certain processing. Deletion may be delayed where we have a legal obligation, such as financial record-keeping, to keep the data.

1. 11.1

   Kenya. You have rights under the Data Protection Act, 2019, and may lodge a complaint with the Office of the Data Protection Commissioner.

2. 11.2

   European Union and United Kingdom. You have rights under the GDPR and UK GDPR, and may lodge a complaint with your local supervisory authority.

3. 11.3

   California. You have rights under the CCPA and CPRA, including the right to know what we collect and to opt out of the sale or sharing of personal data. We do not sell personal data.

4. 11.4

   How to exercise these rights. Email [email protected]. We may ask for information to verify your identity before acting on a request, and we respond within the time your law requires.

Children's privacy

CraftAutoFlow is intended for people aged 18 and over. We do not knowingly collect personal data from anyone younger. If you believe a minor has provided us with personal data, contact us and we will remove it.

Changes to this policy

We update this policy as our practices, the platform, and the law change. The effective date at the top of this page always reflects the current version. For material changes we give notice in your dashboard and by email at least 30 days before they take effect.

Contact us

Data controller

Nexavalan Tech Solutions

Privacy inquiries

[email protected]

Mailing address

Nairobi, Kenya

WhatsApp

+254 793 540 705