Privacy Policy
Version 1.4 — in force from 2 November 2026 (version 1.3: 1 November 2026; version 1.2: 30 October 2026; version 1.1: 28 October 2026; version 1.0: 8 October 2026)
1. Controller
The controller of personal data processed through Cresques is binqode Robert Binkowski (Cresques is the brand), ul. Marsz. J. Piłsudskiego 91/1, 50-019 Wrocław, Poland, VAT PL6263027353. Contact for privacy matters: privacy@cresques.com.
2. Data about our users
| Data | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| E-mail address, optional name, chosen language, optional answer to “How did you hear about us?”, and the campaign tag (utm) of the sign-in page you created the account from, if any | account, sign-in, service messages | contract (Art. 6(1)(b)); for team members invited by a customer: legitimate interest (Art. 6(1)(f)) | until the account is deleted |
| Sessions: IP address, browser, dates | keeping you signed in, security | legitimate interest (security) | until the session expires + 7 days |
| Server logs (IP address, browser, pages requested, time) | security, troubleshooting, aggregate traffic statistics without cookies | legitimate interest (security, measuring use of the site) | 14 days; the statistics kept longer contain only counts, no addresses |
| Visits to the public pages and the sign-in page (page, language, referring website, campaign tags, device and browser type, browser language, and a visitor code computed from the IP address and browser with a random value that changes every day). Visits from a browser that is signed in are not counted | audience measurement of our own website, without cookies; the IP address itself is not stored | legitimate interest (understanding how the site is used) | 13 months; the daily random value is deleted after two days, after which a visitor code can no longer be linked to anyone |
| Steps on the way into the Service (a sign-in code asked for, a sign-in, the first screen of a new account, the new-market form opened, a market created, a locked company profile seen, a checkout started, a free preview asked for), each stored as the day, the name of the step and a daily code computed from your e-mail address and the same daily random value; the address, your account and the time of day are not stored with it | seeing, in totals, at which step new users stop; without cookies | legitimate interest (improving the first steps of the Service) | 13 months; the daily random value is deleted after two days, after which the code can no longer be linked to anyone; nothing is recorded when your browser sends Do Not Track or Global Privacy Control |
| E-mail address, language and what you have done in the Service (for example whether you created a market or have unused credits) | service e-mails that help you use the Service: a few short guides after you sign up, a reminder about unused credits, a notice before a yearly plan renews | legitimate interest (helping you use what you signed up for); you can stop them in Settings or with the link in each e-mail | until you stop them or delete your account |
| E-mail address, language and your consent (when, where and the exact text you agreed to) | news and offers by e-mail, once or twice a month | consent (you can withdraw it at any time, in Settings or with the link in each e-mail) | until you withdraw your consent; the record of the consent is kept until your account is deleted |
| Sign-in codes and links (stored only as hashes) | passwordless sign-in | contract | 10 minutes + 1 day |
| Name and e-mail address from Google, Microsoft or LinkedIn (only if you sign in with one of them) | account, sign-in | contract | until the account is deleted |
| Acceptance of the Terms (version, date) | proof of the agreement | contract; legitimate interest (evidence) | until the account is deleted |
| Materials you submit (a brochure PDF or a website address) and the markets you create | suggesting product categories; your market set-up | contract | brochures are processed in memory and not stored; markets until you delete them or the account |
| Questions you ask the in-app assistant and its answers (visible to your workspace) | answering your questions about the Service and your workspace data (processed by Anthropic, see processors) | contract | 30 days, or until you clear the conversation |
| Invitations (invitee's e-mail) | joining a workspace | legitimate interest of the inviting customer | expiry (48 h) + 30 days |
| Audit trail (user ID, action, time) | security, accountability | legitimate interest | 13 months |
| Billing data (company, billing address, VAT number, contact e-mail, payment provider customer ID) | payments, invoices, tax | contract; legal obligation (Art. 6(1)(c)) | as required by tax law (typically 5 years) |
| A one-way hash (SHA-256) of the e-mail address that received the free credits | free credits once per person, preventing abuse | legitimate interest | 24 months, also after the account is deleted |
| Weekly market e-mail ("Watch this market" on the public pages): e-mail address, the market chosen, the consent text with its date and the page it was given on, a coarse browser description | sending the weekly e-mail you asked for, proving the consent, limiting abuse of the form | consent (Art. 6(1)(a)); you can withdraw it at any time | until you unsubscribe (then only a one-way hash of the address, 24 months, so we do not write again); an unconfirmed request is deleted after 7 days |
