Privacy Policy

Ply Craft Ltd. ("Ply," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use the Ply platform, including our website, creator tools, and marketplace services (the "Platform"). We operate in compliance with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and the Data Protection Act 2018.

What We Collect

We collect the following categories of personal data:

Account information: Name, email address, password (hashed), country of residence, and preferred language when you register for an account.

Creator profile data: Display name, biography, profile photo, social media links, portfolio information, and craft specialisms you choose to share publicly.

Financial data: Bank account details, tax identification information, and payment history processed through Stripe Connect. We do not store full bank account or card numbers on our servers; this data is held by Stripe in accordance with PCI DSS standards.

Transaction data: Records of pattern purchases, yarn sales attributions, revenue share calculations, and payout history.

Usage data: Pages visited, features used, timestamps, referring URLs, browser type, device type, and IP address (anonymised after 30 days).

Communications: Emails, support requests, and feedback you send to us.

How We Use It

We use your personal data for the following purposes:

• —To provide, maintain, and improve the Platform and its features
• —To process transactions, calculate revenue shares, and issue payouts
• —To communicate with you about your account, including service updates and security alerts
• —To send marketing communications (only with your explicit consent, which you may withdraw at any time)
• —To detect and prevent fraud, abuse, and security incidents
• —To comply with legal obligations and respond to lawful requests from public authorities
• —To analyse aggregate, anonymised usage patterns to improve the Platform

Legal Basis

We process your personal data under the following legal bases as defined by the GDPR:

Performance of a contract: Processing necessary to provide the Platform services, manage your account, and fulfil our obligations under the Terms of Service and Creator Agreement.

Legitimate interests: Processing for fraud prevention, platform security, and service improvement, where such interests are not overridden by your rights and freedoms.

Legal obligation: Processing required to comply with tax reporting, anti-money laundering, and other legal requirements.

Consent: Processing for marketing communications and non-essential cookies, based on your freely given, informed consent.

Data Sharing

We do not sell your personal data. We share data only with the following categories of recipients, and only to the extent necessary:

• —Stripe: Payment processing and KYC verification
• —Hosting providers: Cloud infrastructure for Platform operation (EU-based or with adequate safeguards)
• —Analytics: Privacy-respecting analytics service (no personal data shared; aggregated, anonymised metrics only)
• —Legal authorities: When required by law, court order, or governmental regulation

All third-party processors are bound by data processing agreements that require them to process data only on our instructions and in accordance with applicable data protection law.

Cookies

We use essential cookies required for the Platform to function (session management and authentication). We do not use third-party advertising cookies. For full details, see our Cookie Policy.

Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• —Right of access: Request a copy of the personal data we hold about you
• —Right to rectification: Request correction of inaccurate or incomplete data
• —Right to erasure: Request deletion of your personal data, subject to legal retention requirements
• —Right to data portability: Receive your data in a structured, commonly used, machine-readable format (JSON or CSV)
• —Right to restrict processing: Request limitation of processing in certain circumstances
• —Right to object: Object to processing based on legitimate interests or for direct marketing purposes
• —Right to withdraw consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at privacy@plycraft.co. We will respond within thirty (30) days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the UK or your local supervisory authority.

Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy:

• —Account data: Retained while your account is active and for 30 days after deletion
• —Transaction records: Retained for 7 years to comply with tax and accounting obligations
• —Usage data: IP addresses anonymised after 30 days; aggregated analytics retained indefinitely
• —Communications: Retained for 2 years after your last interaction, unless required longer for legal purposes

Contact

For any privacy-related questions, concerns, or requests, contact our Data Protection team: