California Residents (CCPA)
We do not sell your personal information, and share it only if you turn on marketing cookies. You have rights to access, delete, and opt-out. See Section 10 for details.
Request Data Deletion →Table of Contents
1. Information we collect
We collect the following categories of information:
a) Account Information
- Name, email address, company name
- Google OAuth profile data (if you sign in with Google)
- Timezone, language preferences
b) Connected Platform Data
- Access tokens for the platforms you connect, such as Meta, Google Ads, Google Analytics, Google Tag Manager, Google Merchant Center, TikTok, Microsoft Ads, ChatGPT Ads, Shopify, WooCommerce, Adobe Commerce (Magento), BigCommerce, Klaviyo, Slack and Notion
- Campaign performance data (spend, revenue, impressions, clicks, conversions)
- Store data: orders, products, inventory and locations from a store you connect (see Store data you connect, below)
- Ad account names, campaign names, creative performance metrics
- Historical performance data for forecasting
c) Service Usage Data
- Questions you ask in the chat feature
- Dashboard views, report generation, forecast requests
- Feature usage, clicks, interactions within the Service
- Team member invitations and permissions
d) Technical Data
- IP address, browser type, device information
- Log data, error reports, performance metrics
- Cookies and similar tracking technologies (see Section 6)
e) Payment Information
- Billing details (processed by Stripe; we don't store full credit card numbers)
- Transaction history, invoices
f) Communications
- Support tickets, feedback, emails you send us
- Survey responses, product feedback
Important: Where an agent can act on a platform, we request the write access those actions need. The exact scopes are shown to you by that platform's own consent screen before you grant anything, and you can revoke them there at any time.
By default an agent proposes a change and it does not run until you approve it. That default is a per-brand setting you control, and raising it is deliberate: a higher level asks you to confirm, and full autonomy asks you to type a confirmation. Whatever the setting, every change an agent makes is recorded in an audit log you can read.
Store data you connect
When you connect a store (Shopify, WooCommerce, Adobe Commerce (Magento) or BigCommerce), we read its orders, products, inventory and locations. For orders that means the order total, line items, discounts, refunds, currency, order date and the order source. Orders can also carry the buyer's email address and customer ID, and we store those with the order when the store provides them.
Why we read it
To report your revenue, match your ad spend to the sales it brought in, forecast demand from your order history, and show stock and product details to your agents.
We read the buyer's email on each order to recognise repeat customers in your reports. Emails are not shown to your team. We read whether each buyer accepted marketing and never use an email for advertising without it. We never ask Shopify for a buyer's name, phone number or address.
Where it goes
- It is stored in our database (Neon) for your account only.
- If you turn on purchase events for Meta, we send Meta each purchase with the buyer's email hashed, and only for buyers who accepted marketing.
- When someone on your team approves an audience, we send hashed emails of customers who accepted marketing to the ad account you choose.
- When an AI shopping agent places an order through your store, we create a draft order in Shopify with the email the agent gives us so you can invoice the buyer.
- When an AI provider answers a question about your customers, it is given order figures and an internal customer ID. It is never given a customer's email address.
How long we keep it
While the store is connected. When you uninstall our Shopify app, syncing stops at once and we delete the store's data within 30 days, sooner if Shopify asks us to. When you close your account, the same applies to every store on it. Deleted data leaves our database backups as they roll over, which takes 7 days.
If a buyer asks Shopify for their data, or asks for it to be erased, we act on Shopify's request: we report what we hold about that buyer, or remove their email address and customer ID from the orders we hold.
Slack data
When you add Cresva to a Slack workspace, Slack sends us only what is addressed to Cresva: messages that mention @Cresva, direct messages to Cresva, the /cresva command and clicks on Cresva's buttons, with the ids of the workspace, channel and person. We do not read channel history, and we do not ask Slack for members' email addresses.
What we keep
- The workspace's access token, encrypted, until Cresva is uninstalled or Slack is disconnected.
- Which Cresva account each Slack member connected, and which channel each brand posts to.
- Each delivery from Slack, which includes the message text, for 30 days, so a failed delivery can be processed again.
- Your questions to Cresva in Slack and its answers, in your Cresva chat history, for 365 days unless your company sets another window.
- We do not keep a separate log of Slack messages.
When Cresva leaves the workspace
When Cresva is uninstalled from the workspace, or Slack is disconnected in Cresva, we delete the token at once, along with the deliveries from that workspace, its questions and answers, the member connections and the channel choices. A proposal Cresva posted in Slack keeps a reference to its message, because the proposal is the record of a decision. Deleted data leaves our database backups as they roll over, which takes 7 days.
When you sign up for the newsletter we keep your email address, the consent wording you saw and its version, the page you signed up on, the time, and a one-way hash of your IP address and browser. We never store the IP address or browser details themselves. You are not subscribed until you click the link in the confirmation email, which works for 7 days.
Resend sends the newsletter for us. It receives your address only after you confirm, and only to send it.
While you are subscribed we keep these details so we can send it. If you never confirm, or you unsubscribe, we erase your address and the hashes 90 days later. We also stop sending if your address bounces permanently, if you mark an issue as spam, or if it bounces temporarily three times in a row.
Every issue has an unsubscribe link, and your email app's unsubscribe button works too. To delete your data sooner, use the data deletion page: we email you a link, valid for 30 days, that erases it here and at Resend. Deleted data leaves our database backups as they roll over, which takes 7 days.
2. Legal basis for processing (GDPR)
For users in the EU/UK, we process your personal data under the following legal bases:
Contract Performance
We process your data to provide the Service you signed up for (account management, analytics, forecasts, etc.)
Legitimate Interests
We process data to improve our Service, prevent fraud, ensure security, and send relevant product updates (you can opt out of marketing emails)
Consent
For cookies (other than essential ones), AI training on your data, and marketing communications, we ask for your explicit consent
Legal Obligations
We may process data to comply with laws, regulations, court orders, or tax requirements
3. How we use your data
We use the information we collect to:
Provide & maintain the Service
Process your ad data, generate forecasts, answer questions via chat
Improve & develop features
Analyze usage patterns, fix bugs, develop new features
Customer support
Respond to your questions, troubleshoot issues
Security & fraud prevention
Detect and prevent abuse, unauthorized access, and security threats
Communications
Send service updates, billing notices, security alerts (you can opt out of marketing emails)
Legal compliance
Comply with laws, regulations, court orders, tax obligations
4. AI & machine learning
🤖 How we use AI
Cresva uses AI and machine learning to analyze your marketing data, generate forecasts, and provide insights. This processing happens in real-time and is essential to the Service.
Training and your data
- We do not train or fine-tune any AI model on your data or on your customers' data.
- Revenue forecasts are statistical models fitted on one brand's own data, for that brand only.
- The expected effect of a change an agent proposes starts from the pooled results of brands that turned on shared learning (below). Every brand's estimates draw on that pool, whether or not the brand shares, and the brand's own measured results count for more as they build. Turning shared learning on adds your results to the pool; it is not what lets you read it.
Shared learning
- Off by default. Every brand starts at “Keep it to this brand”.
- Only an owner or admin of the brand can turn it on, in Settings under Data sharing. We record who changed it and when.
- What joins the pool: for each change made on the brand while sharing was on and measured afterwards, the kind of change (for example a medium budget increase on a campaign), how much contribution changed for each unit of spend the change moved, and how close the agent's forecast came. These are kept as ratios and counts, with no brand name, id, campaign, note or amount, and grouped by brand category, spend band and ad platform mix. Demo brands and brands we run ourselves are never pooled.
- A result joins the pool only when every platform its figures came from allows that platform's data to be used for other customers. Google, Meta, TikTok, Shopify and Klaviyo do not allow it, or their terms do not clearly allow it, so results measured on their data are never pooled. Today only results measured on Cresva's own records can join.
- A pooled figure exists only when at least 5 brands from at least 3 companies are in it.
- The wider option, “Share patterns and help test models”, also lets us replay your past decisions, with the figures and notes they were made on, through our AI providers to test new forecasting models. Those providers may not train on it. Only decisions whose figures come from a platform that allows it are replayed, which today excludes every decision made on Google, Meta, TikTok, Shopify or Klaviyo data, and a decision is never replayed with notes an agent was given from memory, since those notes do not record where their figures came from.
- It can be turned off at any time. The pool is rebuilt every night, so your results leave it at the next rebuild.
Industry benchmarks
- A brand added from 10 October 2026 is left out until an owner or admin turns this on. Brands added before then are included unless it is turned off. Either way a brand is counted only once we have assigned it an industry, and demo brands are never included.
- A benchmark uses a platform's figures only when that platform allows its data to be combined across customers. Google, Meta and TikTok do not allow it, or their terms do not clearly allow it, so no industry benchmark is built from their ad totals today. When a platform does allow it, from each included brand we take its last 30 days of that platform's totals (spend, impressions, clicks, purchases and the revenue the platform reports) and turn them into six figures: ROAS, cost per purchase, click-through rate, conversion rate, average order value and monthly spend.
- Comparisons between stores selling to AI shopping agents use Cresva's own records of agent requests and of orders placed through Cresva's checkout. Product and order data from Shopify or another store platform is not combined across stores.
- Those figures are combined across the industry's brands into percentiles and an average. A figure is used only when at least 5 brands have a value for it; when an industry has too few, its wider group is used where there is one. No brand is named, and no brand id leaves the calculation.
- An owner or admin of the brand can turn this off, or back on, in Settings, Data sharing, under Industry benchmarks. The change and who made it are recorded. While it is off, the brand is left out of every industry benchmark and of the comparisons other brands see. Its own agents still compare it with the benchmark.
AI providers we send data to
To answer your questions and run your agents we send the data a task needs to the AI providers listed in Section 5, under their business terms. What each provider's own terms say about training:
- OpenAI: data sent through its API is not used to train its models unless the customer opts in; it keeps API data for abuse monitoring for up to 30 days.
- Anthropic: data sent through its API is not used to train its models by default.
- Perplexity: data sent through its API is not kept and not used to train its models.
- Google (Gemini API), ElevenLabs and Sync Labs: their terms let them use data to improve their products depending on the plan and account settings. We send them only what a task needs (prompts, images, video or script text for a creative you asked for), never your customers' personal data.
Data from Google APIs
- Cresva's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- Data from Google APIs (Google Ads, Google Analytics, Google Tag Manager and Google Merchant Center) is used only to give you the features you connected it for. It is never used to develop, improve or train generalized AI or machine learning models, by us or by anyone we send it to.
- It is never combined with other customers' data: it is left out of shared learning, of model testing and of industry benchmarks.
- When an agent reads it to answer you, it goes to OpenAI or Anthropic under their API terms, which do not let them train on it. It is never sent to the providers whose terms allow training, and it is never sold or used for advertising.
⚠️ We do NOT sell your data
We never sell your personal information to third parties. Period.
We may share your data with:
Service Providers (Subprocessors)
We use trusted third-party services to help operate Cresva:
Hosting and infrastructure
- Vercel: Application hosting, CDN, file storage (Vercel Blob) and web analytics.
- Inngest: Background job orchestration.
- jsDelivr: Public script CDN for charts, previews and code sandboxes the agents generate.
- Tailwind Labs: Stylesheet CDN for landing page mockups the analyzer generates.
Data storage
- Neon: Primary PostgreSQL database.
- Cloudflare R2: Storage for generated video creatives.
- Upstash: Cache and rate limiting (Redis).
AI services
- OpenAI: Language, vision, embedding and image models.
- Anthropic: Language models for agents, planning and research.
- Google (Gemini API): Image and video generation and AI visibility checks.
- Perplexity: AI visibility checks.
- Replicate: Image generation.
- Sync Labs: Lip-sync for generated video.
- ElevenLabs: Voice generation for video creatives.
Observability
- Langfuse: AI request tracing. Only when Langfuse keys are configured.
- Sentry: Error tracking.
- Better Stack: Log storage. Only when a Better Stack source token is configured.
Analytics
- PostHog: Product analytics. Only after you consent to analytics.
- Google Analytics, Google Tag Manager and Meta Pixel: Advertising and analytics measurement on public cresva.ai marketing pages. Only after you consent to analytics or marketing cookies.
Communications
- Resend: Transactional and report email.
- Email relay (SMTP): Sign-in links and team invitations.
- Slack: Alerts and reports to the Slack workspace you connect.
Payments
- Stripe: Subscription billing.
Integrations
- Composio: Connections to third-party apps you choose to link.
Research and search
- Google (Custom Search, PageSpeed and Chart APIs): Image search, page speed checks and QR code images.
- ScreenshotOne: Screenshots of public web pages for page analysis.
- Tavily: Web search for research and competitor monitoring.
- Brave Search: Image search.
- SerpAPI: Search result checks for AI visibility.
Security
- Cloudflare Turnstile: Bot protection on public forms.
Every subprocessor is bound by a data processing agreement. Where each is located and how long it keeps data is in our Data Processing Agreement.
Legal Requirements
We may disclose data if required by law, court order, subpoena, or to protect our rights, safety, or property.
Business Transfers
If Cresva is acquired or merged, your data may be transferred to the new entity. We'll notify you and update this policy accordingly.
With Your Consent
We may share data with other parties if you explicitly consent (e.g., integrations you enable, case studies you approve).
If you run a store check and tick the box asking to be introduced to an agency in your region, we share your email address and that store check with one Cresva founding partner agency there, and with no one else. Nothing is shared if the box is left unticked, and no commission is paid either way.
6. Assistant connectors
This section describes what happens when a user connects a third party AI assistant to Cresva. It applies in addition to the rest of this policy, not instead of it.
What a connected assistant can read
Cresva operates a Model Context Protocol server at https://cresva.ai/mcp. A user may connect a third party AI assistant, such as Claude, ChatGPT or Cursor, to that server. The assistant is the client: it authenticates to Cresva using OAuth 2.1 and holds its own access token.
A connection can read only the brands the user selected on the Cresva consent screen at the time of granting, and only through the tools that the granted scopes permit. It cannot enumerate or reach an account the user did not grant, and it cannot reach another customer's data.
The connector is read only by default. Two tools are not reads. One adds a proposed Google campaign budget to the brand's approvals queue for a person to approve in Cresva, never changes an ad account, and needs a permission that is off unless the user grants it. The other is run_ai_shopper, which publishes a public page about a store on cresva.ai and never writes to the store.
The assistant acts as the user, and every call is logged
A connection is granted by an individual user and carries that user's identity. Anything the assistant reads is what that user is entitled to read, and their permissions are re-evaluated at the time of each call rather than frozen when the grant was made. A user who loses access to a brand loses it through the connector at the same moment.
Every tool call is written to Cresva's audit log against the granting user, the assistant that made it and the grant it was made under. An administrator can therefore attribute any connector activity to a named person. Audit records are retained on the same schedule as other account audit data.
What leaves Cresva's systems
When a connected assistant calls a tool, Cresva returns the answer to that tool call to the assistant, over TLS. Nothing else is transmitted: Cresva does not send the assistant vendor credentials, connected platform tokens, other customers' data, or any bulk export of the customer's account.
When you ask a question through the Cresva Chrome extension or the npm package, the question text is sent to OpenAI to produce the answer. A Store run may send shopping questions written from the store's public product information to AI assistants such as ChatGPT, Claude, Perplexity and Gemini, to check what they recommend. When the store's products cannot be read, the questions may name the store. The Claude and ChatGPT connectors send no question text to a third-party model.
Once an answer reaches the assistant it is governed by the agreement between the user and that assistant's vendor. Cresva has no visibility into, and makes no representation about, how a vendor stores, processes or trains on content the user brings into their own conversation. A customer evaluating that risk should read the vendor's terms.
Grants, tokens and retention
Cresva stores, for each connection: the registered client, the granting user, the brands and scopes granted, the time of grant, and the time the connection was last used. Access tokens and refresh tokens are stored as hashes rather than in a recoverable form.
Access tokens are short lived. Refresh tokens are single use: a refresh issues a new refresh token and invalidates the one presented, and presenting a token that has already been used revokes the grant. Records of a revoked grant are retained as audit history rather than deleted, so that past access remains attributable.
How to revoke a connection
A user can revoke a connection at any time from Connected apps in their Cresva settings. Revocation takes effect immediately: the tokens are invalidated and the next call from that assistant is refused. Revoking one user's connection does not affect any other user's.
Removing a user from the Cresva account, or removing their access to a brand, has the same effect on what their connections can reach, because permissions are evaluated per call.
Test credentials read simulated data
Cresva issues test API keys, distinguishable by their sk_test_ prefix, alongside live keys. A request authenticated with a test key reads simulated data only. It does not read the customer's connected accounts and cannot change any record. Test keys exist so that an integration can be built and run in a customer's own CI without touching production data.
6a. Claiming a store
A store listed in our public AI Shopper Index can be claimed by whoever controls its domain. Claiming is something you start; it never happens as a side effect of anything else.
What you send us.
Which store you are claiming, and, when you come back to finish, the value we gave you. That is the whole of it. We do not ask for anything about the business and we do not ask you to upload anything to us.
What we do with it.
We give you a value to publish, either as a DNS TXT record on the domain or as a file at a fixed address on the site. When you ask us to check, we make one DNS lookup and at most one request to that address on your own domain. All we look for is whether the value is there. Nothing else on the site is fetched, and no page of it is stored.
What we keep.
That the store is claimed, when it was proved, and which of the two methods proved it. We keep the account that made the claim so that the claim can be managed, and a one way digest of the value rather than the value itself. An unfinished claim expires after seven days, after which a nightly job removes the account, the timestamp and the digest, and the store is claimable again by anybody.
What a claim proves, and what it does not.
It proves control of the domain on the day the check ran. It does not prove ownership of the business, and we do not treat it as such: an agency proving a client's domain is an ordinary case rather than a misuse. For that reason a claimed store is shown as claimed, never as belonging to the person who claimed it, and we do not publish who claimed anything.
We use cookies and similar technologies to improve your experience. Here's what we use:
Essential Cookies (Required)
These are necessary for the Service to function:
- Authentication (keeping you logged in)
- Security (CSRF protection)
- Preferences (timezone, language)
Analytics Cookies (Optional)
Help us understand how you use the Service (anonymized):
- PostHog (product analytics)
- Google Analytics (anonymized)
Declining this category in our cookie banner (or choosing "Essential Only") means these do not load. You can also block them at the browser level.
Marketing Cookies (Optional)
Used only with your consent, to measure advertising effectiveness:
- Meta Pixel
- Google Tag Manager (loaded only with marketing consent, because the tags it runs are set outside this site)
Declining this category, or choosing "Essential Only," means these do not load.
Free Tool Reports (Set When You Ask)
When you ask us to email you a free-tool report, we set a small cookie so we don't ask for your address again on your next report. It holds a signed reference only, no personal data, and expires after 12 months.
Page View Counts and Setup Progress
Inside the dashboard, Cresva counts how many times each page is viewed per day, without recording who viewed it. These totals are seen only by Cresva staff and are used to decide what to improve.
Cresva records how far each account has got in setup (the last step completed and when), to help accounts finish setting up.
On our homepage and on Store run pages we count visits, clicks on Start for free and clicks on Connect Shopify without a cookie: nothing is stored on your device, and each count holds only the step, a random number for that one visit and the time, never linked to you.
How to control cookies:
at any time. If your browser sends a Global Privacy Control signal, marketing cookies stay off.
- Most browsers allow you to block or delete cookies in settings
- Note: Blocking essential cookies may prevent the Service from working properly
- Learn more: allaboutcookies.org
8. Security measures
What we do to protect your information:
In transit
Connections to Cresva and from Cresva to our providers use TLS
Database
Our database (Neon) is encrypted at rest with AES-256 by Neon
Files
Files we store (Vercel Blob) are encrypted at rest by Vercel
Platform tokens
The access tokens for the platforms and stores you connect are also encrypted by Cresva itself with AES-256-GCM before they are stored
Cache
Our cache (Upstash Redis) is encrypted in transit but not at rest on our plan, so we keep no order data and no personal data of your customers there: it holds counters, locks, settings, catalogue details, totals and short-lived sign-in and session state
Access
Every request is checked against your role in the brand and company it reads, and changes to ad and store accounts pass one write gate that records who approved them
Data breach notification: If a breach affects your data, we will tell you, and the authorities where the law requires it, without undue delay, and no later than 72 hours after we become aware of it.
9. Data retention
We retain your data for as long as necessary to provide the Service:
While Your Account Is Active
We delete or strip these on a schedule, every night:
- Storefront request logs: after 30 days. The record of each request an AI agent or shopper makes to a store's agent storefront, including the IP address and browser details, is deleted in full, once that day is counted in the daily totals. A store can choose a shorter period.
- Daily storefront totals: after 13 months. Daily totals, including the text of queries, are kept for 13 months and then deleted. They hold no IP address or browser details.
- Chat messages: after 365 days. Your company can set a shorter or longer window.
- Questions asked and their answers: after 180 days. The query log behind answers.
- IP address and browser on security events: after 90 days. The event itself is kept; these two fields are removed.
- Inbound webhook payloads: after 30 days. Kept only so a delivery can be replayed.
- Agent working state: after 180 days. Intermediate steps of agent runs.
Active Accounts
As long as your account is active, we retain your data to provide the Service.
After Account Deletion
- Account data: Deleted within 30 days of an owner deleting the company or your verified deletion request, together with the data of every store on it. The deletion runs 7 days after it is asked for.
- Inactive companies: A company with no paid plan and no sign-in for 12 months is erased. Its owners and admins are warned by email 30 days and 7 days before. Signing in, using an API key or starting a paid plan cancels it.
- Backups: Deleted data leaves our database backups as they roll over, which takes 7 days
- Billing records: Held by Stripe and kept for as long as tax and accounting law requires
- Anonymised benchmark figures: May be kept, because they identify no brand, company or person
- Settled Agent Commerce transactions: Where a brand has a completed negotiated sale (an accepted negotiation with an order reference), we retain that transaction's record for accounting and legal reasons, consistent with how any completed sale record is kept
Legal Holds
We may retain data longer if required by law, legal proceedings, or to resolve disputes.
Want to delete your data? Visit /data-deletion or email hello@cresva.ai
10. International transfers
Cresva is based in the United States. If you're accessing the Service from outside the US, your data may be transferred to, stored, and processed in the US and other countries.
For EU/UK users (GDPR):
- We rely on Standard Contractual Clauses (SCCs) approved by the European Commission for data transfers to the US
- All subprocessors handling EU data sign Data Processing Agreements (DPAs) with SCCs
- We implement additional safeguards (encryption, access controls) to protect your data
By using the Service, you consent to the transfer of your data to the US and other countries where we or our service providers operate.
11. Your rights & choices
Under GDPR, CCPA, and other privacy laws, you have the following rights:
Access
Request a copy of your personal data we hold
Rectification
Correct inaccurate or incomplete data
Erasure ("Right to be forgotten")
Request deletion of your account and data
Data portability
Download your data in a portable format
Object to processing
Object to certain uses (e.g., AI training)
Restrict processing
Limit how we use your data
Withdraw consent
Opt out of cookies, emails, AI training
Lodge a complaint
File a complaint with your data protection authority
California Residents (CCPA/CPRA)
You have additional rights under California law:
- Right to know what personal information we collect and how we use it
- Right to deletion
- Right to opt-out of "sale" or "sharing" (we do neither)
- Right to non-discrimination for exercising your rights
How to exercise your rights:
Email: hello@cresva.ai
Data deletion form: /data-deletion
Response time: We'll respond within 30 days (GDPR) or 45 days (CCPA)
Verification: We may ask for additional information to verify your identity before processing requests
No fees: We don't charge for requests unless they're excessive or repetitive
12. Children's privacy
Our Service is not intended for children under 16 years old (or 13 in the US). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately at hello@cresva.ai so we can delete it.
13. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We'll update the "Last updated" date at the top of this page.
For material changes: We'll notify you through the Service, via email, or with a prominent notice on our website at least 30 days before the changes take effect. For non-material changes, we encourage you to review this policy periodically.
Continued use of the Service after changes become effective constitutes acceptance of the updated policy. If you don't agree with the changes, you may close your account.
Contact us
Privacy questions or requests?
Contact our privacy team for any questions about this policy or to exercise your rights.
EU/UK residents: If you're not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.
Using the Cresva Chrome extension? It is covered by its own policy, which states exactly what a scan sends, what it never reads and which pages it refuses outright: Chrome extension privacy policy.