Privacy Policy

Crescence Inc. (“Crescence,” “we,” or “us”) operates the B2B marketplace at crescence.co (the “Service”). This policy explains what we collect, how we use it, and the privacy rights we extend to you.

We use the California Consumer Privacy Act (CCPA), as amended by the CPRA, as our privacy baseline. We honor the rights it describes for Crescence users where they apply and where it is operationally feasible, even where Crescence does not yet meet the formal legal thresholds that would make every requirement mandatory.

Crescence is intended for businesses and users located in the United States. We do not intentionally offer the Service to individuals in the EU or UK. If you are outside the United States, please do not create an account or submit personal information through the Service.

This policy describes Crescence's current practices and, where applicable, our practices during the twelve months before the effective date above.

1. Who this applies to

This policy covers visitors to crescence.co and authenticated users of the Service, both brand operators and the offices, workplaces, and other business buyers that buy from them. If you contact us by email or join a waitlist before creating an account, the information you share is also covered.

2. What we collect

We collect the following categories of personal information:

Identifiers. Name, email, phone number, mailing or shipping address, company name, role (brand operator vs. business buyer).
Commercial information. Orders placed, products listed, sample requests, payment status, payout history, dispute records.
Internet and device information.IP address, user agent, referring URL, pages visited, approximate location (city level via IP), session timestamps, browser cookies (see § 7 below).
Communications. Messages you send through the in-app messenger, support tickets you open with us, and drafts, recommendations, and edits you interact with through Maia (our AI assistant).
Inferences. Preferences derived from your activity: dietary tags you avoid, brands you favor, and suggested matches and preferences from your interactions with Maia. Used to personalize your workspace; never sold.
Financial information. Stripe-tokenized payment methods, bank account information for payouts (brand operators), and tax identification numbers (W-9 / 1099-K reporting). The card number itself never touches our servers, since Stripe handles tokenization.
Sensitive personal information (CCPA-defined). Account credentials (password hash, salt) and government-issued ID images if a brand uploads them as part of verification. Stored encrypted; access logged.

A complete category-by-category summary lives in the data inventory at the end of this policy.

3. How we use it

To provide the Service: matching brands with buyers, processing orders, and sending transactional emails like receipts and shipping notifications.
To run Maia, our AI assistant: Maia uses your Crescence workspace data to personalize recommendations, draft suggestions, improve matching, and prepare recurring orders. Crescence does not permit its AI service providers to use your personal information to train their general-purpose models.
To keep the marketplace safe: verifying brand identities, detecting abuse and fraud, securing accounts, and routing orders.
To improve the Service: aggregated analytics that do not identify any single account.
To comply with the law: tax reporting, responding to lawful requests, and keeping audit records.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

3.1 Maia and automated tools

Crescence may use automated tools, including Maia, to personalize recommendations, draft suggestions, detect abuse, improve matching, support the marketplace, and automate recurring ordering workflows that you choose to enable.

You may be able to set preferences, budgets, product rules, approval settings, reorder cadences, and other controls that let Maia place or prepare orders on your behalf. Maia's autonomous ordering features operate based on the settings and limits you choose, and you can review, change, pause, or disable them from your account at any time.

Crescence may use automated systems for operational purposes such as fraud prevention, abuse detection, account security, order routing, recommendations, and replenishment suggestions. We do not use automated tools to make decisions that produce legal or similarly significant effects about a person without human review, and any autonomous ordering is controlled by your own preferences, budgets, cadence, and approval settings.

4. Where it comes from

Most personal information comes directly from you, when you sign up, place an order, or write a message. Some comes from our service providers: Stripe surfaces payment status, Resend reports delivery, bounce, and complaint events, Sentry forwards error traces (scrubbed of PII), and PostHog captures page-view analytics (opt-in via the cookie banner).

Crescence shares personal information only with the service providers necessary to run the platform. Each is contractually bound to use it only for our instructions and to apply security controls equivalent to ours. The current list is in the sub-processor registry below.

We disclose personal information to the following categories of third parties for business purposes: payment processors, transactional email providers, error-monitoring providers, product-analytics providers, and the other service providers listed at our sub-processor registry. We do not disclose personal information to any third party for that party's own commercial purposes.

We disclose information to law enforcement only when legally compelled (subpoena, court order, or statutory production demand), and we will notify you where legally permitted and operationally feasible.

6. Your privacy rights

We use the CCPA and CPRA as our privacy baseline. We honor the following rights for Crescence users where they apply and where it is operationally feasible, even where Crescence does not yet meet the formal legal thresholds that would make every requirement mandatory:

Right to know. Request the categories and specific pieces of personal information we have collected about you. Download a copy at /account/data-export, and you will receive an email with a 7-day signed download link.
Right to delete.Request deletion of personal information we collected from you. Submit a request from Account Settings → Privacy → Delete account. There is a 30-day cooling window during which you can cancel; after that the request is processed. Records we are legally required to keep (orders, invoices, payouts) are pseudonymized rather than deleted.
Right to correct. Request correction of inaccurate information. Most fields you can edit directly from your account settings; for fields you cannot edit, email hellocrescence@gmail.com.
Right to opt out of sale / sharing. We do not sell or share your personal information. The opt-out toggle at /legal/do-not-sell is provided as a backstop, and where your browser sends a Global Privacy Control (GPC) signal, Crescence treats it as a refusal of non-essential cookies and does not enable analytics.
Right to non-discrimination. Exercising any of the rights above does not change the price you pay or the features available to your account.
Right to limit use of sensitive personal information. You can ask us to use the sensitive categories listed in § 2 only for the services you requested. We use sensitive personal information only for purposes permitted under California regulations, such as providing the service, security, and fraud prevention. You may still contact us with any request at hellocrescence@gmail.com.

We verify identity before honoring requests by matching the request to a signed-in session or by emailing a confirmation link to the address on file. Authorized agents may submit requests on your behalf with a signed authorization, together with verification of your identity where we require it. Crescence aims to respond within 45 days after verifying your request, and complex requests may take up to 90 days with notice.

7. Cookies and tracking

Cookies are small text files a site stores in your browser. Crescence uses three categories of cookies and a few similar technologies (browser local storage) to keep you signed in, to remember your choices, and, only with your consent, to measure usage and catch errors.

Strictly necessary. Authentication, CSRF protection, consent-decision persistence, and preference storage. Always active. These cannot be disabled, since the Service does not work without them. Retained per-session, or up to one year for saved preferences.
Analytics (prior opt-in). PostHog page-view and interaction events, and experiment variant assignment where used for analytics or product improvement. Off by default. Configured for retention of up to 13 months from the last event.
Optional diagnostic error tracking (prior opt-in). Sentry exception capture with session context. Personal data is minimized and sensitive fields are scrubbed before send where feasible. Retained up to 90 days.

For visitors located in jurisdictions where prior consent is required (such as the EU and UK), non-essential cookies and similar technologies are not set until the visitor opts in. Where your browser sends a Global Privacy Control signal, Crescence treats that signal as a refusal of non-essential cookies and similar technologies, does not enable analytics, and does not show the banner. Change your choices at any time by clicking the Cookies link in the footer, or by asking your browser to send a Global Privacy Control signal.

We do not use cross-site advertising cookies, and we do not embed third-party tracking pixels on any page.

Separately, Crescence may perform basic, essential error and security logging where necessary to keep the Service secure, reliable, and functional. This essential logging is minimized and does not depend on optional cookies or storage; the richer diagnostic error tracking listed above runs only with your consent.

8. Retention

Account data: kept while your account is active.
Orders, invoices, and payouts: 7 years (US tax retention).
Messages: 3 years from last activity.
Security and audit logs: retained as long as reasonably necessary for fraud prevention, legal compliance, dispute resolution, and platform integrity.
Raw server access logs: 30 days.
Cookie consent and email delivery logs: 13 months.

When you delete your account, we pseudonymize the records we are legally required to keep (replacing your account identifier and personal fields with placeholder values) so the record stays present for accounting and audit purposes but is no longer linked to you. Where feasible, account identifiers are pseudonymized after account deletion.

9. Security

Crescence runs on Supabase (Postgres, realtime, storage, auth) and Cloudflare / Vercel edge. Both providers maintain SOC 2 Type II certification and encrypt data at rest (AES-256) and in transit (TLS 1.2+).

Database access is governed by row-level security (RLS) policies. Brand and office data is isolated at the row level, so one account cannot read another's records through the API. Service-role access is restricted to backend edge functions; the client never receives a service key.

Crescence uses Supabase Auth for identity and Supabase JWT for sessions. Passwords are hashed with bcrypt. Two-factor authentication (TOTP) is available and recommended for every account. Session tokens expire after 24 hours of inactivity; refresh tokens rotate on each use; magic links expire in 10 minutes and are single-use.

All payment processing is handled by Stripe, a PCI DSS Level 1 certified provider. Crescence never stores raw card numbers or bank account details. Payouts to brands run through Stripe Connect.

Backups are taken daily and retained for 30 days. Sensitive fields are stored encrypted, and access to them is restricted and logged. Internal access to production data is limited to the founding team, authenticated, logged, and audited under the principle of least privilege.

