Privacy Policy

Last updated 20 September 2026

This policy explains what Master Craft does with personal information in the Master Craft Employee Experience System (ESS), including information about people who submit an enquiry to us through a Facebook or Instagram lead form.

Who we are

Master Craft is the controller of the personal information described here. You can reach us at support@mastercraftorg.com.

Information we collect from Meta lead forms

When you submit one of our lead forms on Facebook or Instagram, Meta passes us the answers you gave on that form. Depending on the form, that includes:

• your name;
• your telephone number and email address, where the form asked for them;
• your answers to the form's own questions, such as the plot or configuration size you are interested in;
• the identifiers Meta attaches to the submission: the lead identifier, the form, the ad, ad set and campaign it came from, and the Page you submitted it to;
• the time Meta recorded the submission.

We store the answers exactly as Meta reports them, including the original question wording and the language it was asked in. We do not buy personal information about you from anyone, and we do not enrich what you gave us with data from other sources.

Other information in ESS

ESS is primarily an internal system for Master Craft employees, and it holds employment information such as attendance, leave and payroll records for our own staff. That material is unrelated to lead enquiries and is described in our internal employee notices.

Why we use enquiry information

• To answer your enquiry. A member of our sales team contacts you about the project you enquired about.
• To keep a record of that contact so you are not called repeatedly by different people, and so we can see what was discussed.
• To measure our advertising. We record which campaign an enquiry came from so we can tell which advertising is worth continuing. This uses the campaign identifiers, not the content of your conversation.
• To meet our legal and accounting obligations where a transaction follows.

We rely on our legitimate interest in responding to an enquiry you chose to send us, and on your consent where the law requires it. We do not use your enquiry for automated decision-making that produces legal effects about you.

Information we send back to Meta

Where we have enabled it, we tell Meta when an enquiry reached a business milestone - for example that it became a qualified opportunity - so Meta can report on how its advertising performed. We send the outcome and the identifier of the original lead. We do not send the content of your conversations with us, your documents, or any payment information.

Who else can see it

We share personal information only with:

• Meta Platforms, which is the source of the lead and the recipient of the outcome described above;
• our hosting and storage providers, who store the data on our behalf under contract and do not use it for their own purposes;
• professional advisers and authorities, where we are legally required to disclose it.

We do not sell personal information.

Storage and retention

Enquiry records are stored in our database and in private object storage that is not publicly readable. We keep an enquiry for as long as we are actively dealing with it and then for the period we need it for accounting and dispute purposes. When that period ends, or when you ask us to delete it and we have no obligation to keep it, we delete it.

Some records are deliberately append-only - our audit log, for example - because being able to show who did what is the point of keeping it. Where we cannot delete such a record, we remove or mask the personal information inside it instead.

How we protect it

• Access tokens and application secrets are encrypted before they are stored and are never displayed again.
• Uploaded documents are held in private storage; we verify that they cannot be read anonymously.
• Access inside ESS is controlled by permission, checked on the server. Hiding a menu is not how we restrict access.
• Every change to a record is recorded in an audit log that cannot be edited or deleted.
• Inbound webhook deliveries from Meta are rejected unless they carry a valid signature.

Your rights

You can ask us to:

• tell you what we hold about you and give you a copy;
• correct it if it is wrong;
• delete it - see Data deletion;
• stop contacting you;
• restrict or object to a particular use.

Write to support@mastercraftorg.com. We respond within 30 days. If you are not satisfied, you may complain to your data protection authority.

Children

Our advertising and our enquiry forms are directed at adults. We do not knowingly collect information from children. If you believe we have, contact us and we will delete it.

Changes

If we change this policy we will update the date above. Material changes to how we use enquiry information will be described here rather than made quietly.

Contact

support@mastercraftorg.com
See also Terms of Use and Data deletion.