Privacy Policy

Cresca is an AI-powered email marketing platform. In this policy, “Cresca”, “we” and “us” mean the operator of the Cresca service. You can reach us at hello@cresca.xyz.

We handle two different kinds of information, in two different roles:

• Information about our users (people who create a Cresca account or contact us). We decide how this is used.
• Information our users upload about their own contacts (subscriber lists and the emails sent to them). Our users decide how this is used; we process it on their instructions to provide the service. If you received an email sent through Cresca and have a question about your data, please contact the sender first. Every email sent through Cresca names the sender and their postal address.

• Account details: your name, email address and password. Passwords are stored only as a one-way hash, never in readable form. We verify your email with a one-time code.
• Google sign-in: if you sign in with Google, we receive your name, email address, a Google/Firebase account identifier and, if Google provides it, your phone number.
• Business and profile details: your company name and postal address, which are required before you can send campaigns because anti-spam laws require a physical address in every marketing email. You may also add optional profile details such as job title, time zone, language, bio and a profile picture.
• Billing information: your plan, payment amounts, billing dates, invoices and the identifiers our payment provider assigns to you. Card details are entered with our payment provider, Dodo Payments; we do not receive or store your full card number.
• Usage and technical information: how many contacts, emails and campaigns you use against your plan limits; your last sign-in time, sign-in count, IP address and browser user agent; and server request logs that include IP addresses.
• Messages you send us: if you use our contact form, we keep your name, email, company, phone number, subject and message, plus the IP address and browser user agent of the submission.

We use this information to provide and secure the service, verify your identity, enforce plan limits, process payments, prevent spam and abuse, respond to you, and send you service messages such as verification codes, usage warnings and billing notices.

When you use Cresca you may upload or create information about your own contacts: email addresses, names, phone numbers, company, location, job title, website, tags and any custom fields in an imported CSV file. If you connect your own website or app through our API, you can also send us contact activity such as page views, form submissions, purchases and downloads, which may include IP address, device, browser, approximate location and campaign (UTM) parameters.

We also store the campaigns, templates and images you create. Images are stored with our media provider, Cloudinary.

We use this information only to provide the service to you: storing and segmenting your lists, sending your campaigns, checking email addresses for validity, processing unsubscribes, bounces and complaints, and protecting deliverability. You are responsible for having a lawful basis, such as consent, to email your contacts.

• Campaign emails are sent through Amazon Simple Email Service (Amazon SES).
• Open and click tracking is currently turned off. Cresca does not insert tracking pixels into campaign emails or rewrite their links. If we enable this in the future, we will update this policy first.
• Every campaign includes an unsubscribe link and one-click unsubscribe email headers. When a recipient unsubscribes, they are marked as unsubscribed in that sender’s list.
• Amazon SES tells us when an email bounces or a recipient reports it as spam. To protect deliverability, addresses that hard-bounce are blocked from future sends for all Cresca users, and addresses that complain are blocked for the sender they complained about. We keep these suppression records, including the notification details from Amazon SES.

When you use AI features, such as generating a campaign or template from a prompt or checking an email for spam risk, the prompt, the email content involved and, where you provide one, content from a website URL are sent to our AI providers to produce the result. Our primary AI provider is Google (Gemini); OpenRouter is used as a fallback. To read a website you point us to, we load it with a hosted browser service (Browserless). AI-generated content can be inaccurate; review it before you send it.

• Analytics: www.cresca.xyz uses Google Tag Manager and Google Analytics, which set cookies to measure visits, and Vercel Web Analytics and Speed Insights to measure traffic and page performance. The Cresca app also uses Vercel Web Analytics and Speed Insights.
• Sign-in: the app keeps your sign-in session token and basic account details in your browser’s local storage, and Google sign-in (Firebase Authentication) stores its own session data. Clearing site data signs you out.
• Preferences: we remember your light/dark theme choice and, in the app, your AI chat history in your browser’s local storage.
• Sending-domain setup: if you connect Cloudflare to configure your sending domain, a short-lived cookie (about 10 minutes) secures that connection step.

You can block or delete cookies in your browser settings; blocking sign-in storage will prevent the app from keeping you signed in.

These providers process information on our behalf to run Cresca:

• Amazon Web Services (Amazon SES): email sending, bounce and complaint notices
• Google: Firebase Authentication (sign-in), Gemini (AI), Tag Manager and Analytics
• OpenRouter: fallback AI processing
• Browserless: loading websites you ask the AI to read
• Dodo Payments: checkout, subscriptions and payment processing
• Cloudinary: storage of images you upload
• Vercel: hosting of our website and app, analytics
• OVHcloud: application servers
• A managed database hosting provider for our application database
• Cloudflare: only if you choose to connect it for sending-domain DNS setup

We do not sell personal information. We share it only with the service providers above, when you direct us to (for example, sending your campaign to your contacts), when required by law or to protect the rights, safety and security of Cresca, our users or others, or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to the transferred information.

• We keep account and billing information while your account exists.
• Deleting your account in the app deactivates it: you are signed out, your API key is revoked and sending stops, but the account data is retained. To have your account data erased, email hello@cresca.xyz.
• Contacts you delete in the app are deleted.
• Some operational records expire automatically, for example temporary bounce tracking and daily sending-reputation records (about 90 days). Suppression records for bounced and complaining addresses are kept to prevent repeat sending.
• We may keep information longer where the law requires it, such as billing records.

We use HTTPS for our website, app and API; store passwords and API keys only as one-way hashes; store third-party connection tokens encrypted; limit sign-in and API request rates; and restrict access to accounts that are suspended or banned. No system is perfectly secure, so please use a strong, unique password and tell us promptly at hello@cresca.xyz if you suspect unauthorized access.

You can view and update your profile in the app at any time. You can also ask us to access, correct, export or erase the personal information we hold about you, or object to or restrict its use, by emailing hello@cresca.xyz. We will respond within the time the law applicable to you requires and may need to verify your identity first. Depending on where you live, you may also have the right to complain to your local data protection authority.

If you are a recipient of an email sent through Cresca, use the unsubscribe link in that email, or contact the sender, who controls your data. We will help our users respond to such requests.

Our service providers operate in several countries, including the United States and the European Union, so your information may be processed outside the country where you live.

Cresca is a business tool and is not intended for children. You must be at least 18 years old to create an account, and we do not knowingly collect information from children.

We will update this page when our practices change and revise the “Last updated” date above. If a change materially affects how we use information you have already given us, we will notify account holders by email before it takes effect.

Questions or requests about privacy: hello@cresca.xyz.