§ 1Who is the data controller?
The controller of your personal data is CRESH GROUP spółka z ograniczoną odpowiedzialnością (a Polish limited liability company), with its registered office at ul. Tadeusza Zielińskiego 55/65, 53-533 Wrocław, Poland, entered in the Register of Entrepreneurs of the National Court Register by the District Court for Wrocław-Fabryczna in Wrocław, 6th Commercial Division of the National Court Register, under KRS number 0001212096, NIP 8993044448, REGON 543523306, with a share capital of PLN 5,000 (hereinafter “Cresh”, “we”, or “us”).
For matters concerning personal data, contact us at info@cresh.me or by post at our registered office address. We have not appointed a Data Protection Officer.
§ 2When and what data we collect
We collect only the data needed for a specific purpose. The data depends on which part of the Service you use.
| Situation | Data | Purpose | Legal basis (GDPR) | Retention period |
|---|---|---|---|---|
| Website demo without registration | Numbers entered in the form | Calculating the result | Not applicable: calculations take place in your browser; we do not send this data to the server unless you ask for the result by email | Until you close the page |
| “Send the result by email” in the demo | Email address, the demo result and the data entered in it | Sending the result you requested | Article 6(1)(b) (taking steps at your request) | Until the result is sent, then until the limitation period for claims expires |
| Consent to emails about new analyses | Email address, email open history | Sending information about new analyses and features | Article 6(1)(a) (consent) and the provisions of the Polish Electronic Communications Law | Until consent is withdrawn |
| Application account | Email address, password (in encrypted form) or sign-in with a Google account, login data, Account settings | Creating and maintaining an account, providing the service | Article 6(1)(b) (contract) | Until account deletion (§ 5), then until the limitation period for claims expires |
| Analyses in the application | Description of the idea, answers to questions, attached files, the chosen configuration, reports | Performing and storing Analyses (§ 3) | Article 6(1)(b) (contract) | For as long as the account exists. When the account is deleted, we delete the Analyses immediately (§ 5) |
| Subscription and Cresh Coins | Plan, subscription status and period, card brand and last 4 digits, Stripe customer and subscription identifiers, Cresh Coins ledger | Billing subscriptions and Analyses (§ 4) | Article 6(1)(b), (c) and (f) (contract, accounting obligations, defense of claims) | For as long as the account exists; the Cresh Coins ledger is deleted with the account (§ 5). Invoices and tax data up to 5 years from the end of the year in which the tax obligation arose |
| Protecting the trial from abuse | Hashes of the card fingerprint, an identifier assigned by Stripe from which the card number cannot be reconstructed, of your email address (reduced to one canonical address, for example without a “+” suffix), and of the subscription identifier. We do not store them together with your Account identifier | Preventing the trial from being used more than once with the same card or email address (§ 4) | Article 6(1)(f) (legitimate interest: protection against abuse) | 24 months from the start of the trial, also after the account is deleted |
| Purchase of a plan | Full name or company name, address, tax identification number (NIP) if you provide it, transaction details | Processing payments and issuing invoices | Article 6(1)(b) and (c) (contract and tax obligations) | 5 years from the end of the year in which the tax obligation arose |
| Contacting us by email | Email address, message content | Responding to inquiries and handling complaints | Article 6(1)(b) or (f) (legitimate interest: communication) | Until the matter is resolved, then until the limitation period for claims expires |
| Website statistics (Umami) | Page views and events in the Service, device and browser type, collected without cookies | Aggregated statistics: which pages and tools are used | Article 6(1)(f) (legitimate interest: aggregated statistics without cookies) | 6 months |
| Disputes and claims | Data necessary to establish or defend claims | Establishing, pursuing, or defending claims | Article 6(1)(f) | Until the limitation period expires |
§ 3Data in Analyses
When you run an Analysis, we process the description of your idea, your answers to questions asked during the Analysis, attached files, the chosen configuration, and the generated report. We store them in your Account on Amazon Web Services servers in the European Union.
To find publicly available information, the analysis engine sends search queries derived from the content of your idea to the Perplexity search engine (Perplexity AI, Inc., USA). The engine also uses the artificial intelligence model providers listed in § 7.
Do not include personal data of other people or information that must stay confidential, such as trade secrets, in your ideas or files.
§ 4Billing data and Cresh Coins
When you buy a Plan or start a trial, we store: the Plan, the subscription status, the dates of the billing period, the card brand and the last 4 digits of the card number, the Stripe customer and subscription identifiers, the overage limit (Max Plan), and the Cresh Coins ledger, which records every grant, reservation, charge, release, and expiry.
We do not store full card numbers. Card data is processed by Stripe.
We keep this data for as long as the Account exists. When the Account is deleted, we delete the Cresh Coins ledger and the subscription record (§ 5). We keep invoices and payment customer data to the extent needed for accounting and for establishing, pursuing, or defending claims. We keep tax data for up to 5 years from the end of the year in which the tax obligation arose.
