KRAFTSPACE PRIVACY POLICY

1. Who We Are

[KraftSpace Legal Entity Name] (“KraftSpace”, “we”, “us”, “our”) operates the KraftSpace website, applications, professional marketplace, project marketplace, KAI/AI services, communications, payment and related services (“Services”). Registered office: [Full Legal Address]. Privacy contact: [privacy@domain.com]. Grievance contact: [grievance@domain.com]. Data Protection Officer/authorised contact, where applicable: [details].

2. Scope

This Policy applies to clients, professionals, visitors, account holders, business/studio representatives and other people whose personal information is processed through the Services. Third-party services are governed by their own privacy notices.

3. Information We Collect

• Account and identity data: name, email, phone, login details, role, profile image and verification information.
• Professional data: studio/business information, categories, services, capabilities, experience, portfolio/project records, locations served, availability, ratings and reviews.
• Client/project data: project type, category, location, budget, area, style, requirements, services, timeline, preferences and project status.
• Content: images, drawings, briefs, PDFs, BOQs, estimates, messages, comments, documents and other uploads.
• Transaction data: payment status, transaction/reference IDs, invoice/billing information and limited payment-provider data.
• Technical/usage data: IP address, device/browser information, timestamps, logs, searches, pages viewed, approximate location and usage events.
• AI/matching data: prompts, structured answers, project/profile attributes, matching inputs, recommendations, explanations and feedback.

4. Purposes of Processing

We use information to create accounts; authenticate users; operate projects and profiles; power search, filters and KAI matching; generate dynamic forms; validate project completeness; recommend professionals/projects; facilitate proposals, shortlists, communications and hiring; process payments and contact-unlock services; provide support and notifications; prevent fraud and abuse; secure the platform; analyze performance; improve ranking/matching; and comply with law.

5. KAI, AI and Automated Matching

KAI may structure user input, suggest missing information, retrieve candidates, calculate match scores, compare project requirements with professional capabilities and portfolio evidence, and provide explanations.

Match scores are recommendations, not guarantees of quality, availability, hiring, project success or suitability.

Matching may use structured rules, search/retrieval, semantic similarity, portfolio evidence, availability, experience, ratings and platform outcome signals.

Users should independently verify important facts and should not rely on KAI as legal, financial, architectural, engineering, construction or other regulated professional advice.

Where applicable law requires information about automated decision-making or rights relating to it, KraftSpace will provide the required information.

6. Legal Grounds

Where India's Digital Personal Data Protection Act, 2023 and applicable Rules apply, KraftSpace will process personal data in accordance with applicable lawful grounds, notices and consent requirements. The Act provides for lawful processing based on consent or specified legitimate uses and gives Data Principals rights including withdrawal of consent.

Where GDPR or another privacy regime applies, KraftSpace will identify the applicable legal basis and provide required transparency, retention and rights information. GDPR transparency requirements include purposes, data categories, legal basis and retention information.

7. Consent and Withdrawal

Where consent is the processing basis, users may withdraw it through the method KraftSpace provides. Withdrawal does not invalidate processing already performed lawfully and may affect features requiring the relevant data. Under India's DPDP Act, consent is intended to be free, specific, informed, unconditional and unambiguous, with withdrawal as easy as giving consent.

8. Sharing of Information

We may share information with other users according to project visibility, role, privacy controls and marketplace workflow.

We use service providers/processors for hosting, storage, authentication, analytics, communications, payments, security, AI infrastructure and support.

We may disclose information to regulators, courts, law enforcement or other parties where legally required or permitted.

Information may be transferred as part of a merger, acquisition, financing or sale of assets.

Certain professional/client contact details may remain hidden until an applicable contact-unlock condition is satisfied.

9. Contact Unlock

KraftSpace may offer paid or subscription-based contact unlocking. Before unlock, discovery APIs/interfaces should expose only information necessary for discovery. After a valid unlock/payment, only the permitted contact fields are revealed. Unlock and payment events may be logged for security, audit, support and dispute handling.

10. Cookies and Similar Technologies

We may use cookies, local storage, pixels, SDKs and similar technologies for authentication, preferences, security, analytics and performance, and for marketing where permitted. Where required, non-essential technologies will be controlled through an appropriate consent mechanism.

11. Retention

We retain information only as long as reasonably necessary for the purposes described in this Policy, including account operation, contracts, security, fraud prevention, disputes, accounting and legal obligations.

Final retention periods must be configured by data category before launch. The DPDP Rules 2025 include requirements concerning reasonable security safeguards, breach notification and specified-purpose retention/erasure.

12. Security and Breaches

KraftSpace uses reasonable technical and organizational safeguards such as encryption in transit, access controls, authentication, monitoring, backups, secure file access and logging. No system is completely secure.

If a personal-data breach occurs, KraftSpace will assess, contain, investigate and notify affected persons/regulators as required by applicable law. The notified DPDP Rules 2025 prescribe breach-related requirements and timelines.

13. Your Privacy Rights

Depending on applicable law, you may have rights to access, correct, delete/erase, withdraw consent, object, restrict processing, obtain portability, obtain information about processing and automated decision-making, and lodge grievances.

GDPR rights include access, rectification, erasure, restriction, portability and objection in specified circumstances.

14. Exercising Rights / Grievance

Contact: [privacy@domain.com]. Grievance Officer: [Name / Email / Address]. We may request reasonable identity verification. Requests will be handled within applicable legal timelines.

Where KraftSpace is subject to applicable Indian IT intermediary requirements, the platform should publish the required rules, privacy policy, user agreement and grievance mechanism.

15. Children

The Services are not intended for persons who cannot legally use them. Do not submit children's personal data unless legally authorized and necessary.

16. International Processing

KraftSpace and its service providers may process information outside your country. Where applicable law restricts international transfers, we will use legally recognized safeguards.

17. Third-Party Services

Payment processors, cloud providers, maps, analytics, communications, meeting tools and AI providers may process information under their own terms and privacy policies.

18. Changes

We may update this Policy. Material changes will be communicated through the Services or other appropriate means where required.

19. Contact