Privacy Policy
Draft — to be reviewed by the client’s legal counsel
Last updated 1 October 2026
This working version describes how the website and the project workspace currently handle information. The final wording is to be supplied by the client’s counsel, together with the company’s legal name and address.
Who we are
Craft My Furniture designs and makes furniture for hotels, restaurants, workplaces and homes. The company’s legal name, registered address and the contact for privacy questions will be set out here. Until then, write to the studio using the address on the contact page.
What we collect
When you send an enquiry, request samples or a catalogue, sign up for the studio’s letters or write to the studio, we keep the details you give us — such as your name, email address, company, phone number, project location and message — and any files you attach.
Pieces you save to My Project before signing in stay in your own browser; nothing is sent to us until you send an enquiry or save them to a workspace.
Your verified email and the project workspace
The project tools and the workspace use your email address instead of a password. We send a one-time code and a sign-in link; once you enter the code, a session keeps you signed in for up to 30 days. We then keep your email address, the profile details you choose to add, your projects, the products you select and the files you upload.
To protect the service from abuse we keep limited security records: a random device identifier, hashed (not raw) network addresses, and a record of sign-in attempts and unusual activity. We do not use browser fingerprinting.
Project files stay private
Files you upload — schedules, drawings, photographs of a space, references — are stored privately. They are never published on the website. They can be opened only by you and the people you invite to a project, through short-lived links, and by our team when they prepare a quotation or a design response. Uploaded files are checked for unsafe content before anything reads them, and photographs are re-saved without their location data before analysis.
AI processing by third-party providers
When you ask a project tool to read a document, analyse a photograph of a space, answer a question or create a concept image, the relevant content is processed by AI service providers acting for us — currently OpenAI and Google (Gemini). Your email address, name and other contact details are not included in what is sent. Results are labelled as AI interpretations or concepts, and our team reviews them before anything is quoted or made.
The providers process this content to return the result to us. Whether they keep it for a limited period for abuse monitoring, and where it is processed, will be stated here once confirmed under the agreements with each provider.
How we use it
We use your information to reply to you, prepare quotations and samples, send the documents you asked for, run your workspace, keep the service secure and improve the website. We do not sell personal data. Letters from the studio are sent only if you sign up for them.
How long we keep it
The studio sets retention periods in the workspace settings. At the time of writing they are:
- files uploaded without a verified project: removed after 24 hours;
- a project you delete: erased after 7 days;
- documents and photographs prepared for analysis, and generated concept images: kept for up to 12 months;
- projects with no activity for 24 months that were never sent to the studio: removed.
Enquiries and projects you send to the studio become business records and are kept for as long as the law requires for quotations, orders and accounts. The periods for those records will be set out here.
Your rights, including deletion
You can delete a file, a project or all of your workspace data at any time: Your details → Delete my data in the workspace removes your projects and files and closes your access. You can also ask us to access, correct or delete your personal data, or object to how it is used, by writing to the studio. If you are not satisfied with our answer, you may complain to your data protection authority.