Privacy Policy

Who we are

Creslo is operated by Creslo AI Ltd, a company registered in England and Wales (company number 17256802) with its registered office at Bartle House, Oxford Court, Manchester M2 3WQ, and registered with the UK Information Commissioner's Office (ICO) under registration number ZC169912. For anything in this policy, you can reach us at privacy@creslo.ai. Creslo AI Ltd is the data controller for the personal data described here.

The data we collect

Account data

When you create an account we collect your email address and authentication details (handled by our authentication provider, Supabase). If you add them, we also store your name and basic profile information.

Brand profile data

Information you enter to describe your brand - business name, industry, tone, audience, description, brand colour, logos, and any words or styles you tell us to avoid. This is used to generate content that matches your brand.

Content you create

The posts, captions, images and adverts you make or upload, along with any scheduling information.

Connected social accounts

When you connect a social network (for example Instagram, Facebook, LinkedIn, X or TikTok), we receive and store the access tokens and basic account information (such as your username and display name) needed to publish on your behalf. This connection is handled through our publishing partner, Zernio. You can disconnect any account at any time from your brand profile, which revokes that access.

Filling your brand from Instagram

If you choose Fill from Instagram on your brand page, you log in with Instagram and allow Creslo to read your own professional account, through Meta's Instagram API with Instagram Login (permission: instagram_business_basic). We read your username, name, bio, website, profile picture, follower count and your 12 most recent posts with their captions and pictures. We use them once, to suggest your brand's About, Audience, What you offer, Tone and website, which you review before anything is saved. We do not keep the access Instagram gives us: it is used for that one read and then discarded. We never post with it. What we keep: the brand details you choose to save, the photos you choose to use (in Your photos), and a short record of the import (your Instagram user id and username, and when) so we can remove it later. Anything you did not save is deleted after an hour. To remove it, choose Disconnect Instagram in Settings > Your data, or remove Creslo in Instagram's settings (Apps and websites): either way we delete the imported photos and the record. The brand details you saved stay, as your own words, until you change them. See how to delete your Instagram data.

Filling your brand from Facebook

If you choose Use Facebook on your brand page, you log in with Facebook and allow Creslo to read a Facebook Page you manage, through Facebook Login (permissions: pages_show_list, to list your Pages; pages_read_engagement, to read the Page's details; and pages_read_user_content, to read the Page's posts). If you manage more than one Page, you pick which one. We read the Page's name, username, about, description, category, website, phone, address, opening hours and its 12 most recent posts with their text and pictures. We use them once, to suggest your brand's details, which you review before anything is saved; the Page's opening hours, town and phone only fill boxes that are empty. We do not keep the access Facebook gives us: it is used for that one read and then discarded. We never post with it. What we keep: the brand details you choose to save, the photos you choose to use (in Your photos), and a short record of the import (your Facebook user id, the Page's id and name, and when) so we can remove it later. The other Pages' details and anything you did not save are deleted after an hour. To remove it, choose Disconnect Facebook in Settings > Your data, or remove Creslo in Facebook's settings (Apps and websites): either way we delete the imported photos and the record. See how to delete your Facebook data.

Payment data

Subscription and billing is handled by Stripe. We do not store your full card details - Stripe processes them directly. We retain records of your plan, subscription status, and trial dates.

Usage and technical data

Basic information about how you use Creslo (such as generation counts and feature usage) and standard technical data needed to run a secure service.

Sign-ins and devices

To warn you about a log-in you do not recognise, we keep a short record of each log-in: when it happened, a description of the device and browser (for example "Chrome on Windows"), and a shortened network address (for example 81.2.x.x - never the full address). Settings > Security shows the devices logged in to your account.

A free week request

If you ask for a free week of posts on our free week page, we collect your name, email address, your business's name and website, and - if you have no website - what you tell us about your business and any photos you add. We also record which boxes you ticked and when, and a shortened network address (for example 81.2.x.x) to stop the form being misused. We read your website's public pages to write your posts, and use your own photos where they suit a post.

First posts from your website

If you ask for your first posts on our first posts page, we collect your email address, your business's website and a shortened network address (for example 81.2.x.x) to stop the form being misused. Once you confirm your email, we read your website's public pages to write three posts and choose stock photos for them. Nothing is posted.

We may also prepare a free week for a local business from its public website before getting in touch. If that business is yours and you would rather we did not, email privacy@creslo.ai and we will delete it.

Cookies and similar storage

We use only the storage Creslo needs to work: keeping you logged in, remembering your settings (such as light or dark mode) and keeping the service secure. We do not run advertising trackers.

To see how many people visit the site and which links brought them, we use Vercel Web Analytics. It sets no cookies and does not identify you: it counts page visits and a handful of steps (such as starting a sign-up), records the page address with anything personal removed, and keeps only general details like country and device type. If you arrived on a tagged link (for example from one of our emails or posts), the tag is kept in your browser and, if you create an account, saved with it so we know which of our posts and emails bring people in.