| Free preview request (form on the public pages, no account): work e-mail address, what you make (a website address or one line), the target country, the page and language of the form, a campaign tag (utm) if the visit had one, the wording of your request with its date, a coarse browser description | preparing and sending the one preview and price you asked for, proving that you asked for it, limiting abuse of the form. Not used for marketing: you are not added to any list | steps taken at your request before a contract (Art. 6(1)(b)); where you ask on behalf of your employer, and for the proof and the abuse limits, legitimate interest (Art. 6(1)(f)) | 90 days after we answer, then only a one-way hash of the address with the wording of the request and its dates for 24 months; a request we did not answer or declined is deleted after 30 days |
We use no advertising, analytics or tracking cookies, and the public pages set no cookies and store nothing on your device. Our own audience measurement (see the table above) runs on our servers in the EU, uses no third party, and records nothing when your browser sends Do Not Track or Global Privacy Control. After you sign in, the Service uses only these, which are needed for what you asked for and therefore need no consent:
- __Secure-cresques.session_token — keeps you signed in (30 days, or until you sign out);
- cresques.known_device — marks this browser as one that has signed in to your account before, so that sign-in codes keep reaching you here even if someone else keeps requesting codes for your address (13 months; it is not a session and holds no personal data beyond a keyed fingerprint of your e-mail address);
- cresques_currency — remembers the currency you chose for amounts in the app (12 months; set only when you choose one);
- sidebar_state — remembers whether you collapsed the side menu (7 days; set only when you do).
When you pay, Stripe's checkout page (on stripe.com) uses its own cookies for payment security and fraud prevention, under Stripe's privacy policy.
3. Data about businesses in our database
To show manufacturers who already sells a product category, we compile information about businesses that won public contracts, from contract award notices published in TED (Tenders Electronic Daily, © European Union) and from the businesses' own public websites: company name, address, registration number, website and generic company e-mail addresses (such as info@). Where a business is run by an individual, its name may identify that person.
- Legal basis: legitimate interest (Art. 6(1)(f)) in helping businesses find commercial partners, using data the businesses or public authorities have made public.
- We do not store names, personal e-mail addresses or phone numbers of contact persons that appear in procurement notices — they are removed before storage.
- You can object at any time (privacy@cresques.com); we will remove your business from what we show customers and keep a minimal record so it is not re-imported.
4. Recipients and transfers
We use these service providers, bound by data-processing agreements:
- OVHcloud — hosting, backups and e-mail delivery (sign-in codes and service messages), in France (EU);
- Google, Microsoft or LinkedIn — only if you choose to sign in with one of them; the provider gives us your name and e-mail address, and we send it nothing;
- Stripe — card payments and payment receipts (Stripe Payments Europe, Ireland; transfers to the US under the EU–US Data Privacy Framework or standard contractual clauses). Card details go to Stripe directly and never reach us.
- inFakt — issuing and keeping our VAT invoices (inFakt Sp. z o.o., Kraków, Poland). Your workspace's billing details (company name, address, VAT number, billing e-mail) and the invoice lines go there. Invoices are also filed in the Polish National e-Invoice System (KSeF, run by the Ministry of Finance), as the law requires; that is a legal obligation, not a service provider of ours.
- Anthropic — AI analysis of business information and public websites, when AI features are enabled (US; standard contractual clauses / Data Privacy Framework). We do not send our users' account data to AI providers.
We do not sell personal data and do not use it for advertising. Data is stored in the EU.
5. Your rights
You have the right to access, rectify and erase your data, to restrict processing, to data portability and to object to processing based on legitimate interest. Signed-in users can download all their data and delete their account in Settings. You can also lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.
6. Automated decisions
We may classify businesses automatically (for example, distributor or manufacturer). These classifications do not produce legal or similarly significant effects on individuals.
7. Security
Data is encrypted in transit, customer workspaces are isolated from each other at database level, sign-in uses one-time codes and links instead of passwords, backups are encrypted, and access is limited to what each component needs. In the event of a personal data breach we will notify the supervisory authority within 72 hours where required and inform affected users without undue delay.
8. Changes
We will publish changes to this policy here and notify account owners of material changes by e-mail.