Privacy policy
Last updated: 26 October 2026
This policy explains what personal data Craftadoc (craftadoc.com) collects, why, how long we keep it, and what you can do about it.
Who is responsible
The controller of your personal data is:
- CodeBenchers, the trade name of Bart Moyaers, self-employed (autónomo) in Spain
- NIF: Z1401157W
- Email: info@craftadoc.com
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Account details: name, email address, a securely hashed password | To give you an account, sign you in and send account emails such as password resets | Contract |
| Your content: form values, uploaded images, documents and templates | To store, generate and show your documents | Contract |
| Share link submissions: what visitors enter in a template you share | To deliver the filled-in document to you, the link's owner | Contract with the owner; the owner decides what is collected and must have a lawful basis for it |
| Billing details: plan, subscription status, billing address, VAT number, invoices | To charge for paid plans, apply the correct tax and keep invoices | Contract; legal obligation (tax and accounting) |
| Security data: IP address, browser details, the bot check result | To keep Craftadoc secure, prevent abuse and limit misuse | Legitimate interest |
| Newsletter: your email address, when and where you signed up and confirmed, and whether you unsubscribed | To send occasional news about Craftadoc, and to prove your consent | Consent, which you can withdraw at any time |
| AI usage: when you used an AI feature and how much (token counts). For template changes with AI, also your request and the AI's summary of what it changed, which the template editor shows you; never what you give "Fill in with AI" | To apply your plan's AI allowance, keep costs in check, and show you what changed | Contract |
| Visit statistics: which pages are visited, the referring site, country, browser and device type, and page load times, counted without cookies or any identifier that recognises you | To see how the site is used and keep it fast | Legitimate interest |
| Messages: what you send us | To answer you | Legitimate interest |
We don't sell your data, we don't show advertising, and we don't use your content to train AI models.
Who processes data for us
- Cloudflare hosts Craftadoc, stores accounts, documents and files, sends account emails, runs the Turnstile bot check on sign-up, sign-in, password reset, share links and previews for visitors, turns dictation into text (Workers AI), and counts visits (Web Analytics, without cookies). Recordings are only passed through, not stored.
- Stripe processes payments and calculates tax. Stripe also processes some payment data as an independent controller, for example to prevent fraud; see Stripe's privacy policy.
- Have I Been Pwned checks whether a new password appears in known data breaches. It only receives the first 5 characters of a hash of the password, never the password itself.
- Anthropic (Claude) receives what you give "Fill in with AI" (your text, files and the form's current values) only when you use it, to fill in the form, and, when you ask the AI to change one of your templates, your request and the template's files. Anthropic doesn't train its models on it and keeps it only for a limited time, normally up to 30 days; Craftadoc doesn't store your files.
Some of these providers are based in the United States or process data there. Transfers are protected by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
How long we keep it
- Account details and your content: until you delete them or your account. Our database keeps point-in-time backups for 30 days, so deleted data also disappears from backups within 30 days.
- Invoices and billing records: as long as tax and accounting law requires, which is currently up to 6 years.
- Security logs: up to 30 days.
- AI usage records: until the end of the month after you used the feature, to apply your plan's monthly allowance and keep costs in check. After that we keep only monthly totals for all users together, which can't be linked to you. Requests to change a template with AI stay with the template until you delete it or your account; unsaved changes to a template are removed 3 days after your last change.
- Newsletter: until you unsubscribe or delete your account. After unsubscribing we keep only the record that you did, so we never email you by mistake.
Your rights
You can ask us to access, correct, export or delete your personal data, or to restrict or object to how we process it. Most of this you can do yourself on the account page, including getting a copy of all your data (Email me my data, which sends you a download link) and deleting your account; for anything else email info@craftadoc.com. We answer within one month.
If you think we handle your data wrongly, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos, or the authority in your own country.
Newsletter
You only get our newsletter if you ask for it: by ticking the box when you sign up, on your account page, or through a sign-up form, after which you confirm your address by email. Every newsletter has a link to unsubscribe, which takes effect immediately; you can also turn it off on your account page. Emails about your account, such as password resets, are not newsletters and still arrive.
Cookies
We only use what is needed for the site to work, such as the cookie that keeps you signed in. See our cookie policy.
Children
Craftadoc is not meant for people under 16, and we don't knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will remove it.
Changes
We may update this policy. For important changes we tell account holders by email. The date at the top shows when it last changed.