Informativa sulla privacy

Crescelo is operated by Crescelo ("Crescelo", "we", "us"). You can reach us through the contact form at https://www.crescelo.com/support/contact, which opens a support ticket.

Crescelo lets businesses put an AI assistant on their website that answers visitor questions from the business’s own content, books appointments, captures leads and hands over to a person. This policy explains how we handle personal data in two different roles:

• As a controller of the data of people who visit crescelo.com, create an account, contact us or pay us (our "Website and Account Data").
• As a processor (service provider) of the data of people who talk to an assistant that one of our customers has installed on the customer’s own website, phone line or messaging channel (the "Visitor Data"). In that case the customer decides why and how the data is used, and the customer’s own privacy notice applies. We process it only on the customer’s instructions under our Data Processing Addendum.

If you are a visitor who used an assistant on another company’s website and want to see, correct or delete what you told it, contact that company first. We will help them respond.

Depending on how you use Crescelo, we collect:

• Account data: name, work email address, password (stored only as a salted hash), optional profile picture and job title, workspace settings, and team members you invite.
• Sign-in with Google: your name, email address and profile picture, which Google sends us with your permission. We do not receive your Google password.
• Billing data: plan, invoices, billing name and email, tax details. Card details are entered on Lemon Squeezy’s pages and are never stored by us.
• Content you upload or connect: documents, web pages, FAQs and other knowledge-base material, business hours, services and prices, and integration settings. AI provider keys and webhook secrets you give us are stored encrypted.
• Visitor Data (as a processor): the messages a visitor types or speaks to an assistant, the assistant’s replies, contact details a visitor chooses to give (name, email, phone), appointment bookings, call recordings or voicemails and transcripts if the customer enables the phone feature, and a random visitor identifier stored in the visitor’s browser.
• Technical and security data: IP address, browser type, device information, pages and API endpoints requested, timestamps, error details and a request identifier. Our operational logs record metadata only, not the text of chat messages or form entries.
• Communications: messages you send us through the contact form, support requests and emails.
• Playground data: if you open the public playground, your name and email address, whether you agreed to tips and product news, and the documents, pasted text or web pages you add and the questions you ask. Playground documents and questions are deleted automatically after 7 days. We email you a private link to your playground and, only if you agreed, occasional tips and product news that you can opt out of at any time.

We do not knowingly collect special-category data (such as health, biometric or political data). Customers must not use Crescelo to collect it (see the Acceptable Use Policy). If it reaches us anyway, we treat it as confidential and delete it on request.

Where the GDPR or the UK GDPR applies, we rely on the following bases:

• To provide the service you asked for (create your account, run your assistants, send confirmations, bill you): performance of a contract.
• To keep Crescelo secure and working (fraud and abuse prevention, rate limiting, reCAPTCHA, error diagnosis, audit trails): our legitimate interests in protecting the service and our customers.
• To answer your messages and give support: performance of a contract or our legitimate interests.
• To send product and security notices about your account: performance of a contract and our legitimate interests. We send marketing email only if you ask for it or the law allows it, and you can unsubscribe in every message.
• To meet legal obligations (tax records, responding to lawful requests): legal obligation.
• Anything else we ask your permission for: consent, which you can withdraw at any time.

We do not sell personal data. We do not share personal data for cross-context behavioural advertising. We do not use Website and Account Data or Visitor Data to train AI models. Customers who connect their own AI provider are bound by that provider’s terms on how it handles the text it receives (see section 5), so customers should choose a provider and plan whose data terms suit them.

When a visitor asks a question, the assistant searches the customer’s knowledge base, selects the most relevant passages and sends them, together with the question and recent turns of the conversation, to the AI model provider the customer has connected (for example Google Gemini, OpenAI, Anthropic, Groq or DeepSeek) to write a reply. The provider processes that text under the customer’s own agreement with it. An assistant that has no key connected runs on Crescelo’s own free engine (and so does the public playground): the same text then goes to Groq or Google under Crescelo’s account. Free provider tiers can be governed by terms that let the provider use content to improve its services, so customers who need stricter treatment (for example for EU or UK visitors, or sensitive content) should connect their own paid key.

Replies are generated automatically and can be wrong. Assistants are designed to say when they do not know and to offer a booking or a live person instead. Businesses using Crescelo are responsible for telling visitors they are talking to an AI and for reviewing important conversations. No decision with legal or similarly significant effect is made about a person solely by the assistant.

We share personal data only as needed to run the service:

• Our sub-processors (hosting, database, caching, payments, email, sign-in and bot protection). The current list is at /subprocessors.
• The AI model provider the customer connects, as described above.
• The tools a customer connects (for example a webhook, Slack, Google Sheets or calendar). Data sent there is under the customer’s control and that tool’s own terms.
• Professional advisers, and authorities where the law requires it or to protect rights, safety and security.
• A buyer or successor if Crescelo is sold or reorganised, with the same protections for your data.

Our providers process data in several countries, including the United States and India. Where personal data leaves the European Economic Area, the United Kingdom or Switzerland, we rely on an appropriate safeguard, such as the European Commission’s Standard Contractual Clauses (with the UK Addendum where relevant), and on our providers’ own transfer mechanisms. You can ask us for a copy of the safeguard that applies.

• Account data: while your account is open, then deleted within 30 days of closure or of a verified deletion request.
• Knowledge base, conversations, leads and appointments: until the customer deletes them or closes the workspace, then deleted within 30 days. Customers control retention of their Visitor Data.
• Operational and security logs (metadata only): 30 days, then deleted automatically.
• Billing records: as long as tax and accounting law requires, usually several years.
• Support messages: up to two years after the matter is closed.
• Backups: deleted data drops out of encrypted backups as they rotate; we do not restore it into live systems except to recover from failure.

We protect personal data with measures that fit the risk, including encryption of traffic between your browser and our application, encryption of stored AI provider keys and secrets (AES-256-GCM), salted password hashing, optional two-factor sign-in, separation of each customer’s data by workspace, rate limiting and bot protection on public endpoints, and access and error logging. No system is perfectly secure. If a breach affecting your personal data occurs we will notify you and the relevant authority as the law requires.

Depending on where you live you may have the right to: access your personal data and receive a copy; correct it; delete it; restrict or object to processing; receive it in a portable format; withdraw consent; and complain to your data protection authority. Residents of California and some other US states may also ask what we collected, ask us to delete or correct it, and opt out of sale or sharing (we do neither), and we will not discriminate against you for using these rights.

To use a right, send a request through our contact form (https://www.crescelo.com/support/contact, category "Privacy request") using the email address on your account. We may need to verify your identity, and we aim to reply within 30 days (45 days where US law allows). If your data is Visitor Data, we will pass your request to the business whose assistant you used.

We use the cookies and browser storage needed to sign you in, keep the site secure and remember your preferences, and, only if you accept, Google Analytics to count visits. We do not use advertising or cross-site tracking cookies. Details and your choices are in our Cookie Policy at /cookies.

Crescelo is a business service for people aged 18 and over. We do not knowingly collect personal data from children. Businesses that use assistants must not direct them at children. If you believe a child has given us personal data, contact us and we will delete it.

You can contact us about privacy matters through https://www.crescelo.com/support/contact (category "Privacy request"). We have not appointed a representative in the EU or UK; if you are in those regions you may contact us directly, and you also have the right to lodge a complaint with your local supervisory authority.

We will post any change on this page with a new "last updated" date and, for material changes, notify account holders by email or in the dashboard before they take effect.