Privacy Policy

Corporate ownership and administration. Crafters Apex is a service and brand owned and administered by Crafters Corporation. The corporation owns the intellectual property in the original Crafters Apex brand identity and materials. This ownership statement does not claim that any particular trademark registration has been granted. The registered legal data controller, its address and privacy contact details must still be confirmed and completed before public use. You can reach the support team through the Contact page while those details are being completed.

We collect only the data we need to create your account, run your servers, take payment and keep the platform secure. The data falls into the groups below.

A. Data you give us

• Account Information: username, email address and a password. Passwords are stored only as an encrypted hash; we cannot read them.
• Profile Information: the display name you set in Settings. Profile photo, description and email changes are not available yet, so we do not collect them.
• Server and Bot Information: the bot name, optional description and location you enter during checkout, and the files, code, environment variables and configuration you upload or create on your server.
• Billing Information: subscription plan, billing cycle, subscription status and transaction history. We never receive or store full card numbers; payments are handled entirely by our payment processor, Whop.com.
• Communication Data: messages and attachments you choose to include in a private support ticket on our official Discord server, email correspondence for legal/privacy/access matters, and any review you choose to publish on our website. Please do not include passwords, payment-card data, authentication codes, private keys or secret tokens.
• Discord Identity: your Discord User ID, where applicable (for example, when it is used for support ticket verification or community role syncing).

B. Data collected automatically

• Usage Data: server resource consumption (CPU, RAM, disk), power actions, connection logs and API request logs, retained for up to 90 days.
• Technical Data: IP address, browser type, operating system, device information and session tokens, used for security, abuse prevention and fraud detection.
• Browser Storage: a secure session cookie and a small user record (display name, email and verification status) stored in your browser, as described in Section 5 and in our Cookie Policy.

C. Data received from third parties

• Social sign-in (Discord, Google, GitHub): if you sign in with one of these providers, we receive the basic profile information the provider shares with us, such as your username and email address, which we use to pre-fill and create your account.
• VPS deployment forms: technical configuration choices and a delivery email are used to prepare the requested server after payment. The SSH private key is generated in the customer’s browser and is not collected or stored.

D. What we do not collect

• We do not store full payment card numbers, card security codes or bank details.
• We do not run advertising trackers and we do not use analytics platforms that build profiles of visitors.
• We do not collect the contents of your bot or application for any purpose other than running it for you, as explained in Section 8.

We use the information we collect for the following purposes:

• To provision, operate, and maintain the hosting services you subscribe to.
• To process payments and manage your subscription.
• To communicate with you about your account, support requests, and important service updates.
• To enforce our Terms of Service and Acceptable Use Policy.
• To detect and prevent fraud, abuse, and security incidents.
• To improve and develop our services based on aggregated, anonymized usage trends.

We do not sell, rent, or share your personal data with third parties for their own marketing purposes. This commitment extends to your intellectual property as well: we will never sell, rent, share, inspect for commercial gain, or otherwise disclose the source code of your bots or applications to any third party. We will never use your data for purposes incompatible with those described in this policy without your explicit consent.

We do not sell your personal data, we do not rent it, and we do not share it for advertising. We share data only with the service providers below, and only the minimum needed for each one to do its job:

• Authentication (Supabase): creates and secures your login, and manages your session.
• Infrastructure (Microsoft Azure): hosts the virtual machine, disks and network resources requested through the VPS form. Azure credentials are used only by our Worker and are never exposed to the website.
• Payment Processing (Whop.com): we share the minimum data needed to verify a transaction and associate each membership with the correct server. Whop processes payment details under its own privacy policy.
• Server control plane (Pterodactyl/Wings): server name, runtime settings, resource allocation and account identifiers needed to create and operate the server.
• Support tickets (Discord): if you contact us through Discord, Discord processes your messages, account identifiers and attachments under its own privacy terms. We use ticket content to investigate and answer your request.
• DNS, CDN and security (Cloudflare): API routing, DDoS mitigation, content delivery and hosting of this website.
• Social sign-in providers (Discord, Google, GitHub): only if you choose to sign in with them. They receive the information needed to authenticate you, under their own privacy policies.
• Typography (Google Fonts): your browser requests font files from Google when you load our pages, which exposes your IP address to Google.

Each provider is independently operated and may process data under its own terms and privacy policy; we do not control processing performed by a provider for its own purposes. We take reasonable steps to use providers and configurations appropriate to the service, and we disclose data when legally required or reasonably necessary to protect people, systems or the service. If the operating entity changes, we will update this policy and provide notice where required by law.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. Specifically:

• Active account data is retained for the duration of your subscription.
• After account deletion, we retain anonymized billing records for up to 7 years to comply with financial regulations.
• Server logs and usage metrics are retained for 90 days.
• Support correspondence is retained for up to 2 years.

If a bot-hosting subscription expires, only the server linked to it may be suspended; expiry does not automatically delete it. The account owner may separately delete that expired server through the dashboard, which permanently removes its files and data. We do not promise indefinite retention or restoration of expired-server data, and we may remove data when reasonably necessary for security, legal compliance or infrastructure operations, subject to applicable law and required notice. Billing and tax records may be retained longer where required by law. Data that has been irreversibly anonymized may be retained for aggregated statistics.

