Data Processing Addendum

Roles

• You (the project owner / organization) decide why People and records are stored.
• Crafio processes that data only to provide the backend, admin, MCP, and API.

What we process

Tenant users, collection records, files, email logs, payment metadata, CRM sync payloads, and audit events you or your agents write into a project. Team account data is described in the Privacy Policy and is not “customer content” under this DPA.

Instructions

We process project data only on your documented instructions: the product UI, API, and MCP tools. We will not sell it or use it to train unrelated models.

Security

• Projects are isolated. Tokens do not work across projects.
• Integration secrets are not exposed to agents.
• Team access is role-based (owner, admin, editor, viewer).
• You can revoke tokens and remove teammates at any time.

Subprocessors

We use infrastructure and auth providers to run Crafio (including Clerk for team sign-in). You choose additional processors when you connect Stripe, email, or CRM. You are responsible for those connections.

Assistance and deletion

You can access, correct, and delete project records in the admin or via API. On written request to [email protected] we will help with a reasonable access or deletion request you cannot complete yourself. After you delete a project, we delete live project data, subject to short-lived backups.

International transfers

If this deployment is hosted in a region other than yours, you instruct us to transfer project data to that region as needed to provide the service.

This DPA is part of the Terms of Service.