The one exception is our partner programme. If you arrive on Creslo from a partner's link, we ask first whether we may set a referral cookie (run by our affiliate provider, PromoteKit) so the partner who recommended us can be credited if you subscribe. No cookie is set unless you choose Allow, and it expires after 60 days. Until you answer, the partner's code is kept in that browser tab only, so we can still ask you on the next page; it is deleted when you answer or close the tab. Choosing No thanks changes nothing else about the site.

How we use your data

• To provide the service - creating your account, storing your brands, and generating content.
• To generate text using our AI provider (Anthropic) and images using our image provider (fal.ai), guided by your brand profile.
• To schedule and publish content to the social accounts you have connected, via Zernio.
• To take payment and manage your subscription and trial, via Stripe.
• To send you service emails (for example trial reminders or important account notices), via our email provider, Resend, and app notifications, via Firebase Cloud Messaging.
• To make a free week of posts you asked for, email it to you, and make sure each business gets one free week.
• To write the first posts you asked for from your website, email you the link to them, and make sure each business and each email address gets one look.
• To send occasional tips and offers from Creslo, only if you ticked the box asking for them. Every one has a way to unsubscribe.
• To keep the service secure, prevent abuse, and meet our legal obligations - including emailing you about a new log-in.

Legal bases (UK GDPR)

We process your data to perform our contract with you (providing the service), on the basis of our legitimate interests (running and improving Creslo securely), to comply with legal obligations, and - where required, such as for certain communications - with your consent. Making a free week or first posts you asked for is a step you asked us to take before any contract; marketing emails are sent only with your consent. Where we rely on consent you can withdraw it at any time.

Who we share data with

We use a small set of trusted providers (sub-processors) to run Creslo. We share only what each needs to do its job:

• Supabase - database, authentication and file storage (hosted in the EU/UK, London region).
• Vercel and Railway - application hosting; Vercel also counts site visits (Vercel Web Analytics, no cookies).
• Amazon Web Services - rendering videos, where used.
• Anthropic - AI text generation.
• fal.ai - AI image and video generation.
• ElevenLabs - voiceovers for videos, where used.
• Zernio - connecting and publishing to your social accounts.
• Stripe - payment processing.
• Resend - transactional email.
• Microsoft 365 - our own email, if you write to us.
• Google Firebase - notifications to the Creslo app on your phone.
• PromoteKit - crediting the partner who referred you, only if you allowed the referral cookie.
• Pexels - stock imagery, where used.

Some of these providers may process data outside the UK. Where that happens, we rely on appropriate safeguards (such as the UK International Data Transfer Agreement or equivalent contractual protections). We do not sell your personal data.

Data retention

We keep your data for as long as your account is active. If you close your account, we delete or anonymise your personal data within a reasonable period, except where we need to retain certain records (for example billing records) to meet legal or accounting obligations. When you disconnect a social account, the associated access tokens are removed. If you are on the Free plan or have cancelled, and you have not used Creslo for 28 days, we disconnect your social accounts - we email you a week before, and you can reconnect at any time.

Log-in records are deleted after 90 days, and a remembered device 12 months after it was last used.

Free week requests: a request that is not confirmed is deleted after 7 days; one we asked more about and did not hear back on, after 30 days; one we decline, straight away, with its photos. Once your free week has been made, we keep your details for up to 60 days, or until the week itself is deleted if that is sooner; after that we cut the request down to your email address, your business's name and website and the dates, so we can keep to one free week per business, and delete that record after two years. If you start using Creslo from your free week, its posts move into your Scheduler, where you can keep, change or delete them like any of your posts. They are free: they never use any of your generations.

First posts: a request that is not confirmed is deleted after 7 days. After 30 days we delete your email address, the posts and what we read from your website. We keep a simplified copy of your email address, your website and the dates, so each business gets one look, and delete that after two years. If you start using Creslo with them, the posts move into your Scheduler, where you can keep, change or delete them like any of your posts. They are free: they never use any of your generations.

Your rights

Under UK data protection law you have the right to access your data, correct it, erase it, restrict or object to its processing, and request portability. To exercise any of these, email privacy@creslo.ai. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, though we would appreciate the chance to resolve any concern first.

Security

We take reasonable technical and organisational measures to protect your data, including encrypted connections, access controls, and storing social access tokens only where needed to provide the service. No system is perfectly secure, but we work to keep your data safe and to act quickly if anything goes wrong.

Children

Creslo is intended for use by businesses and adults. It is not directed at anyone under 18, and we do not knowingly collect data from children.

Changes to this policy

We may update this policy from time to time. If we make material changes we will update the date above and, where appropriate, notify you. Continuing to use Creslo after a change means you accept the updated policy.

Contact

Questions about this policy or your data? Email privacy@creslo.ai and we will help.