Privacy Policy

Last Updated: 5 April 2026 | Registered business: Crafts by Jon, Deal, Kent, United Kingdom

1. Introduction

This Privacy Policy explains how Crafts by Jon ("we", "us", or "our") collects, uses, stores, and protects personal information when you interact with us — including through our website (craftsbyjon.co.uk), our Facebook Page, our Instagram account, and any automated services we operate using the Meta Platform APIs.

We are committed to handling all data responsibly and in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and Meta's Platform Terms and Developer Policies.

2. Who We Are

Crafts by Jon is a small handmade goods business based in Deal, Kent, UK, selling acrylic bookmarks and keyrings. The data controller for the purposes of UK GDPR is Jon (the sole owner). Contact: jon@craftsbyjon.co.uk.

3. What Data We Collect and Why

3.1 Website Visitors

We do not use cookies for tracking or advertising on this website. We may collect basic server access logs (IP address, page requested, timestamp) for security and performance purposes. These logs are retained for a maximum of 30 days and are not used to identify individuals.

3.2 Direct Contact

If you email us at jon@craftsbyjon.co.uk, we collect your email address and the content of your message in order to respond to your enquiry. This data is retained for up to 12 months and is not shared with third parties.

3.3 Facebook Messenger (pages_messaging)

We use the Meta pages_messaging permission to receive and respond to direct messages sent to our Facebook Page. When you message our Page:

• Your message content and Facebook-provided sender ID are received by our automated system.
• The message is processed in real time by an AI assistant to generate a relevant reply about our products.
• We receive a notification via our internal systems confirming the message was handled.
• Message content is not stored beyond the immediate processing required to generate a reply.
• We do not use message content for advertising, profiling, or any purpose other than responding to your enquiry.

You can stop receiving automated replies at any time by sending "STOP" or by adjusting your Facebook Messenger settings. We comply fully with Meta's Messenger Platform policies, including responding only within the standard messaging window.

3.4 Instagram Direct Messages (instagram_manage_messages)

We use the instagram_manage_messages permission to receive and respond to direct messages sent to our Instagram Business account. The same principles as Section 3.3 apply:

• Message content and the Instagram-provided sender ID are received for real-time processing only.
• Replies are generated automatically to answer product enquiries.
• Message content is not stored beyond immediate use.
• Data is never used for targeting, advertising, or profiling.

3.5 Facebook Page Insights (read_insights)

We use the read_insights permission to access aggregated analytics for our Facebook Page, such as reach, impressions, post engagement, and follower counts. This data:

• Is aggregated and anonymised — it does not identify individual users.
• Is used solely to understand how our content is performing and to inform our posting strategy.
• Is not shared with third parties or used for advertising.

3.6 Instagram Insights (instagram_manage_insights)

We use the instagram_manage_insights permission to access aggregated analytics for our Instagram Business account (reach, impressions, follower activity, etc.). The same principles as Section 3.5 apply — data is aggregated, anonymised, and used only for internal performance review.

3.7 Instagram Content Publishing (instagram_content_publish)

We use the instagram_content_publish permission to publish posts (images and captions) to our own Instagram Business account automatically, as part of our content scheduling. This permission is used to post content about our own products only. No user data is collected or used as part of this process.

3.8 Product Catalogue Management (catalog_management)

We use the catalog_management permission to manage our own product catalogue on Facebook/Instagram. This involves uploading and updating product information (names, prices, images, descriptions) that we own. No personal data belonging to users or customers is collected or processed as part of catalogue management.

4. Meta Platform Data

We access certain data via the Meta Platform APIs (Facebook Graph API) strictly as required to operate the features described above. In accordance with Meta's Platform Terms:

• We do not sell, transfer, or share Meta Platform Data with third parties.
• We do not use Meta Platform Data to make decisions about eligibility for credit, insurance, employment, housing, or other sensitive matters.
• We do not use Meta Platform Data to build profiles on individuals for any purpose beyond responding to their enquiries.
• We do not combine Meta Platform Data with data from other sources for profiling or targeting.
• API access credentials (tokens, keys) are stored securely on our private server and are never exposed publicly.

5. Data Retention and Deletion

We retain different categories of data for different periods:

• Messenger / Instagram DM content: Not retained beyond the immediate processing window (typically seconds).
• Insights / analytics data: Retained for up to 12 months for performance review purposes, then deleted.
• Email correspondence: Retained for up to 12 months, then deleted.
• Server access logs: Retained for up to 30 days, then automatically purged.

If you would like us to delete any personal data we hold about you, please contact us at jon@craftsbyjon.co.uk and we will action your request within 30 days.

6. Your Rights (UK GDPR)

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Erase your data ("right to be forgotten").
• Object to processing of your data.
• Data portability — receive your data in a machine-readable format.
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at jon@craftsbyjon.co.uk. If you believe we have not handled your data correctly, you have the right to complain to the Information Commissioner's Office (ICO).

7. Data Security

We implement appropriate technical and organisational measures to protect personal data, including encrypted server storage, restricted access to API credentials, and HTTPS for all web traffic. No method of transmission over the internet is 100% secure, but we take our obligations seriously and review our security practices regularly.

8. Third-Party Services

Our services make use of the following third-party platforms. Each has its own privacy policy:

• Meta (Facebook / Instagram) — Meta Privacy Policy
• MadeMeShop — our storefront host. Please refer to their privacy policy for purchase-related data.

We do not use Google Analytics, Facebook Pixel, or any advertising tracking on this website.

9. Changes to This Policy

We may update this policy from time to time. The "Last Updated" date at the top of this page will always reflect the most recent version. Continued use of our services after a change constitutes acceptance of the updated policy. For significant changes, we will post a notice on our website.

10. Contact Us

For any questions, data requests, or concerns about this Privacy Policy, please contact:
Jon — Crafts by Jon
📧 jon@craftsbyjon.co.uk
📍 Deal, Kent, United Kingdom