Privacy Policy

Craftex operates a global tender platform connecting real estate developers with construction contractors and subcontractors. We act as the data controller for account and platform data. Questions: privacy@craftex.com.

Account data: email address, role (developer, contractor or admin), authentication credentials (stored as salted hashes) and account status.

Profile data: company name, registration number, contact details, regions of operation, specializations, years of experience, team size, price range, logo, portfolio entries and uploaded licences or certifications.

Project data: tenders you publish, their descriptions, locations, budgets, deadlines and attachments; bids you submit including price, timeline, notes and documents.

Communications: messages exchanged with other users on the platform, reviews you write, and reports you file.

Usage data: product activity such as profile views, bid events, sign-in timestamps, device and browser information, and IP address, used to operate, secure and improve the service.

Billing data: plan, subscription status and billing history. Card details are handled by our payment provider Paddle and never stored by us.

To create and maintain your account, publish and match tenders, deliver bids and messages, and show ratings and reviews.

To verify companies, moderate content, investigate reports and resolve disputes.

To bill subscriptions, prevent fraud and secure the platform.

To send service notifications about new bids, messages and status changes, and — where you have not opted out — occasional product updates.

To produce aggregate, non-identifying statistics about platform activity.

We process data to perform our contract with you (operating your account), on the basis of legitimate interests (security, fraud prevention, product improvement, moderation), to comply with legal obligations (tax and accounting records), and with your consent where consent is required, such as optional marketing email.

Profile information you publish — company, specializations, regions, rating, verification status and portfolio — is visible to other signed-in users and may appear in the public contractor directory.

Tender details, attachments, bids and messages are visible only to the developer who published the tender and the contractors involved, plus Craftex administrators when investigating a report or dispute.

We never sell personal data and do not share it for third-party advertising.

Supabase (authentication, database, file storage, backups), Paddle.com Market Ltd (Merchant of Record for subscription billing, tax and invoicing) and Cloudflare (hosting and content delivery). Each processes data only on our instructions and under contract.

Account and profile data is kept while your account is active. After closure we delete or anonymise personal data within 90 days, except records we must retain for billing, tax, legal or dispute purposes. Tender and bid records may be retained in anonymised form for platform statistics.

Traffic is encrypted with TLS, data is encrypted at rest by our infrastructure providers, and access is enforced with row-level database policies so users only reach records they are party to. Details are on the Trust & security page. No system is perfectly secure, so please use a strong, unique password.

Subject to your local law, you may request access to your data, correction, deletion, export in a portable format, restriction of processing, or object to processing based on legitimate interests. You can also withdraw consent to marketing at any time. Contact privacy@craftex.com; we respond within 30 days.

We use cookies and local storage that are strictly necessary to keep you signed in and to remember interface preferences. We do not run third-party advertising trackers.

Craftex is used worldwide, and our providers may process data in countries other than yours. Where required, transfers rely on standard contractual clauses or an equivalent safeguard.

The platform is for business use and is not directed at anyone under 18. We do not knowingly collect data from children.

We will update this page when our practices change and, for material changes, notify account holders by email or in-app notice before they take effect.