Client Craft — Privacy Policy
Version 2026-10-06.2

1. Who is responsible
Client Craft is operated by Harvestmirage LDA, Portugal, NIF 518955486. Business address: Rua Piteira Santos 22, Quinta do Conde, 2975-337, Portugal. Contact: arthur.nassar@client-craft.com.
This policy explains how we handle personal data in connection with our website, enquiries, appointments, accounts and connected platform services.


2. Our role and your business’s role
Harvestmirage LDA acts as controller for our own account administration, sales enquiries, billing, support and security records. When a customer uses Client Craft to manage its website enquiries, contacts, deals, projects or support requests, that customer generally decides why the data is used and acts as controller. We process that workspace data on its instructions. An agency may act for its own clients; the relevant roles must be agreed in writing.
If a business using Client Craft holds your information, contact that business first about its use of your data. We assist it with requests as required. A customer’s own privacy notice applies to its relationship with you.


3. Information we handle
Contact and account details: name, business, email, account credentials, user roles and workspace identifiers.
Subscription and billing information: chosen users and plan, billing address, tax information, payment status, invoice references and payment-provider identifiers.
Enquiries and appointments: messages, contact details, selected meeting times and relevant correspondence.
Customer workspace content: website content, leads, contacts, deal records, project and support information, and files that authorised users provide.
Technical records: IP address, browser and device information, request logs, security events and integration identifiers needed to operate and protect the service.
Data comes from you, authorised colleagues, your business’s website forms, and integrations your business enables. Do not include medical records, payment-card details or other sensitive information in ordinary enquiry forms. Client Craft is not offered as a clinical-record system.


4. Why we use information
Providing the service: setting up and administering accounts, responding to a requested proposal, delivering the website and supporting the subscription. Where you are the contracting individual, necessary processing is based on the contract or steps you ask us to take before it.
Business administration and security: communicating with company representatives, handling support, preventing abuse and maintaining the service. We rely on our legitimate interests where appropriate, considering people’s rights and reasonable expectations.
Legal requirements: issuing and keeping required accounting records and responding to lawful obligations.
Optional activities: where consent is required for marketing or non-essential tracking, we request it separately. You can withdraw it without affecting earlier lawful processing.
Accepting the terms is not consent to advertising. We do not use a blanket consent checkbox as the legal basis for every use of your information. If information is necessary to fulfil your request or provide an account, we explain that in the relevant form.


5. Providers and disclosures
Authorised personnel and providers may access information as needed for infrastructure, payments, communications, support and security. Our platform uses Google Cloud infrastructure and Stripe for payment services. A connected provider’s own terms and privacy information also apply to the processing it controls. We do not sell personal data.
We may disclose necessary information to professional advisers, authorities where legally required, or parties to a business restructuring subject to appropriate safeguards. Ask our privacy contact for information about the providers relevant to your service.


6. Payments and connected services
Payment details entered into a payment provider’s checkout are handled by that provider. Do not send card information to our team. We use transaction references and status information to administer your subscription.
When you enable Stripe Connect or another integration for your own business, information needed for that connection is exchanged with the provider. Your business remains responsible for its sales, customer notices and authorised use of the integration. Request deletion separately when required; disconnecting a service does not necessarily erase previously imported records.


7. International transfers
Our service and its providers may involve processing outside the European Economic Area. Where a transfer is subject to GDPR safeguards, it must use an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses, together with supplementary measures where needed. Contact us for the transfer mechanism and a copy or description of relevant safeguards for your service.


8. How long we keep information
Customer workspace data is retained for up to one year after cancellation to support an authorised return to the service, unless deletion is requested earlier or the processing agreement requires an earlier return or deletion. Retention does not extend your right to use the website or platform after the subscription ends. Contact us before relying on restoration.
We retain enquiries, support and security records only while needed for their purpose and any applicable legal claims. Accounting, tax and other records that must be retained by law may be kept longer than the workspace retention period. Restricted records held for a legal obligation are not used to continue marketing or provide a cancelled service.
You can request deletion at our privacy email. We assess the request, verify authority where necessary and explain any lawful reason that prevents immediate or complete deletion. A return-to-service retention period does not override a valid deletion request.


9. Your choices and rights
Depending on the circumstances, you can request access, correction, deletion, restriction or portability, object to processing based on legitimate interests, and withdraw consent. You can object to direct marketing at any time.
Write to arthur.nassar@client-craft.com. We normally respond within one month. If a lawful extension is necessary, we explain it within that first month. We may request proportionate information to verify your identity or authority.
You may complain to the Portuguese supervisory authority, CNPD, or another competent supervisory authority. Contacting us first is not a condition of that right.


10. Cookies and browser storage
Necessary session, authentication and security technologies support the service. Non-essential analytics or advertising technologies, if introduced, require the applicable notice and consent controls before activation where consent is required. Browser settings can limit cookies, although doing so may affect sign-in or other essential functions.
The demonstration site does not send its form entries to Client Craft or store them in browser storage. Its hosting provider may process access and authentication records. No advertising trackers or marketing analytics are included in this site’s application code.


11. Security, children and changes
We use safeguards appropriate to the risks of the processing and restrict access to authorised purposes. No service can guarantee that every security incident will be prevented. Protect your credentials and tell us promptly about suspected unauthorised access.
The service is intended for business users, not for children to create accounts. We do not use the website’s signup or enquiry journey to make solely automated decisions with legal or similarly significant effects.
We update this policy when practices change. The version date identifies the text currently displayed; material changes affecting customers will be communicated where required.