We have a coordinated disclosure policy at /.well-known/security.txt. If you find a vulnerability, please report it there before public disclosure. Safe harbor: if you make a good-faith effort to comply with that policy during your research, we will consider your testing authorized, work with you to resolve the issue quickly, and will not pursue or support legal action against you. Scope: limit testing to your own account and data. Do not access, modify, or delete other users' data, degrade or disrupt the Service, or use social engineering or physical attacks.

10. Children

The Service is not directed at anyone under 18. We do not knowingly collect information from minors. If you believe a minor has signed up, please email hellocrescence@gmail.com and we will delete the account.

11. Changes to this policy

We may update this policy as the Service evolves. We notify every active account by email of material changes (new categories of information, new sharing arrangements, or the removal of a right) at least 30 days before they take effect, and we review and update this policy at least once every 12 months.

12. Contact

Privacy questions: hellocrescence@gmail.com.

Crescence Inc.
5500 S University Ave
Chicago, IL 60637
United States

Sub-processors

Crescence relies on the third-party services below to operate the marketplace. Each provider is contractually bound (via a Data Processing Addendum) to process personal information only on Crescence's instructions and to apply security controls equivalent to ours. Material changes are notified to your account email at least 30 days in advance.

SupabaseUnited States
Postgres database, file storage, authentication, real-time channels.
Data processing terms
VercelUnited States
Application hosting and edge function execution.
Data processing terms
CloudflareUnited States
DNS, CDN, Turnstile CAPTCHA.
Data processing terms
AnthropicUnited States
LLM provider for the Maia AI assistant.
Data processing terms
StripeUnited States
Payments, Stripe Connect payouts, Stripe Tax, dispute handling.
Data processing terms
ResendUnited States
Transactional email delivery, bounce and complaint tracking.
Data processing terms
PlainUnited States
Customer support inbox and chat widget.
Data processing terms
TwilioUnited States
Phone-number lookup (carrier and line type) for sign-up anti-fraud screening. Receives the phone number entered at sign-up and returns carrier name plus line type (mobile, landline, VoIP). No call or message content is sent.
Data processing terms
PostHogUnited States
Product analytics and A/B experiment variant assignment. Off by default; not loaded until the visitor opts in through the cookie banner, and treated as refused when a Global Privacy Control signal is present.
Data processing terms
SentryUnited States
Error tracking and source-map symbolication.
Data processing terms
BetterStackUnited States
Uptime monitoring, status page, on-call rotation.
Data processing terms
Google LLCUnited States
Google Calendar OAuth integration. Receives an OAuth authorization code and issues access and refresh tokens scoped to the user's Google Calendar. Token data is stored encrypted per integration row. No calendar event body or attendee data is read by Crescence at this time. Data residency follows Google Workspace tenant configuration.
Data processing terms
Slack Technologies, LLCUnited States
Slack OAuth integration. Receives an OAuth authorization code and issues a workspace-scoped access token. Token data is stored encrypted per integration row. Crescence uses the token solely to post order-event notifications to a workspace channel nominated by the brand. No message history or member data is read by Crescence.
Data processing terms
US Census Bureau GeocoderUnited States
US postal address verification and normalization. Receives the typed shipping address of an office account at the point of address confirmation. No name or account identifier is transmitted; only the raw address string. Operated by the US federal government; US data residency.
Data processing terms
Komoot (Photon / OpenStreetMap)Germany (European Union)
US street-address autocomplete. Receives the partial address string an office account types into the street field, debounced per keystroke, to return completion candidates. No name or account identifier is transmitted; only the partial address text. Built on open OpenStreetMap data; the public instance is EU-hosted (self-hosting keeps the data in-region).
Data processing terms
VeeqoUnited States
Parcel shipping rate shopping and carrier label management. Receives the shipment destination address, package dimensions, and declared value for fulfilled orders. Rate quotes and carrier tracking numbers are surfaced to the buyer.
Data processing terms
Warp (Warp Logistics)United States
LTL (less-than-truckload) freight rate quoting and shipment booking for large or heavy orders. Receives origin and destination addresses and cargo dimensions. Used only when a shipment exceeds parcel thresholds.
Data processing terms
SmartyUnited States
US postal address validation and normalization. Receives the shipping address of an office account at the point of address entry. No name or account identifier is transmitted; only the raw address string. US data residency.
Data processing terms
Microsoft (Microsoft 365)United States
Microsoft Teams and Outlook Calendar OAuth integration. Receives an OAuth authorization code and issues access and refresh tokens scoped to the user's Microsoft 365 tenant. Token data is stored encrypted per integration row. No message content or calendar event body is read by Crescence at this time. US data residency where the tenant is US-hosted.
Data processing terms
QuickBooks Online (Intuit)United States
Accounting integration for brands. Receives invoice metadata (invoice ID, line items, totals, order reference) to push Crescence invoices into the brand's QuickBooks Online account. No office or buyer PII is transmitted to Intuit.
Data processing terms
Ship24Hong Kong (European Union operations)
Multi-carrier shipment tracking. Receives the carrier tracking number for a fulfilled order to return delivery status and tracking events, which are surfaced to the buyer.
Data processing terms
Have I Been Pwned (HIBP)Australia
Breached-password detection at account creation and password change. Only the first 5 characters of a SHA-1 hash of the candidate password are transmitted (k-anonymity prefix API). No plaintext password, no email address, and no account identifier leaves Crescence servers.
Data processing terms

Crescence sub-processors, their location, function, and data processing terms.
Provider	Location	Function	Terms
Supabase	United States	Postgres database, file storage, authentication, real-time channels.	DPA
Vercel	United States	Application hosting and edge function execution.	DPA
Cloudflare	United States	DNS, CDN, Turnstile CAPTCHA.	DPA
Anthropic	United States	LLM provider for the Maia AI assistant.	DPA
Stripe	United States	Payments, Stripe Connect payouts, Stripe Tax, dispute handling.	DPA
Resend	United States	Transactional email delivery, bounce and complaint tracking.	DPA
Plain	United States	Customer support inbox and chat widget.	DPA
Twilio	United States	Phone-number lookup (carrier and line type) for sign-up anti-fraud screening. Receives the phone number entered at sign-up and returns carrier name plus line type (mobile, landline, VoIP). No call or message content is sent.	DPA
PostHog	United States	Product analytics and A/B experiment variant assignment. Off by default; not loaded until the visitor opts in through the cookie banner, and treated as refused when a Global Privacy Control signal is present.	DPA
Sentry	United States	Error tracking and source-map symbolication.	DPA
BetterStack	United States	Uptime monitoring, status page, on-call rotation.	DPA
Google LLC	United States	Google Calendar OAuth integration. Receives an OAuth authorization code and issues access and refresh tokens scoped to the user's Google Calendar. Token data is stored encrypted per integration row. No calendar event body or attendee data is read by Crescence at this time. Data residency follows Google Workspace tenant configuration.	DPA
Slack Technologies, LLC	United States	Slack OAuth integration. Receives an OAuth authorization code and issues a workspace-scoped access token. Token data is stored encrypted per integration row. Crescence uses the token solely to post order-event notifications to a workspace channel nominated by the brand. No message history or member data is read by Crescence.	DPA
US Census Bureau Geocoder	United States	US postal address verification and normalization. Receives the typed shipping address of an office account at the point of address confirmation. No name or account identifier is transmitted; only the raw address string. Operated by the US federal government; US data residency.	DPA
Komoot (Photon / OpenStreetMap)	Germany (European Union)	US street-address autocomplete. Receives the partial address string an office account types into the street field, debounced per keystroke, to return completion candidates. No name or account identifier is transmitted; only the partial address text. Built on open OpenStreetMap data; the public instance is EU-hosted (self-hosting keeps the data in-region).	DPA
Veeqo	United States	Parcel shipping rate shopping and carrier label management. Receives the shipment destination address, package dimensions, and declared value for fulfilled orders. Rate quotes and carrier tracking numbers are surfaced to the buyer.	DPA
Warp (Warp Logistics)	United States	LTL (less-than-truckload) freight rate quoting and shipment booking for large or heavy orders. Receives origin and destination addresses and cargo dimensions. Used only when a shipment exceeds parcel thresholds.	DPA
Smarty	United States	US postal address validation and normalization. Receives the shipping address of an office account at the point of address entry. No name or account identifier is transmitted; only the raw address string. US data residency.	DPA
Microsoft (Microsoft 365)	United States	Microsoft Teams and Outlook Calendar OAuth integration. Receives an OAuth authorization code and issues access and refresh tokens scoped to the user's Microsoft 365 tenant. Token data is stored encrypted per integration row. No message content or calendar event body is read by Crescence at this time. US data residency where the tenant is US-hosted.	DPA
QuickBooks Online (Intuit)	United States	Accounting integration for brands. Receives invoice metadata (invoice ID, line items, totals, order reference) to push Crescence invoices into the brand's QuickBooks Online account. No office or buyer PII is transmitted to Intuit.	DPA
Ship24	Hong Kong (European Union operations)	Multi-carrier shipment tracking. Receives the carrier tracking number for a fulfilled order to return delivery status and tracking events, which are surfaced to the buyer.	DPA
Have I Been Pwned (HIBP)	Australia	Breached-password detection at account creation and password change. Only the first 5 characters of a SHA-1 hash of the candidate password are transmitted (k-anonymity prefix API). No plaintext password, no email address, and no account identifier leaves Crescence servers.	DPA

If you have a privacy concern that involves one of the providers above (for example, you want your Sentry-captured error data deleted), email hellocrescence@gmail.com and we coordinate the request on your behalf.

Data inventory

A summary of the main categories of personal data Crescence processes, mapped to a GDPR-style category, a CCPA / CPRA-style category, the lawful basis, a general retention period, and the sub-processors that may receive it. Not an exhaustive field-by-field list, so it stays durable as the product, schema, vendor list, and Maia workflows evolve. Crescence is intended for businesses and users in the United States; the GDPR framing is used to make the data easier to understand, not because Crescence operates as an EU or UK service.

Name and company nameGDPR category: Identity dataCCPA category: IdentifiersLawful basis: Performance of a contract, or a service you enableRetention: While the account is active. Deleted or pseudonymized after account deletion, unless it must be retained for legal, tax, fraud-prevention, security, audit, or dispute-resolution purposes.Sub-processors: Supabase; Stripe where Stripe provides payment or verification services
Email addressGDPR category: Contact dataCCPA category: IdentifiersLawful basis: Performance of a contract, or a service you enableRetention: While the account is active. Deleted or pseudonymized after account deletion, unless it must be retained for legal, tax, fraud-prevention, security, audit, or dispute-resolution purposes.Sub-processors: Supabase; Resend (transactional email); Plain (support)
Phone numberGDPR category: Contact dataCCPA category: IdentifiersLawful basis: Performance of a contract, or a service you enableRetention: While the account is active. Deleted or pseudonymized after account deletion, unless it must be retained for legal, tax, fraud-prevention, security, audit, or dispute-resolution purposes.Sub-processors: Supabase; Twilio where phone verification runs
Phone carrier and line type (sign-up anti-fraud lookup)GDPR category: Profile dataCCPA category: Identifiers; inferencesLawful basis: Legitimate interestsRetention: While the account is active. Deleted or pseudonymized after account deletion, unless it must be retained for legal, tax, fraud-prevention, security, audit, or dispute-resolution purposes.Sub-processors: Supabase; Twilio where the anti-fraud lookup runs
Mailing and shipping addressGDPR category: Contact dataCCPA category: Identifiers; commercial informationLawful basis: Performance of a contract, or a service you enableRetention: Kept with the related order, generally 7 years (US tax retention).Sub-processors: Supabase; address-validation and shipping providers where used for that workflow (US Census Bureau Geocoder, Komoot, Veeqo, Warp)
Role (brand operator vs. business buyer)GDPR category: Profile dataCCPA category: IdentifiersLawful basis: Performance of a contract, or a service you enableRetention: While the account is active. Deleted or pseudonymized after account deletion, unless it must be retained for legal, tax, fraud-prevention, security, audit, or dispute-resolution purposes.Sub-processors: Supabase
Account credentials (password hash, salt)GDPR category: Authentication dataCCPA category: Sensitive personal informationLawful basis: Performance of a contract, or a service you enableRetention: While the account is active. Deleted or pseudonymized after account deletion, unless it must be retained for legal, tax, fraud-prevention, security, audit, or dispute-resolution purposes.Sub-processors: Supabase
Government-issued ID and verification materials (brand verification)GDPR category: Identity verification dataCCPA category: Sensitive personal informationLawful basis: Legal obligationRetention: Verification materials are generally handled by Stripe. Where Crescence stores any copies, they are retained only as long as necessary for verification, fraud prevention, legal compliance, or dispute resolution.Sub-processors: Stripe; Supabase where a copy is stored
Orders, listings, sample requests, dispute recordsGDPR category: Transaction dataCCPA category: Commercial informationLawful basis: Performance of a contract, or a service you enableRetention: Generally 7 years (US tax retention).Sub-processors: Supabase; Stripe where payment applies
Payment status and payout historyGDPR category: Financial dataCCPA category: Commercial informationLawful basis: Performance of a contract, or a service you enableRetention: Generally handled by Stripe where Stripe provides payment and payout services; references kept up to 7 years (US tax retention).Sub-processors: Stripe; Supabase (references)
Tokenized payment methods and payout account detailsGDPR category: Financial dataCCPA category: Sensitive personal informationLawful basis: Performance of a contract, or a service you enableRetention: Generally handled by Stripe where Stripe provides payment and payout services, per Stripe's retention policy.Sub-processors: Stripe
Tax identification numbers (W-9 / 1099-K)GDPR category: Financial dataCCPA category: Sensitive personal informationLawful basis: Legal obligationRetention: Generally handled by Stripe where Stripe provides tax services; retained as required for US tax reporting.Sub-processors: Stripe
Invoice PDFsGDPR category: Transaction dataCCPA category: Commercial informationLawful basis: Legal obligationRetention: Generally 7 years (US tax retention).Sub-processors: Supabase; QuickBooks Online where the accounting integration is enabled
IP addressGDPR category: Technical dataCCPA category: Internet or other network activityLawful basis: Legitimate interestsRetention: Server access logs: about 30 days.Sub-processors: Vercel, Cloudflare, Supabase
User agent, referring URL, pages visited, session timestamps (analytics)GDPR category: Usage dataCCPA category: Internet or other network activityLawful basis: ConsentRetention: PostHog: configured for up to 13 months from the last event.Sub-processors: PostHog, where analytics is enabled with your consent
Sign-up IP address and user agent (anti-fraud signals)GDPR category: Technical dataCCPA category: Internet or other network activityLawful basis: Legitimate interestsRetention: Kept as a fraud-prevention signal while the account is active. Deleted or pseudonymized after account deletion, unless it must be retained for legal, tax, fraud-prevention, security, audit, or dispute-resolution purposes.Sub-processors: Supabase
Approximate (city-level) location from IPGDPR category: Location dataCCPA category: Geolocation dataLawful basis: Legitimate interestsRetention: Not stored beyond the access-log window.Sub-processors: Cloudflare
Cookie and storage identifiers and consent recordGDPR category: Technical dataCCPA category: Internet or other network activityLawful basis: Legal obligation where applicable, otherwise legitimate interests in remembering your privacy choicesRetention: Consent record: at least 13 months.Sub-processors: None
In-app messagesGDPR category: Communications dataCCPA category: Electronic communications informationLawful basis: Performance of a contract, or a service you enableRetention: 3 years from last activity. Deleted or pseudonymized after account deletion, unless it must be retained for legal, tax, fraud-prevention, security, audit, or dispute-resolution purposes.Sub-processors: Supabase
Support ticketsGDPR category: Communications dataCCPA category: Electronic communications informationLawful basis: Legitimate interestsRetention: 3 years from last activity.Sub-processors: Plain
Email delivery, bounce, and complaint eventsGDPR category: Communications metadataCCPA category: Internet or other network activityLawful basis: Legitimate interestsRetention: About 13 months from send date.Sub-processors: Resend
Maia drafts, recommendations, approvals, rejections, overrides, and edits you makeGDPR category: Profile dataCCPA category: InferencesLawful basis: Legitimate interestsRetention: While the account is active. Deleted or pseudonymized after account deletion, unless it must be retained for legal, tax, fraud-prevention, security, audit, or dispute-resolution purposes.Sub-processors: Supabase; Anthropic where Maia processes the request
Maia settings and autopilot controls (preferences, budgets, reorder cadences, approval settings, product rules)GDPR category: Profile dataCCPA category: Identifiers; inferencesLawful basis: Performance of a contract, or a service you enableRetention: While the account is active. Deleted or pseudonymized after account deletion, unless it must be retained for legal, tax, fraud-prevention, security, audit, or dispute-resolution purposes.Sub-processors: Supabase; Anthropic where Maia uses them to prepare an order
Maia order activity (generated suggestions, approvals, pauses, overrides, and autopilot order history)GDPR category: Transaction dataCCPA category: Commercial informationLawful basis: Performance of a contract, or a service you enableRetention: Placed orders: kept with the order, generally 7 years (US tax retention). Suggestions and settings: while the account is active. Deleted or pseudonymized after account deletion, unless it must be retained for legal, tax, fraud-prevention, security, audit, or dispute-resolution purposes.Sub-processors: Supabase; Stripe where an order is placed
Product and workplace preferences, including dietary or allergen preferences where provided or inferredGDPR category: Profile dataCCPA category: InferencesLawful basis: Legitimate interestsRetention: While the account is active. Crescence does not intentionally use these preferences to infer protected traits. Deleted or pseudonymized after account deletion, unless it must be retained for legal, tax, fraud-prevention, security, audit, or dispute-resolution purposes.Sub-processors: Supabase; Anthropic where Maia uses them
Essential error and security loggingGDPR category: Technical dataCCPA category: Internet or other network activityLawful basis: Legitimate interestsRetention: Basic error and security logging that may run where necessary to keep the Service secure, reliable, and functional. Crescence configures it to minimize personal data and scrub sensitive fields where feasible. Retained up to 90 days.Sub-processors: Sentry (essential capture)
Optional diagnostic error trackingGDPR category: Technical dataCCPA category: Internet or other network activityLawful basis: ConsentRetention: Richer diagnostic error context that runs only with consent. Crescence configures error tracking to minimize personal data and scrub sensitive fields where feasible. Retained up to 90 days (about 3 months).Sub-processors: Sentry, where enabled with your consent
OAuth tokens for connected integrationsGDPR category: Technical dataCCPA category: Sensitive personal informationLawful basis: Performance of a contract, or a service you enableRetention: Treated as sensitive where they grant account or integration access. Encrypted at rest, access restricted, and retained until the integration is disconnected or the account is deleted, unless retention is legally required.Sub-processors: Google, Slack, Microsoft, or QuickBooks Online, where the corresponding integration is enabled
Uptime and on-call alert metadataGDPR category: Operational dataCCPA category: Internet or other network activityLawful basis: Legitimate interestsRetention: Per BetterStack's retention policy, where uptime monitoring is used.Sub-processors: BetterStack

Categories of personal data Crescence processes, mapped to GDPR and CCPA categories, lawful basis, retention, and sub-processors.
Data point	GDPR category	CCPA category	Lawful basis	Retention	Sub-processors
Name and company name	Identity data	Identifiers	Performance of a contract, or a service you enable	While the account is active. Deleted or pseudonymized after account deletion, unless it must be retained for legal, tax, fraud-prevention, security, audit, or dispute-resolution purposes.	Supabase; Stripe where Stripe provides payment or verification services
Email address	Contact data	Identifiers	Performance of a contract, or a service you enable	While the account is active. Deleted or pseudonymized after account deletion, unless it must be retained for legal, tax, fraud-prevention, security, audit, or dispute-resolution purposes.	Supabase; Resend (transactional email); Plain (support)
Phone number	Contact data	Identifiers	Performance of a contract, or a service you enable	While the account is active. Deleted or pseudonymized after account deletion, unless it must be retained for legal, tax, fraud-prevention, security, audit, or dispute-resolution purposes.	Supabase; Twilio where phone verification runs
Phone carrier and line type (sign-up anti-fraud lookup)	Profile data	Identifiers; inferences	Legitimate interests	While the account is active. Deleted or pseudonymized after account deletion, unless it must be retained for legal, tax, fraud-prevention, security, audit, or dispute-resolution purposes.	Supabase; Twilio where the anti-fraud lookup runs
Mailing and shipping address	Contact data	Identifiers; commercial information	Performance of a contract, or a service you enable	Kept with the related order, generally 7 years (US tax retention).	Supabase; address-validation and shipping providers where used for that workflow (US Census Bureau Geocoder, Komoot, Veeqo, Warp)
Role (brand operator vs. business buyer)	Profile data	Identifiers	Performance of a contract, or a service you enable	While the account is active. Deleted or pseudonymized after account deletion, unless it must be retained for legal, tax, fraud-prevention, security, audit, or dispute-resolution purposes.	Supabase
Account credentials (password hash, salt)	Authentication data	Sensitive personal information	Performance of a contract, or a service you enable	While the account is active. Deleted or pseudonymized after account deletion, unless it must be retained for legal, tax, fraud-prevention, security, audit, or dispute-resolution purposes.	Supabase
Government-issued ID and verification materials (brand verification)	Identity verification data	Sensitive personal information	Legal obligation	Verification materials are generally handled by Stripe. Where Crescence stores any copies, they are retained only as long as necessary for verification, fraud prevention, legal compliance, or dispute resolution.	Stripe; Supabase where a copy is stored
Orders, listings, sample requests, dispute records	Transaction data	Commercial information	Performance of a contract, or a service you enable	Generally 7 years (US tax retention).	Supabase; Stripe where payment applies
Payment status and payout history	Financial data	Commercial information	Performance of a contract, or a service you enable	Generally handled by Stripe where Stripe provides payment and payout services; references kept up to 7 years (US tax retention).	Stripe; Supabase (references)
Tokenized payment methods and payout account details	Financial data	Sensitive personal information	Performance of a contract, or a service you enable	Generally handled by Stripe where Stripe provides payment and payout services, per Stripe's retention policy.	Stripe
Tax identification numbers (W-9 / 1099-K)	Financial data	Sensitive personal information	Legal obligation	Generally handled by Stripe where Stripe provides tax services; retained as required for US tax reporting.	Stripe
Invoice PDFs	Transaction data	Commercial information	Legal obligation	Generally 7 years (US tax retention).	Supabase; QuickBooks Online where the accounting integration is enabled
IP address	Technical data	Internet or other network activity	Legitimate interests	Server access logs: about 30 days.	Vercel, Cloudflare, Supabase
User agent, referring URL, pages visited, session timestamps (analytics)	Usage data	Internet or other network activity	Consent	PostHog: configured for up to 13 months from the last event.	PostHog, where analytics is enabled with your consent
Sign-up IP address and user agent (anti-fraud signals)	Technical data	Internet or other network activity	Legitimate interests	Kept as a fraud-prevention signal while the account is active. Deleted or pseudonymized after account deletion, unless it must be retained for legal, tax, fraud-prevention, security, audit, or dispute-resolution purposes.	Supabase
