Privacy

Last updated: 13 October 2026

This is a translation of the Bulgarian text. If the two differ, the Bulgarian version prevails.

“Crafts with a Spark” (crafthallspark.com and app.crafthallspark.com) is a free platform where artists show objects they have made, and visitors browse them and contact the artists directly. Here we explain what we keep about you, why, and what your rights are.

Who is responsible for the data

The data controller (the person who decides why and how the data is processed) is Liliya Katsarova, a private individual in Bulgaria who runs the site as a non-commercial project. For anything about your data, write to welcome@crafthallspark.com. We answer within one month at the latest.

What data we collect

If you only browse

We do not create an account for you and we do not set cookies. We count visits with Cloudflare Web Analytics, which works without cookies and does not identify you. Your language choice (BG / EN) is remembered in your browser; it is not a cookie and it is not used for tracking.

Cloudflare, whose network delivers the site, and the app process technical data - your IP address and data about your browser. This is needed to deliver the pages to you and to protect the site from abuse, for example during the check that forms are filled in by a person. This data is kept for 7 days at most and is not used for advertising.

If you have an account

In addition to the above we keep:

• your sign-in email and password;
• the name from your sign-up - it is the name of your page and makes its address; you can change the name, the address stays;
• at every sign-in - your IP address and browser type, to protect your account from access by someone else;
• your profile: materials, city, short introduction and, optionally, contact details - a phone, an email and up to three links;
• your works: title, description, material and photos;
• one sign-in cookie (session). It is the only cookie we set and it is required for the site to work.

Your profile, works and photos are public - that is the purpose of your page. Contact details are shown only because you added them, and you can remove them at any time. Your sign-in email and password are never public. The administrator sees a list of the artists with their sign-in email, in order to act when the terms are broken.

Photos

Before upload we remove the embedded technical data (EXIF), including the location from the phone. If the “Watermark” setting is on - and it is on by default - your page address is written on the photo when it is uploaded. You can switch it off in the settings; that applies to photos uploaded afterwards. Photos are delivered through an address that cannot be guessed, are shown on your page and in the gallery, and may be found by search engines. When you delete a photo, we remove it from storage immediately and ask Cloudflare to remove its copies from its network - usually within seconds, one hour at the latest.

Emails we send

We send only service emails: confirmation of sign-up, a link for a new password and, when needed, an important notice about the service. We send them through Resend. We do not send advertising or newsletters.

Why we process it and on what basis

• Sign-in email and password, name, profile, works and photos - so that the service works: account, sign-in, public page, service emails. Basis: performance of the terms of use you accepted.
• Contact details (phone, email, links) - so that visitors can reach you. Basis: performance of the terms.
• Technical data (IP address, browser type), sign-in records - security of the site and protection against abuse. Basis: our legitimate interest.
• Reports and hiding of content - reviewing reports of infringed rights. Basis: our legitimate interest.
• Summary statistics without cookies - to know how much the site is visited. Basis: our legitimate interest.
• Data under a legal request - answering a request from a public authority. Basis: legal obligation.

A separate case: photos in which a person can be recognised. We show them as the artist uploaded them. The basis is the consent of the person shown, which the artist must have obtained under the terms; it can be withdrawn at any time (see “Your rights”). What we do on a report about such a photo is described in the Terms of use.

Your name, email and password are required to sign up. For your page to be published, at least one material and a city are also needed. Everything else is your choice. We do not make automated decisions about you and we do not do profiling.

How long we keep it

• Profile, works and photos: for as long as your account exists. When it is deleted - by you, or by the administrator for breaking the terms - we immediately remove everything from the live system: the profile, the works, the photos and the account itself. From the backups the data disappears within 30 days. If your page is only hidden, your data stays and you still have access to it.
• A sign-up not confirmed by email: 7 days, then it is deleted by the daily clean-up.
• Sign-in records (IP address, browser type): 7 days after your last visit.
• Technical data for the security of the site: up to 7 days.
• Reports: 12 months after they are reviewed, or until the account they are about is deleted - whichever comes first. A report that has not been reviewed is kept until it is.
• Backups of the database: up to 30 days, after which they disappear automatically.

If the service is discontinued, we will notify you by email at least 30 days in advance, so that you can download your works and data; after that we delete everything.

Search engines and chat apps may keep their own copy or preview of your page for some time after you delete it. That is outside our control.

How we protect it

The connection to the site is encrypted. Passwords are stored only in a protected, unreadable form. The database and the photos are kept in the European Union. Only the administrator has access to the administration area, and that account is protected with two-factor sign-in. There are limits against automated sign-in attempts and reports.

No system is completely secure. If we learn of a breach that endangers your rights, we will notify the Commission for Personal Data Protection and, where necessary, the people affected.

Who else sees it

Two providers process data on our behalf under a data processing agreement, and your messages reach us through a third:

• Cloudflare, Inc. (USA) - network, hosting, database, photo storage, cookieless statistics and protection of the site. The network is worldwide, so technical data such as your IP address may also be processed outside the EU. For the protection against automated programs Cloudflare also uses technical data for a purpose of its own - improving that protection; Cloudflare is responsible for that.
• Resend (Plus Five Five, Inc., USA) - sending the service emails. Your email address and the text of the message are processed in the United States.
• Google (Gmail, USA) - the personal mailbox in which we receive your messages and the reports. Google keeps the data in the EU and the United States under its own terms.

All three are American companies. Data is transferred to the United States on the basis of the standard contractual clauses approved by the European Commission, which are part of our agreements with Cloudflare and Resend, and of the EU-US Data Privacy Framework where the provider is certified under it. The agreements: Cloudflare, Resend. You can also ask us for a copy.

We do not sell data and do not pass it to anyone else, unless the law obliges us.

Your rights

• Access, a copy and portability: from “My page” you can download your profile and works as a JSON file (a format other programs can read) and all your photos in one archive. For the other data, write to us.
• Correction: you can edit your profile and works at any time. Your sign-in email and the address of your page cannot be changed by you; write to us and we will help.
• Deletion: the “Delete account” button in “My page” removes everything forever, without any further confirmation from us; the periods are described in “How long we keep it”.
• Restriction and objection: you can ask us to stop showing or using your data for a time, and you can object to processing based on legitimate interest.
• Withdrawal of consent: where we process data on the basis of consent - for example a photo in which a person can be recognised - you can withdraw that consent at any time by writing to us. The withdrawal does not affect the processing before it.
• Complaint: to the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, kzld@cpdp.bg, www.cpdp.bg.

Everyone whose data we process has these rights, also without an account - for example if you are in a photo or sent a report. We may ask you to confirm that the request comes from you.

Reports and removal of content

If you believe that a page or a work infringes your rights - for example, it shows your work, your photo or your personal data without permission - use “Report a problem” at the bottom of the page or write to us. From the report we keep the reason, your text and your email, if you gave it, for the period in “How long we keep it”. The report reaches the administrator by email. The artist does not see who sent the report. How we review reports and what may follow is described in the Terms of use, section “Reports and removal”.

Children

The site is not intended for children under 14 and we do not knowingly collect their data. If you believe that a child under 14 has created an account, write to us and we will delete it.

Changes

If we change this page, we will update the date at the top. For a significant change we will notify registered artists by email.