Privacy policy

1. Who we are

Crescive is operated by Vasan AI Technologies, LLC, a Delaware limited liability company ("Crescive", "we", "us"). This policy describes how we handle personal data across crescive.ai and the Crescive application. It is written to be read, not skimmed past — it is short because we collect little.

2. What we collect

Account data: your email address (used to sign in with a password or with a magic link we email you), the name and company you give when you sign up, and your workspace name. If you sign in with a password, it is handled by our authentication provider, Supabase Auth; Crescive's own application tables never store that password or a hash of it. If you choose to sign in with Google, we also receive your name, profile picture link, email-verified status, and a Google account identifier from Google. We request only Google's basic email and profile permissions; we do not request or have access to any other Google data, such as your Gmail, Drive, or contacts. We do not require phone numbers or job titles to use the product.

Product configuration: the brands, competitors, topics, prompts, and domains you configure for measurement. This is business data about public entities, not personal data, but we protect it with the same controls.

Measurement data: AI answer text, citations, and derived metrics collected through official, documented interfaces about the public brands you track.

Crawler analytics: server-log events (user agent, IP, path, timestamp) for domains you connect. Bot-verification requires source IPs; human-visitor log lines are aggregated, and raw entries age out on a fixed schedule.

Forms: if you request a demo we collect what you type into the form, use it to schedule the conversation, and nothing else. If you write to us through the contact form, we collect your name, email, and the answers you provide — including any details you volunteer about your business or challenges — and use them only to reply to your message; we don't add you to a mailing list or share the contents outside the team handling your message.

Operational telemetry: standard web logs and error traces necessary to run the service securely (NIST CSF 'Detect' function), sampled performance traces, site-usage analytics from Google Analytics and Google Tag Manager, which run on our public marketing pages (other than the sign-up and sign-in pages) and not inside the signed-in application, and request-rate counters, which are keyed by the requester's IP address and are used to rate-limit requests.

3. What we never do

We never sell personal data. We never share it for cross-context behavioral advertising as defined by the CCPA/CPRA.

We never use your workspace data — prompts, measurements, documents, or logs — to train AI models, ours or anyone else's.

We never scrape consumer applications in violation of their terms to build our datasets, so your reporting never inherits that liability.

4. Legal bases and purposes (GDPR)

We process account data, including the information we receive when you choose to sign in with Google, to create and authenticate your account and perform our contract with you (Art. 6(1)(b)); operational telemetry and security logging under legitimate interest in running a secure service (Art. 6(1)(f)); and optional communications only with consent (Art. 6(1)(a)), withdrawable at any time.

We also send account and service notifications — alerts about your workspace and a weekly digest on plans that include it — to members of your workspace, as part of performing our contract with you or our legitimate interest in operating the service your organization uses. These are not marketing. You can choose which you receive in your notification settings.

5. Retention

Account data persists while your account is active and is deleted within 30 days of a verified deletion request. Measurement history is retained for the life of the workspace because trend continuity is the product; export it at any time. Raw crawler-log lines are retained for 90 days, aggregates thereafter. Backups age out within 35 days.

6. Subprocessors and transfers

We use a small set of infrastructure subprocessors (cloud hosting, database and authentication, email delivery), each under a data-processing agreement. A current list is available on request from [email protected]. Where data crosses borders from the EEA/UK, transfers rely on adequacy decisions or Standard Contractual Clauses.

Sign in with Google (optional). Signing in with Google is your choice; password and magic-link sign-in remain available. If you choose Google, Google authenticates you directly under your own Google account and Google's privacy policy, so Google learns that you are signing in to Crescive each time you use it. Google acts on its own account in doing so; it is not our subprocessor. We do not send Google the contents of your workspace, and we receive from Google only the information described in Section 2. If you would rather Google not see your sign-in activity, use another sign-in method.

7. Security

Controls follow the NIST Cybersecurity Framework: tenant isolation enforced at the database layer (row-level security), encryption in transit (TLS 1.2+) and at rest, secrets kept server-side and out of browsers, least-privilege access, audit logging, and periodic access review. Details live on our security page; responsible-disclosure instructions are published in our security.txt.

Support access: a small number of authorized Crescive staff can open a temporary session inside your workspace to help resolve a support request. That access is never standing — each session is time-boxed, requires a stated reason, and is designed to expire automatically at the end of that window, with a manual end available at any time as well. It is logged twice: internally, and in your own workspace's audit log, so your team can see that Crescive Support acted, by whom, and when. A visible banner is shown across your workspace for as long as a session is active.

8. Your rights

Depending on your jurisdiction (GDPR, UK GDPR, CCPA/CPRA, and similar laws), you may request access, correction, deletion, portability, restriction of processing, or object to processing. Write to [email protected] from your account email; we verify and respond within 30 days. We do not discriminate against you for exercising any right.

9. Cookies

We use first-party cookies to sign you in, keep you signed in and secure your session; to remember the workspace and brand you are working in; and to remember which in-app notices you have dismissed. When you open an invitation link, start our free visibility scan, or open a sign-up link that has your email address in it, we also set a short-lived cookie that holds that email address so the sign-up form can pre-fill it; it expires 30 minutes after it is set, and it is not an authentication or session cookie. Our public marketing pages (other than the sign-up and sign-in pages) also load Google Analytics and Google Tag Manager, which may set their own cookies to measure how those pages are used; they are not loaded inside the signed-in application.

10. Children

Crescive is a business tool, not directed at children under 16, and we do not knowingly collect their data.

11. Changes and contact

Material changes to this policy are announced in-product and by email before they take effect, with the revision date updated below. Questions: [email protected] · Vasan AI Technologies, LLC, Delaware, USA.