Approximate (city-level) location from IP	Location data	Geolocation data	Legitimate interests	Not stored beyond the access-log window.	Cloudflare
Cookie and storage identifiers and consent record	Technical data	Internet or other network activity	Legal obligation where applicable, otherwise legitimate interests in remembering your privacy choices	Consent record: at least 13 months.	None
In-app messages	Communications data	Electronic communications information	Performance of a contract, or a service you enable	3 years from last activity. Deleted or pseudonymized after account deletion, unless it must be retained for legal, tax, fraud-prevention, security, audit, or dispute-resolution purposes.	Supabase
Support tickets	Communications data	Electronic communications information	Legitimate interests	3 years from last activity.	Plain
Email delivery, bounce, and complaint events	Communications metadata	Internet or other network activity	Legitimate interests	About 13 months from send date.	Resend
Maia drafts, recommendations, approvals, rejections, overrides, and edits you make	Profile data	Inferences	Legitimate interests	While the account is active. Deleted or pseudonymized after account deletion, unless it must be retained for legal, tax, fraud-prevention, security, audit, or dispute-resolution purposes.	Supabase; Anthropic where Maia processes the request
Maia settings and autopilot controls (preferences, budgets, reorder cadences, approval settings, product rules)	Profile data	Identifiers; inferences	Performance of a contract, or a service you enable	While the account is active. Deleted or pseudonymized after account deletion, unless it must be retained for legal, tax, fraud-prevention, security, audit, or dispute-resolution purposes.	Supabase; Anthropic where Maia uses them to prepare an order
Maia order activity (generated suggestions, approvals, pauses, overrides, and autopilot order history)	Transaction data	Commercial information	Performance of a contract, or a service you enable	Placed orders: kept with the order, generally 7 years (US tax retention). Suggestions and settings: while the account is active. Deleted or pseudonymized after account deletion, unless it must be retained for legal, tax, fraud-prevention, security, audit, or dispute-resolution purposes.	Supabase; Stripe where an order is placed
Product and workplace preferences, including dietary or allergen preferences where provided or inferred	Profile data	Inferences	Legitimate interests	While the account is active. Crescence does not intentionally use these preferences to infer protected traits. Deleted or pseudonymized after account deletion, unless it must be retained for legal, tax, fraud-prevention, security, audit, or dispute-resolution purposes.	Supabase; Anthropic where Maia uses them
Essential error and security logging	Technical data	Internet or other network activity	Legitimate interests	Basic error and security logging that may run where necessary to keep the Service secure, reliable, and functional. Crescence configures it to minimize personal data and scrub sensitive fields where feasible. Retained up to 90 days.	Sentry (essential capture)
Optional diagnostic error tracking	Technical data	Internet or other network activity	Consent	Richer diagnostic error context that runs only with consent. Crescence configures error tracking to minimize personal data and scrub sensitive fields where feasible. Retained up to 90 days (about 3 months).	Sentry, where enabled with your consent
OAuth tokens for connected integrations	Technical data	Sensitive personal information	Performance of a contract, or a service you enable	Treated as sensitive where they grant account or integration access. Encrypted at rest, access restricted, and retained until the integration is disconnected or the account is deleted, unless retention is legally required.	Google, Slack, Microsoft, or QuickBooks Online, where the corresponding integration is enabled
Uptime and on-call alert metadata	Operational data	Internet or other network activity	Legitimate interests	Per BetterStack's retention policy, where uptime monitoring is used.	BetterStack

“Lawful basis” is the ground that permits the processing: a contract you entered into or a service you enable, our legitimate interests, your consent, or a legal obligation. Where the basis is consent, we do not collect the data until you opt in, and you can withdraw consent at any time. Retention periods are general maximums; we delete or pseudonymize data sooner where it is no longer needed. “Sub-processors” lists the third parties that may receive the data point where a feature, integration, or workflow makes it necessary; not every listed provider receives every data point.