Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Mansurum UG (haftungsbeschränkt) i.G. Achtert Wallen 4 26607 Aurich, Germany Represented by the managing director: Anton Abel Commercial register: to follow Phone: +49 151 15268680 Email: info@craftflowos.com

2. Collection and Processing of Personal Data

We only collect personal data when you voluntarily provide it to us — in particular when signing up for our waitlist.

Waitlist Sign-up

When you sign up for our waitlist, we collect and process the following data:

• Email address
• IP address (at the time of sign-up, for security and anti-abuse purposes)
• Date and time of sign-up and confirmation
• Language preference

Sign-up uses a double opt-in process: after entering your email address, you will receive a confirmation email. Your registration is only activated after clicking the confirmation link.

3. Purpose of Data Processing

We process your data for the following purposes:

• Notifying you about the craftflowOS launch and major product updates
• Confirming your waitlist sign-up (double opt-in)
• Protection against abuse and automated sign-ups

4. Legal Basis

Processing your email address for the waitlist is based on your explicit consent pursuant to Art. 6(1)(a) GDPR. Processing of the IP address for anti-abuse purposes is based on our legitimate interests pursuant to Art. 6(1)(f) GDPR.

5. Storage Period

Your data will be stored until craftflowOS officially launches and you have been notified, or until you withdraw your consent. Unconfirmed entries are deleted after 30 days. IP addresses are deleted after a maximum of 90 days.

6. Disclosure to Third Parties

Your data will not be sold to third parties or shared for advertising purposes. We use the following processors to provide our services:

• Hetzner Online GmbH Hosting our servers (Germany).
• Twilio Inc. (SendGrid) Telephony and SMS, sending confirmation emails and receiving inbound emails (SendGrid).
• Google LLC Web analytics via Google Analytics 4 (USA). See the Google Analytics section below for details.
• Functional Software, Inc. (Sentry) Error monitoring of our servers (Sentry EU region, Frankfurt). See the error monitoring section below for details.
• Cloudflare, Inc. Storage (R2), CDN and domains.
• Stripe, LLC Payment processing.
• 650 Industries, Inc. (Expo) Push notifications of the app.
• AI providers Mistral AI (France), Google LLC (Gemini API) and, in addition, OpenAI and OpenRouter. See the section Use of Artificial Intelligence below for details.

Data processing agreements pursuant to Art. 28 GDPR have been concluded with these processors.

Some of the service providers listed are based in the USA or may process personal data there: Twilio Inc. (including SendGrid), Functional Software, Inc. (Sentry), Google LLC, Cloudflare, Inc., Stripe, LLC and 650 Industries, Inc. (Expo). These companies are certified under the EU-U.S. Data Privacy Framework; transfers are based on the European Commission's adequacy decision of 10 July 2023 (Implementing Decision (EU) 2023/1795, Art. 45 GDPR). In addition, the data processing agreements concluded with these providers include the Standard Contractual Clauses of the European Commission (Implementing Decision (EU) 2021/914, Art. 46(2)(c) GDPR), which apply in particular if the adequacy decision ceases to apply or a certification ends. You can check the certification status at https://www.dataprivacyframework.gov/list; a copy of the Standard Contractual Clauses is available on request at info@craftflowos.com.

For individual AI features we may additionally use services of OpenAI Ireland Ltd. or OpenRouter, Inc. (USA). Data may be transferred to the USA in this case. These providers are not certified under the EU-U.S. Data Privacy Framework; transfers are based on the Standard Contractual Clauses of the European Commission (Art. 46(2)(c) GDPR).

7. Your Rights

You have the following rights with respect to us:

• Access (Art. 15 GDPR) — You may request information about the data we store about you.
• Rectification (Art. 16 GDPR) — You may request the correction of inaccurate data.
• Erasure (Art. 17 GDPR) — You may request the deletion of your data.
• Restriction (Art. 18 GDPR) — You may request the restriction of processing.
• Data portability (Art. 20 GDPR) — You may request the transfer of your data.
• Objection (Art. 21 GDPR) — You may object to the processing of your data.

To exercise your rights, please contact: info@craftflowos.com

8. Right to Withdraw Consent

You may withdraw your consent to the processing of your email address at any time with effect for the future. To do so, send an email to info@craftflowos.com. The lawfulness of processing carried out before the withdrawal remains unaffected.

9. Cookies and Tracking

This website uses technically necessary cookies required for its operation. In addition, and only with your consent via our cookie banner, we use Google Analytics 4, which also uses cookies; see the following section for details. We do not use marketing cookies. You can change or withdraw your choice at any time via the “Cookie settings” link in the footer.

Cookie overview

• craftflow_consent (necessary) — stores your cookie choice — duration: 1 year.
• NEXT_LOCALE (necessary) — stores your language preference — duration: 1 year.
• _ga and _ga_[ID] (analytics, Google Analytics 4) — distinguishes visitors and sessions for audience measurement; set only after your consent and deleted on withdrawal — duration: 2 years.
• cf_jwt, cf_uid (necessary, only when signed in) — keep you signed in to the customer area — duration: until sign-out or session expiry.
• cf_surface (necessary, only in the signed-in area) — stores the detected device class for the matching layout — duration: 1 year.

In the signed-in area we also store display settings and drafts (e.g. sidebar, form drafts) in your browser's local storage (LocalStorage/SessionStorage). This data does not leave your device.

10. Google Analytics

This website uses Google Analytics 4, a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google Analytics uses cookies and similar technologies to analyse how our website is used and to generate reports about website activity.

Data collected

Google Analytics 4 collects and processes the following data:

• Page views and navigation paths
• Time spent on the website
• Approximate geographic location (city/region level)
• Device information (browser, operating system, screen resolution)
• Referrer (previously visited website)

Processing is based on your consent pursuant to Art. 6(1)(a) GDPR, which you can grant via our cookie banner. You may withdraw your consent at any time by adjusting your cookie settings via the link in the footer.

Google LLC may transfer the collected data to the USA. Google is certified under the EU-US Data Privacy Framework, which ensures an adequate level of data protection.

For more information about Google's privacy practices: https://policies.google.com/privacy

11. OpenStreetMap

We use OpenStreetMap to display interactive maps on this website. The provider is the OpenStreetMap Foundation (OSMF), St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. When the map loads, your IP address is transmitted to servers of the OpenStreetMap Foundation. This only happens with your explicit consent (Art. 6(1)(a) GDPR). Storage duration is subject to the provider's server log policies. More information: https://wiki.osmfoundation.org/wiki/Privacy_Policy

12. Data Security

We employ technical and organisational measures to protect your data against accidental or intentional manipulation, loss, destruction, or access by unauthorised persons. Transmission between your browser and our server is encrypted via HTTPS.

13. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data. The competent authority for Lower Saxony is:

Die Landesbeauftragte für den Datenschutz Niedersachsen Prinzenstraße 5 30159 Hannover, Germany

14. Use of Artificial Intelligence

To improve our services and automate processes, we use Artificial Intelligence (AI) systems. Personal data such as project descriptions, communication content, and usage behaviour are processed by specialised AI services.

Processing is based on your explicit consent pursuant to Art. 6(1)(a) GDPR and on data processing agreements (DPA) concluded with our AI providers pursuant to Art. 28 GDPR. You may withdraw your consent at any time by contacting us at info@craftflowos.com.

15. Error Monitoring and Performance Analysis

We use Sentry (Sentry Inc., San Francisco, USA) to detect and analyze technical errors and to monitor the performance of our servers. Error reports, stack traces, and performance metrics are transmitted to servers in the EU (Sentry EU region, Frankfurt). Email addresses and IP addresses are not transmitted. For logged-in users, an internal pseudonymous user ID (integer) and user type (craftsman or customer) are transmitted for error attribution. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in technical stability). We do not currently use Sentry in the browser; no recordings of your page interactions are made.

16. Currency and Changes

This privacy policy is currently valid as of October 2026. Due to the further development of our website or changes in legal requirements, it may be necessary to update this privacy policy.