Privacy Policy
1. Who we are
Comcroft Ltd is the data controller for personal data processed through comcroft.com, registered in England and Wales (company number 17236598).
ICO registration: ZC203672
Contact: support@comcroft.com
2. What data we collect
Account data: Name, email, and profile picture via Auth0 on sign-up.
Profile data: Artists may optionally add a bio, portfolio URL, and tags, displayed publicly.
Transaction data: Project title, description, budget, timeline, and both parties’ names and emails for each commission.
Payment data: We do not store card details. Stripe handles all payment data. We store Stripe payment intent and transfer IDs for record-keeping.
Communications: Messages between buyers and artists, stored for dispute resolution.
Legal acceptance records: Document type, version, and timestamp of each acceptance.
Technical data: Server logs (IP addresses, browser type, pages visited) for security monitoring via Sentry.
3. How we use your data
| Purpose | Legal basis |
|---|---|
| Account management | Contract |
| Processing commissions and payments | Contract |
| Resolving disputes | Legitimate interests |
| Transactional emails | Contract |
| Fraud prevention and security | Legitimate interests |
| Legal compliance and record-keeping | Legal obligation |
| Error monitoring and debugging | Legitimate interests |
We do not use your data for advertising and do not sell it to third parties.
4. Who we share your data with
All processors handle data in accordance with UK GDPR.
Stripe — payment processing (FCA authorised, ref 900461). Privacy policy
Auth0 — authentication. Privacy policy
Supabase — database (EU-hosted). Privacy policy
Resend — transactional email. Privacy policy
Sentry — error monitoring. Privacy policy
5. Retention periods
| Data type | Retention period |
|---|---|
| Account data | Until deletion, plus 30 days |
| Transaction records | 7 years (UK legal requirements) |
| Messages | 2 years from commission date |
| Legal acceptance records | 7 years |
| Server logs | 90 days |
6. Your rights under UK GDPR
You have the right to access, rectify, erase, restrict, or port your data, and to object to processing on legitimate interest grounds. Email support@comcroft.com to exercise these rights — we will respond within one calendar month. You can also export or delete your data from your account settings.
7. Cookies
We use only essential cookies for authentication and sessions. No advertising or tracking cookies.
8. Security
We use HTTPS, role-based access controls, and regular security monitoring. Payment data never touches our servers — it is handled entirely by Stripe.
9. International transfers
Where data is processed outside the UK, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or equivalent adequacy decisions.
10. Children
ComCroft is not for anyone under 18. Contact support@comcroft.com if you believe a child has provided us with personal data.
11. Complaints
You may complain to the Information Commissioner’s Office at ico.org.uk or 0303 123 1113. We’d appreciate the chance to resolve things first — email support@comcroft.com.
12. Contact
Comcroft Ltd — support@comcroft.com