Privacy Policy

Last updated: September 12, 2026

This Privacy Policy outlines how Krafto Digital Technologies Private Limited ("Krafto", "we", "us", or "our"), registered at Level 5, Cyber City, Hitech City, Hyderabad, Telangana 500081, India, collects, uses, stores, and protects personal data obtained through trykrafto.xyz, our developer platform, and our Model Context Protocol (MCP) integrations.

1. Information We Collect

We collect information in the following categories:

• Account Information: Name, verified email address, hashed passwords, profile avatar, language preference, and authentication timestamps;
• Transaction & Order Metadata: Purchased item IDs, license types, order references, billing timestamps, and payment gateway transaction references (we do not store credit/debit card numbers or UPI PINs);
• Developer & MCP Telemetry: API keys, MCP session tokens, tool call timestamps, endpoint request volumes, and IP addresses for security verification;
• Vendor KYC & Tax Data: For approved vendors, store information, government tax IDs (PAN/GST/EIN where applicable), and bank account payout routing details;
• Technical & Usage Logs: IP address, device identifiers, browser specifications, referral URLs, and error diagnostics.

2. How We Use Your Data

• To create, manage, and safeguard your user account and subscription entitlements;
• To securely deliver purchased source files, generate download tokens, and manage license keys;
• To authenticate and enforce rate-limiting for Developer APIs and MCP server tools;
• To process transactions, prevent payment fraud, and fulfill tax reporting requirements;
• To send transactional receipts, security alerts, and customer support responses;
• To analyze platform performance and improve catalog relevance.

3. Third-Party Data Processors

We work with trusted infrastructure and payment partners to deliver the Service:

• Supabase: Scalable database management, secure authentication, and encrypted object storage;
• Razorpay & Stripe: PCI-DSS compliant payment gateways for secure checkout and currency processing;
• Resend: Secure delivery of transactional order receipts and account verification emails;
• Vercel: Global edge application deployment and DDoS mitigation.

4. Data Retention & Security Measures

We implement industry-standard encryption (TLS 1.3 in transit and AES-256 at rest) to protect your personal data. Account records and purchase histories are retained for as long as your account remains active, and for necessary statutory periods required under Indian tax and corporate regulations.

5. Your Rights & Choices

Under applicable data protection laws (including the Digital Personal Data Protection Act and GDPR), you have the right to:

• Access a copy of the personal data we hold about you;
• Request correction of inaccurate or incomplete profile records;
• Request deletion of your account and associated personal data, subject to legal record-keeping obligations;
• Revoke developer API keys and MCP authentication tokens at any time via your settings dashboard.

6. Data Protection & Grievance Officer

If you have questions regarding data privacy or wish to exercise your data rights, contact our designated Grievance Officer: