1. Who we are
Craft Caro (“we”, “us”) is operated by Craft Caro. This policy applies to the Craft Caro Android app and to the website craftcaro.com. By using them you agree to this policy. We act as the “Data Fiduciary” for your personal data under India's Digital Personal Data Protection Act, 2023.
2. Information we collect
Information you give us
- Account details: your name and the phone number or email you sign in with. You can sign in with a phone number (OTP), WhatsApp, Truecaller or Google; we receive your verified number or email and basic profile details from the method you choose.
- Profile & business details: anything you add to appear on your designs — photo, logo, business or party name, designation, address, phone numbers, website and social media handles.
- Content you create or upload: photos you choose for designs or AI creations, images, music you upload, resumes, posts you share in groups, and comments you write (for example in Bhakti).
- Messages to us: what you send through support, the contact form or a deletion request.
Information about purchases
Purchases in the app are made through Google Play. We receive the product, order ID, purchase token, price, currency and status from Google so we can unlock what you bought. We never receive your card, UPI or bank details.
Information collected automatically
- Device & app: device manufacturer and model, Android version, app version, language setting, and a random install ID created by the app (not your IMEI or phone number).
- Usage: which screens and features you use, when you open and leave the app, and actions such as downloads, shares, AI creations and purchases — so we can see how the app is used, fix problems and show our team which features are active.
- Approximate country: from your mobile network. We don't use GPS or precise location. If you enter a state or city in your profile, we use that.
- Technical data: IP address, crash reports and diagnostics (via Firebase Crashlytics), used for security, preventing abuse and fixing errors.
- Notification token: so we can send notifications you have allowed (for example “Your AI creation is ready”).
- Advertising ID: used by our ad partners — see Advertising.
On the website we use only the cookies needed to keep you signed in and protect forms (session and security cookies).
3. App permissions
| Permission | Why we ask |
|---|---|
| Camera | To take a photo for your profile, a design or an AI creation — only when you choose to. |
| Photos, videos & audio | To pick images, videos or music for your designs and to save your designs to your gallery. |
| Notifications | To tell you when an AI creation is ready, about new festival designs and your purchases. You can turn this off at any time. |
| Phone state / phone numbers | To help fill in and verify your phone number at sign-in. |
| Set wallpaper / modify system settings | Only when you choose to set a wallpaper or ringtone from the app. |
| Internet & network state | To load designs and send your requests to our servers. |
We do not access your contacts, microphone recordings, call logs, SMS or precise location.
4. How we use information
- To provide the app: create your account, place your name, photo and logo on designs, save your work and let you download and share it.
- To create AI photos and videos you request (see below).
- To process purchases and subscriptions, unlock premium content and AI credits, and handle refunds.
- To give support and reply to your messages.
- To keep the service safe: prevent fraud and abuse, enforce our Terms and Content Policy.
- To understand and improve the app (which features are used, where it crashes) and to see live usage in our admin dashboard.
- To send notifications you have allowed, and to show ads that keep many features free.
- To meet legal, tax and accounting obligations.
We process your data based on your consent (which you can withdraw at any time) and, where the law allows, for legitimate uses such as providing the service you asked for, security and legal compliance.
5. AI photos & videos
- When you create an AI photo or video, the photo you upload and the chosen template are sent securely to our AI processing provider, which generates the result and returns it to us.
- Your uploaded photo is stored privately — it is never shown publicly or to other users — and is deleted automatically 30 days after the creation finishes.
- The created image or video is kept in “My Creations” until you delete it or your account.
- We don't use your photos to train our own AI models, and we don't sell them.
- Some editing tools (for example background removal and face detection) run on your phone using Google ML Kit; those images are not sent to us.
- Music you upload is reviewed before it can appear in the public music library; until then only you can use it.
6. Who we share it with
We don't sell your personal data. We share it only with service providers who help us run Craft Caro, under contracts that limit their use of it, or when the law requires.
| Provider | Purpose |
|---|---|
| Google (Firebase Authentication, Analytics, Crashlytics, Cloud Messaging; Google Play Billing; AdMob; Google Sign-In; ML Kit) | Sign-in, app analytics and crash reports, notifications, payments, ads, on-device image tools |
| Truecaller | Sign-in with Truecaller, if you choose it |
| Meta (Facebook SDK, Audience Network) and Unity Ads | Ads shown through AdMob mediation; app event measurement |
| OneSignal | Push notifications |
| Our AI processing provider | Creating the AI photos and videos you request |
| Our hosting and storage providers | Running our servers and storing your designs securely |
We may also disclose information if required by law, a court or a government authority, to protect the rights and safety of our users or the public, or as part of a merger or acquisition (in which case this policy continues to apply).
7. Advertising
Free parts of the app show ads from Google AdMob and its mediation partners (Meta Audience Network, Unity Ads). These partners may use your device's advertising ID and app activity to show more relevant ads and measure them. You can reset or delete your advertising ID, or opt out of personalised ads, in your phone's Settings → Google → Ads (or Settings → Privacy → Ads). Premium plans that include ad-free use stop these ads.
8. How long we keep it
- Account, profile and designs: while your account is active. When you delete your account we delete this data within 30 days.
- Photos uploaded for AI: deleted automatically 30 days after the creation finishes.
- Usage and device data: only as long as needed for the purposes above; when your account is deleted it is deleted or made anonymous.
- Purchase and payment records: for as long as tax, accounting and legal rules require, even after account deletion.
- Support messages: as long as needed to resolve your request and keep a record of it.
9. Your rights & choices
Under the Digital Personal Data Protection Act, 2023 you can:
- Access a summary of the personal data we hold about you and how we use it.
- Correct or update it — most details can be edited in your profile.
- Erase it — delete your account in the app (Profile → Delete account) or request deletion online.
- Withdraw consent at any time (for example turn off notifications, reset your advertising ID, or stop using a feature). This doesn't affect processing done before.
- Nominate someone to exercise these rights if you die or become unable to.
- Raise a grievance with our Grievance Officer (below), and if you're not satisfied, with the Data Protection Board of India.
To make a request, email support@craftcaro.com from your registered email or mention your registered phone number. We may ask you to confirm it's your account.
10. Children
Craft Caro is intended for people aged 18 and over. Anyone under 18 may use it only with the consent and supervision of a parent or guardian. We don't knowingly collect children's personal data without that consent and we don't target ads to children. If you believe a child has given us personal data without consent, contact us and we will delete it.
11. Security
We protect your data with encrypted connections (HTTPS), access controls, private storage for uploaded photos, and signed tokens for your account. Payments are handled by Google Play, so we never see your payment details. No system is completely secure, but we work to protect your data and will notify you and the authorities of a breach as the law requires.
12. Where data is processed
Our servers and some of our providers (such as Google, Meta and our AI processing provider) may process data outside India. When that happens we rely on those providers' safeguards and only transfer data as permitted by Indian law.
13. Changes to this policy
We may update this policy as the app changes. We'll change the “Last updated” date above, and for important changes we'll tell you in the app before they take effect.
14. Contact & Grievance Officer
Craft Caro
Email: support@craftcaro.com
Grievance Officer (Information Technology Rules, 2021 and Digital Personal Data Protection Act, 2023)
Email: support@craftcaro.com
We acknowledge complaints within 24 hours and aim to resolve them within 15 days.