Ucraft

GDPR overview

The privacy policy is an iubenda document that states explicitly it was drafted under Articles 13 and 14 of Regulation (EU) 2016/679. It lists the full set of data subject rights: withdrawal of consent, objection, access, rectification, restriction, erasure, portability and complaint to a supervisory authority, with a one-month, free-of-charge response commitment through a single contact address. Two gaps matter. The document has not been revised since 12 May 2020 and still describes several processors as Privacy Shield participants, a framework struck down that same year. And no Data Protection Officer and no Article 27 EU representative are named anywhere, while no Data Processing Agreement is offered. Compliance is claimed by construction, never asserted in so many words.

Who owns the data?

The terms are published by Ucraft LLC, while the privacy policy names Soft Construct LLC at the same Delaware address as data controller. You keep the content you upload, but by publishing it you grant the publisher a non-exclusive, fully paid-up and royalty-free licence to process it, limited to operating and maintaining the service. You also waive your moral rights as far as the law allows, and you remain solely liable for what you publish. The publisher reserves the right to refuse, moderate, remove or block any content at its own discretion. The platform itself, its trademarks and its templates stay the exclusive property of the publisher or its licensors.

Reuse rights

Your own content stays yours to reuse as you wish: nothing in the terms restricts what you do with the texts, images and products you upload, and the licence you grant is limited to running the service. The opposite is not true. Everything Ucraft supplies on the platform, including templates, design blocks and trademarks, is covered by all-rights-reserved wording: you may not copy, download, modify, translate, resell, sublicense or build derivative works from it beyond what normal use of the service requires. Personal data collected about you is processed for analytics, authentication, payments, remarketing and behavioural targeting, and shared with named third-party services. No training of AI models on customer data is mentioned anywhere.

Data retention & training

Hosting summary

Ucraft states that websites are hosted on Google Cloud, presented as fast and secure, free of charge on every plan, with unlimited bandwidth and storage and a free SSL certificate; the White Label page adds a 99.99% SLA. Beyond that, the jurisdiction is undeclared. Neither the privacy policy, nor the terms, nor any trust or security page names a country or a region where customer data is stored. The policy limits itself to saying that data is processed at the publisher's operating offices and wherever the parties involved in the processing are located. The only places actually named apply to third-party services rather than to hosting: the United States for Google, Mixpanel, Stripe, Disqus, Intercom, Twitter and Facebook, and Malta for Hotjar. The publisher's own offices are in Glendale, California and Yerevan, Armenia. Anyone with a data residency requirement will need to ask before committing.