Privacy Policy

StreetCraft ("we," "our," or "the Platform") develops specialized growth and marketing software for physical storefronts—including cafés, bakeries, restaurants, salons, studios, and independent retail shops.

We believe that your store data, menu pricing, slow-hour rhythms, and customer demographics represent the core value of your business. We treat your business operational profile with strict confidentiality and never monetize your data through advertising brokers or third-party behavioral networks.

We collect only the minimum necessary information required to generate localized campaign packs and maintain secure platform operations:

• Account & Authentication Credentials: Your full name, verified business email address, encrypted password hash, and notification preferences.
• Physical Storefront Operational Profile: Store business name, retail category, neighborhood, city, landmark anchors, signature offerings, average ticket values, slow/peak operating hours, and brand tone.
• Campaign & Generation Vault: Generated copy proofs, custom offers, event schedules, in-store poster layouts, and publication logs across Google Business, Instagram, WhatsApp, and print formats.
• Commercial Billing Records: Subscription plan tier, billing frequency (monthly, quarterly, annual), quota usage metrics, and encrypted payment gateway transaction reference identifiers. Raw credit card numbers are never stored on StreetCraft servers.

Storefront data is utilized strictly for executing platform features and delivering your marketing assets:

• Synthesizing coordinated, character-compliant marketing copy tailored to your exact store identity.
• Maintaining your private campaign history, custom templates, and instant re-generation workspace.
• Enforcing subscription quota limits to guarantee equitable AI compute allocation.
• Delivering critical transactional notifications, security verification emails, and opt-in weekly opportunity digests.

StreetCraft enforces database-level Row Level Security (RLS) policies within PostgreSQL. Every campaign draft, store setting, and operational metric is strictly bound to authenticated business team members.

All communications between your browser and our servers are encrypted via TLS 1.3. Stored database records are encrypted at rest with AES-256 standard encryption.

We partner with dedicated infrastructure providers to operate the service. We do not sell or broker your data:

• Transactional Email & Digests: Brevo (DKIM/SPF-signed transactional delivery and notification infrastructure).
• Database & Authentication: Supabase (PostgreSQL with RLS and PKCE secure session management).
• Payment Processing: Razorpay (PCI-DSS Level 1 compliant payment gateway).

Zero Ad Retargeting: We do not run third-party cross-site trackers or sell store behavioral profiles to digital ad networks.

We retain your storefront profile and campaign vault for as long as your account remains active. Unverified signup records older than 1 hour are automatically purged via scheduled database maintenance routines.

Upon account cancellation, your data remains accessible in read-only format under the Free tier. If you request full account erasure, all associated business records, campaigns, and membership links will be permanently deleted within 30 days.

As a storefront operator, you maintain complete authority over your information:

• Access & Export: You can export your generated campaign copy and store context at any time.
• Correction: You can update your business address, signature items, and tone settings directly in your workspace.
• Erasure: You can request permanent account and storefront deletion with immediate effect.

If you have questions regarding this Privacy Policy or wish to exercise data authority rights, please contact our data protection team at privacy@streetcraft.in or reach out via our direct founder support channels.