The trial is available once per card and once per email address. When you start it, we store hashes of your card fingerprint, an identifier assigned by Stripe from which the card number cannot be reconstructed, of your email address, and of the subscription identifier. Before hashing, we reduce the address to its canonical form so that aliases of the same mailbox (for example with a “+” suffix or with dots in Gmail) count as one address. The hashes are computed with a secret key, so neither the address nor the card number can be read from them, and we do not store them together with your Account identifier. If your email address has already had a trial, we do not offer it again and you pay the Plan price from the start. If the same card has already been used for a trial, we cancel the subscription and charge nothing.
We do this in our legitimate interest in protecting against abuse (Article 6(1)(f) GDPR). We keep the hash for 24 months from the start of the trial and do not delete it with the Account, because otherwise the trial could be repeated by creating a new Account. After that time the hash is deleted automatically. You have the right to object to this processing (§ 9).
§ 5Account deletion
You can delete your Account in the application. Deleting the Account:
- deletes your login data and profile,
- immediately deletes your Analyses together with the attached files and reports,
- cancels the Stripe subscription immediately, with no refund for the current period, and deletes the subscription record in the Account,
- deletes the wallet and the Cresh Coins ledger.
We keep: the payment customer data and invoices at Stripe, and the data needed for accounting and the defense of claims, for the periods given in § 2 and § 4, as well as the card fingerprint and email address hashes that protect the trial for 24 months (§ 4).
You can request deletion of the remaining data at info@cresh.me (§ 9).
§ 6Do you have to provide data?
Providing data is voluntary. Without an email address, we cannot send you a result or create an account. Without a payment card, you cannot buy a Plan or start a trial. You can use the website demo without providing any data.
§ 7Who we share data with
We do not sell data. We share it only with companies that help us operate the Service and act on our instructions under data processing agreements:
| Category | Provider | Scope |
|---|---|---|
| Hosting and infrastructure | Amazon Web Services EMEA SARL | Application servers, sign-in (Amazon Cognito), databases, and files; servers in the European Union |
| Service emails | Amazon Web Services EMEA SARL (Amazon SES) | Account messages, results, and notifications from the application |
| Newsletter and marketing emails | Zoho Corporation B.V. (Zoho Campaigns) | Messages you have consented to receive |
| Payments | Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (USA) | Payments and subscriptions, card data |
| Web search | Perplexity AI, Inc. (USA) | Queries derived from the idea, to find publicly available information for the Analysis |
| Artificial intelligence models | Amazon Web Services EMEA SARL (Amazon Bedrock) | Preparing the content of the Analysis |
| Website statistics | Umami (Umami Cloud) | Aggregated statistics without cookies; servers in the European Union |
| Accounting | TAX & LEDGER SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ (accounting firm) | Invoices and settlements |
If you sign in with a Google account, Google sends us your email address, which we need to create the Account. Google processes the sign-in data as a separate controller under its own privacy policy.
Public authorities may also receive data when required by law.
§ 8Transfers of data outside the EEA
Some providers have parent companies or servers in the United States, in particular Stripe and Perplexity. In such cases, data is transferred on the basis of a European Commission adequacy decision (EU–US Data Privacy Framework), if the provider is certified, or on the basis of Standard Contractual Clauses approved by the Commission. You can request a copy of the safeguards at info@cresh.me.
§ 9Your rights
You have the right to:
- access your data and obtain a copy,
- rectify your data,
- have your data erased,
- restrict processing,
- data portability for data we process on the basis of a contract or consent,
- object to processing based on legitimate interests,
- withdraw consent at any time without affecting the lawfulness of processing carried out before its withdrawal.
To exercise your rights, contact us at info@cresh.me. We will respond within one month. You can also withdraw consent to emails using the link in each message, and withdraw cookie consent in the .
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.
§ 10Automated decision-making
We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. Cresh Analyses assess the idea you describe, not you. You make the final decision. We do not profile you for advertising.
§ 11Users outside the European Union
We process all users’ data in accordance with the GDPR, including data of people living outside the EU. If you live in the United States, you have at least the rights described in § 9.
We do not sell personal data and we do not share it for cross-context behavioral advertising, as US state privacy laws define those terms. Our website does not respond to “Do Not Track” signals, but it does not track you across other websites either: our statistics tool stores no cookies or other identifiers in your browser (§ 2), and we do not allow third parties to collect data about your activity across websites through our service. To exercise your rights, write to info@cresh.me (§ 9).
§ 12Security
We use encrypted connections (HTTPS), password encryption, system access controls, and backups. Only people who need data for their work have access to it.
§ 13Changes to this Policy
When we change this Policy, we will publish an updated version on this page with a new date. We will notify account holders of material changes by email.