Privacy Policy

Last updated: June 29, 2026

1. Introduction

This Privacy Policy describes how WhiteCraft ("we", "us", or "our") collects, uses, and shares information about you when you use our website and services ("Service").

2. Information We Collect

Account data

• Email address
• Hashed password
• Referral code (if applicable)

Usage data

• Generation history (templates used, order metadata)
• API usage logs
• Billing transactions

Technical data

• IP address, browser, device information
• Session cookies

Anti-fraud signals

To prevent fraud and multiple-account abuse, we record your IP address and browser user-agent at key events — registration, login, deposit, and promo-code activation. We may compare these signals across accounts to detect coordinated or duplicate accounts, as described in our Terms of Service (§9).

3. How We Use Your Data

• To provide and maintain the Service
• To process payments and credit balances
• To send transactional emails (receipts, account notifications)
• To prevent fraud, abuse, and multiple-account farming
• To comply with legal obligations

4. Legal Basis (GDPR)

We process personal data on the basis of contract performance (delivering the Service you signed up for), legitimate interest (fraud prevention, product improvement), and consent (marketing, where applicable).

5. Data Sharing

We do not sell personal data. We share data only with:

• Payment processors (OxaPay, crypto on-ramps) — for payment execution
• Cloud infrastructure providers — for hosting and storage
• Law enforcement — when required by valid legal process

6. Data Retention

Account data is retained while the account is active and up to 24 months after account deletion for legal and tax compliance. Generation artifacts are retained for 30 days after order completion.

7. Your Rights

Subject to applicable law, you may request access, correction, deletion, or portability of your personal data. To exercise these rights, contact us at the address below.

8. Cookies

We use essential cookies for authentication and session management. Analytics cookies are deployed only after consent where required.

9. International Transfers

Data may be processed outside your country of residence. We rely on appropriate safeguards such as standard contractual clauses.

10. Changes

We may update this Policy. We will notify you of material changes by posting an updated version with a new "Last updated" date.

11. Contact