by CrestSync
Privacy policy
How Crest Sync (Private) Limited handles the data that flows through Cresa. Last updated: 21 October 2026.
1. Who we are
Cresa is operated by Crest Sync (Private) Limited (“Cresa”, “we”, “us”), a company registered in Pakistan (NTN I093522), Suite #611, 6th Floor, Mashriq Centre, Sir Shah Suleman Road, Block-14, Gulshan-e-Iqbal, Karachi 75850, Pakistan. Cresa is a multi-tenant platform that helps businesses (“Business Customers”) manage customer conversations, automate workflows and send AI-assisted replies across the channels they connect.
For data processed through connected channels, the Business Customer is the data controller and Cresa acts as their processor, handling data on their behalf and under their instructions. For our own account, billing, website and service-operations data, Cresa is the controller.
2. Information we process
- Account and business data: names, email addresses, hashed passwords, roles, organisation details and settings of Business Customers and their team members.
- Connected channel data: when a Business Customer connects a channel — WhatsApp Business, Facebook Messenger, Instagram, Facebook and Instagram comments, Threads, YouTube, LinkedIn Page comments, TikTok comments, Google Business Profile reviews, website chat or an email mailbox — we process the account and page identifiers, message and comment content, attachments, sender names and identifiers, timestamps and delivery-status events needed to provide the inbox, automation, analytics and reply features.
- End-customer data: information about the people who contact a Business Customer (for example phone number, display name, email address and what they send), and records the Business Customer keeps about them, such as contacts, leads, deals, tickets, appointments and facts the AI agent is allowed to remember.
- Store data: if a Business Customer connects Shopify or WooCommerce, the product catalogue and the order details needed to answer order questions and create orders or payment links the customer confirms.
- Calendar data: if a team member connects a Google or Microsoft 365 calendar, we read free/busy times of the calendars they choose — never the titles, attendees or contents of their events — and create, update and delete the booking events Cresa itself adds.
- Phone calls: if a Business Customer enables the phone agent on their own Twilio number, the caller's number, the speech transcription and the agent's replies are stored as a call transcript.
- Knowledge base material: documents, web pages and FAQs a Business Customer uploads for the AI agent to answer from.
- Billing data: plan, subscription and payment status. Payments are handled by Paddle; we never see or store full card numbers.
- Technical data: logs, device and browser information, IP addresses and the session cookies needed to sign users in and keep the service secure.
3. How we use information
- to display conversations and route them to the right team member;
- to generate AI-assisted replies, summaries, transcriptions and voice output when the Business Customer enables them;
- to let the AI agent take the actions a Business Customer switches on, such as booking appointments, creating leads or tickets, requesting approvals and scheduling follow-ups;
- to send messages, templates and interactive forms on the Business Customer's behalf;
- to provide analytics, monitor channel health and keep the service secure and auditable;
- to process subscriptions, prevent fraud and abuse, and meet legal and platform obligations.
Where laws such as the EU or UK GDPR apply, we rely on these legal bases for the data we control: performing our contract with you (running your account and the features you use); our legitimate interests in operating, securing and improving the service and preventing abuse; your consent, for website analytics and advertising cookies, which you can withdraw at any time; and legal obligations, such as keeping tax and accounting records. For data we process on a Business Customer's behalf, the Business Customer decides the legal basis.
4. AI processing
When a Business Customer enables AI features, the message content and context needed for the task are sent to our AI providers — currently OpenAI, Google (Gemini) and ElevenLabs — to produce a result. We send only what the task needs. We do not use message content to train AI models, and we use these providers under business API terms that do not allow them to train their models on it; they may keep it briefly (for example up to 30 days) to detect abuse before deleting it. Voice notes are transcribed and images read so they can be answered. These providers may process data in the United States and other countries, so AI features involve an international transfer of the content concerned. Business Customers can switch AI features off at any time, and can hold every AI draft for a person to approve before it is sent.
AI-generated responses can be inaccurate. Business Customers are responsible for reviewing them before allowing automatic replies.
5. Google and Microsoft data
Cresa's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data from Google and Microsoft accounts (calendar free/busy times, YouTube comments, Google Business Profile reviews) is used only to provide the features the user connected it for, is not used for advertising, is not sold, and is not read by people except with the user's consent, for security, or where the law requires it.
6. Meta platform data
Our use of data obtained through Meta APIs (WhatsApp Business Platform, Messenger, Instagram and Threads) complies with the Meta Platform Terms and Developer Policies. We access it only with the Business Customer's authorisation, use it only to provide the features they enable, and do not sell it or use it for advertising. When a channel is disconnected or our app is removed, we stop processing the associated data and delete or anonymise it as described in section 9.
7. How we share information
We do not sell personal data. We share it only as needed to run the service, with these sub-processors:
- Railway — application hosting and job queues.
- MongoDB Atlas — database and file storage.
- OpenAI, Google (Gemini) and ElevenLabs — AI processing as described in section 4.
- Resend — sending account, billing and notification email.
- Sentry — error monitoring. Error reports can incidentally include content present when an error occurred.
- Paddle — our merchant of record for subscriptions and payments. Paddle does not receive message content.
Data also passes to the platforms a Business Customer connects — Meta, Google, Microsoft, LinkedIn, TikTok, Shopify, WooCommerce and Twilio — under those platforms' own terms and the Business Customer's own accounts with them. If a Business Customer sets up event webhooks or connects an AI assistant through Cresa's MCP server, the data they choose is sent to the destination they configure.
We may also disclose information where the law requires it, to protect our rights or the safety of others, or as part of a corporate transaction with appropriate safeguards.
8. International transfers
Our providers may process data outside your country, including outside Pakistan. Where we transfer personal data internationally we rely on appropriate safeguards — such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, or an adequacy decision where one exists — and require providers to protect it consistently with this policy.
9. Retention
We keep data only as long as needed to provide the service, meet legal or contractual obligations, resolve disputes and enforce our agreements. Connected channel data is kept while the channel stays connected and is deleted or anonymised after disconnection or a valid deletion request, typically within 30 days, subject to legal retention requirements. Records of the actions the AI agent takes are kept for 180 days, and notifications and activity history for 90 days. When an account is closed we delete its workspace data, normally within 30 days; backups roll off within their normal cycle. Billing records are kept for as long as tax and accounting law requires, and Paddle keeps its own records as merchant of record.
10. Security
We protect data with administrative, technical and organisational controls, including encryption in transit, encryption at rest of stored store, calendar and API credentials, hashed passwords, role-based access and isolation between workspaces. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting personal data, we will notify affected Business Customers without undue delay and, where the law requires, the relevant authorities and individuals.
11. Your rights and choices
Business Customers can disconnect channels, switch off AI features, export or delete records and close their account at any time. People who messaged a business through Cresa should contact that business, which controls their data; you can also contact us and we will pass the request on. Depending on where you live — for example in the European Union, the United Kingdom, California or other US states — you may have rights to access, correct, delete, export or restrict the processing of your personal data, to object to processing based on legitimate interests, and to withdraw consent. To use them, email us; we will respond within one month (or the time your law sets) and will not treat you differently for exercising them. You can also complain to your local data-protection authority. We do not sell personal data. The Meta Pixel on our website, if you accept it, may count as “sharing” for targeted advertising under some US state laws; you can decline or withdraw it at any time with “Cookie settings”. See our data deletion page.
12. Cookies
The Cresa app uses only strictly necessary cookies, to sign users in and keep sessions secure.
This website (cresa.digital) uses Google Analytics to understand how visitors use the site and, where enabled, the Meta Pixel to measure our advertising — but only after you accept them in the cookie banner. If you decline, neither is loaded. They collect information such as the pages you visit, how you arrived, your approximate location, device and browser, and whether you clicked to start a trial or contact us. Google and Meta process this data under their own privacy policies. You can change your choice at any time with “Cookie settings” in the footer, and you can also block cookies in your browser.
13. Children
Cresa is a business tool not directed to children. We do not knowingly collect personal data from children under 16; if you believe a child has provided us data, contact us and we will delete it.
14. Changes
We may update this policy. We will change the “last updated” date above and, where appropriate, give additional notice.
15. Contact
Crest Sync (Private) Limited, Suite #611, 6th Floor, Mashriq Centre, Sir Shah Suleman Road, Block-14, Gulshan-e-Iqbal, Karachi 75850, Pakistan
Privacy questions: hello@crestsync.com