We use cookies and similar technologies only to keep you signed in, protect the platform and remember your interface state. When you sign in, your browser stores the following in its local storage:

• cb_access_token (HttpOnly cookie): authenticates your session with our API and control panel. Scripts on the page cannot read it, and it expires on its own, after which you are logged out automatically.
• cb_verified (HttpOnly cookie): legacy cookie from a previous release. The current app does not use it to authorize changes and clears it when you log out.
• cb_user (local storage): your display name, email and verification status, kept locally so the dashboard loads faster. It never contains a password or a session token.

Cloudflare may also set security cookies for DDoS protection, and Whop may set its own cookies while you complete a payment. We do not use advertising or cross-site tracking cookies. You can clear this data at any time from your browser settings or by logging out, but removing the items above signs you out. Full details are in our Cookie Policy.

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data ("right to be forgotten"), subject to legal obligations.
• Portability: Request your data in a structured, machine-readable format.
• Objection: Object to certain types of data processing.

To exercise any of these rights, please contact us via our Contact page. We will respond within 30 days.

You may also withdraw any consent you have given at any time, without affecting processing that took place before the withdrawal, and you may lodge a complaint with your local data protection authority. If you live in California, you have the right to know what personal information we collect, to request its deletion, and to not be discriminated against for exercising these rights; we do not sell personal information. We may need to verify your identity before acting on a request, and we may decline requests that are unfounded or that conflict with a legal obligation.

We implement industry-standard security measures including TLS/SSL encryption for all data in transit, bcrypt hashing for passwords, network-level DDoS mitigation, and role-based access controls for our internal systems. Despite these measures, no method of transmission over the internet is 100% secure.

Your server's files, source code, console, SSH keys and configuration are private by default. For unmanaged VPS infrastructure, Crafters Apex does not have access to or control over your private SSH key, internal network traffic, databases or logical server configuration. Our technical staff will only access the internal contents of a customer's server under one of the following two circumstances, and never otherwise:

• You explicitly request it. You have opened a support ticket asking our team to look into a technical issue that requires inspecting your files, configuration, or console output.
• Reasonable suspicion of a policy violation. We have a well-founded, reasonable suspicion that the server is being used in violation of our Acceptable Use Policy (for example, evidence of a DDoS attack, malware, or cryptomining originating from that server).

Outside of these two circumstances, our staff does not browse, inspect, copy, or otherwise access the contents of any customer's server. All staff access, when it occurs, is logged internally for accountability.

If you use our official mobile application, please note that it is designed strictly for server administration. The application connects directly to our secure APIs to allow you to manage your services.

The mobile application does not collect, process, or store any billing or payment information, as all billing management is strictly handled through our official website. The data collected by the app is limited to authentication tokens and server management logs, which are treated with the same strict security and retention policies outlined in this document.

Our services are not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have inadvertently collected such data, we will take steps to delete it promptly.

Where the law requires us to have a legal basis, we rely on the following:

• Performance of a contract: creating your account, provisioning and running your servers, managing your subscription and giving you support.
• Legitimate interests: securing the platform, preventing fraud, abuse and chargebacks, enforcing our Acceptable Use Policy, diagnosing problems and improving the service, always weighed against your rights and expectations.
• Legal obligation: keeping billing and tax records and responding to lawful requests from authorities.
• Consent: any optional use of your data that we explain and ask you to agree to at the time. You can withdraw it whenever you wish.

Our servers run on Microsoft Azure infrastructure, currently in the United States (US East), and our providers operate in several countries. This means your data may be processed outside the country where you live, including in countries whose data protection rules differ from yours. Where the law requires it, we rely on appropriate safeguards such as contractual protections with our providers. By using the service you understand that your data is transferred to and processed in these locations.

You can cancel each bot-server subscription separately from its dashboard card. To delete your account or exercise a right described in Section 6, use the privacy contact method on our Contact page, preferably from the email address linked to your account so we can verify your identity. Do not post sensitive privacy requests in a public Discord channel. We will respond within the period required by applicable law.

Deleting your account removes your personal data and server files, except for the records we must keep by law (for example anonymized billing records, as described in Section 4). Deletion of server files is permanent and cannot be undone.

If a security incident affects your personal data and creates a risk to you, we will investigate it promptly, take steps to contain it, and notify the affected users and the competent authorities without undue delay where the law requires, explaining what happened, what data was involved and what you can do to protect yourself.

Our website links to third-party sites and services, such as Discord, Trustpilot, Whop and social networks. We do not control them and are not responsible for their content or privacy practices. We encourage you to read their policies before sharing information with them.

We may update this policy to reflect changes in our service, our providers or the law. When a change is material, we will notify active customers by email or by a notice in the dashboard before it takes effect. The “Last updated” date at the top of this page shows when it was last revised. Continuing to use the service after a change takes effect means you accept the updated policy.

If you have questions about this Privacy Policy or a personal-data request, use the privacy contact method on our Contact page. For ordinary account or service support, open a private Discord ticket; do not share sensitive data in a public channel.