Privacy Policy

1. Who we are

This Privacy Policy explains how Crerio ("Crerio AI", "we", "us") handles personal data when you visit crerio.com or use the Crerio AI service. It should be read with our Terms of Service.

For your account, billing and website data, we decide how the data is used. For the documents your business uploads and the results produced from them ("Customer Data"), we process the data on your behalf and under your instructions, as described in the Terms.

2. What we collect

Account details: your email address and, if you sign in with Google, the name and profile picture Google shares with us. We also keep your plan and subscription status, when you accepted the Terms and which version, your answer to "How did you hear about us?", and the teams and companies you belong to.

Documents and results: when you upload an invoice, it is sent to our AI provider to extract its contents. We do not keep the uploaded file. We keep the results: supplier name, invoice number and date, line items, totals, the discrepancies found, the file name, and a fingerprint of the file (a SHA-256 hash) used to detect duplicate invoices. We also keep the vendor contracts, parts records and export formats you add.

Billing details: the billing contact, company and address you give us, your billing currency, your payments and invoices and whether they are paid. Our payment provider, Dodo Payments, handles payment details, so we never receive your full card number.

Usage counts: how many times your account uses each feature per day (for example uploads, exports and memo downloads), so we can see which features help and improve them. These are counts only, with no document contents, page views or tracking cookies.

Technical data: your IP address is used briefly, in memory, to limit how often forms such as the contact-sales form can be sent, and your country (as reported by our hosting network) is used to show prices in your currency. Our hosting providers keep standard server logs, such as IP addresses and request times, for security and troubleshooting.

API keys and webhooks: we store only a one-way hash of each API key, and the webhook address you give us.

3. How we use it

To provide the service: signing you in, extracting and checking your documents, keeping your history, and running the features you use.

To bill you and manage your subscription, to answer support requests, and to send service emails such as sign-in links and billing notices. We do not send marketing emails without your consent.

To keep the service secure and fair: preventing abuse, enforcing plan limits and investigating problems.

We do not sell personal data, we do not use it for advertising, and we do not use Customer Data to train AI models.

Our legal bases, where the law requires one: performing our contract with you, our legitimate interest in running a secure and reliable service, complying with legal obligations, and your consent where we ask for it.

4. Google user data

If you choose "Continue with Google", Crerio AI asks Google only for the basic sign-in permissions: openid, email and profile. Through them we receive your Google account's email address, name and profile picture. We do not request or access your Gmail, Google Drive, Calendar, Contacts or any other Google data.

We use this information only to create your Crerio AI account, sign you in, show you who is signed in, and contact you about your account. It is stored with your account in our database (hosted by Supabase) and is visible only to you and, if you join one, to the members of your Crerio AI team.

Google sign-in is optional: you can create and use an account with a one-time code sent to your email instead. We use Google only to confirm who you are when you sign in. We do not store Google access or refresh tokens, and we never read, change or send anything in your Google account on your behalf.

We do not sell Google user data, share it with third parties except the service providers in section 6 that host our service, use it for advertising, or use it to train AI models. Our people do not read it except with your permission, for security reasons, or where the law requires.

You can remove Crerio AI's access at any time in your Google Account under Security, "Your connections to third-party apps & services". To delete the Google data we hold, write to support@crerio.com and we will delete it with your account within 30 days.

Crerio AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements (https://developers.google.com/terms/api-services-user-data-policy).

5. How AI is used

Documents are processed by Google's Gemini API. We use Gemini as a paid API customer, under terms that do not allow Google to use our customers' content to train or improve its models.

AI only reads and extracts information. Every amount is checked by exact arithmetic in our own code, and a person (you) reviews flagged results before they are used. No decision with legal or similar effect on you is made by AI alone.

Crerio's AI is used only to read business documents. It does not generate images, video or audio, cannot create or alter pictures of people, and is never used to produce sexual or intimate content, including non-consensual intimate imagery.

6. Who processes your data

We use these service providers (sub-processors) to run Crerio. Each receives only the data it needs for its task:

Supabase: database and sign-in. Render: hosting for our application server. Cloudflare: hosting for the website, network delivery and security. Google: Gemini AI processing, and Google sign-in if you choose it. Dodo Payments: card payments. Resend: delivery of sign-in emails.

If you connect Crerio to your own systems (for example an ERP webhook), we send results to the address you choose. We may also disclose data when the law requires it, or to a successor if Crerio's business is transferred, under the same protections described here.

7. International transfers

Our providers may process data in countries other than yours, including the United States, the European Union and India. Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses in our providers' terms.

8. How long we keep it

Uploaded files are discarded as soon as they have been processed. Account data, results and the records you add are kept while your account is open, so you can reopen past work.

After your account is closed we delete your Customer Data and account data within 30 days, except billing and tax records we must keep by law. Server logs kept by our hosting providers are deleted on their standard schedules.

9. Cookies and browser storage

We use no advertising, tracking or analytics cookies.

Essential cookies keep you signed in. One preference cookie remembers your country for 30 days so prices show in your currency. Your browser's local storage remembers your light or dark theme, the width of the verification panes and the company you last worked in. None of these are shared with anyone else.

10. Your rights

Depending on where you live (for example under India's Digital Personal Data Protection Act, the EU and UK GDPR, or Californian law), you may have the right to access your personal data, correct it, delete it, receive a copy in a portable format, object to or restrict certain processing, and withdraw consent you have given.

To use any of these rights, write to support@crerio.com from the email address on your account. We reply within 30 days and do not charge for reasonable requests. If your data was uploaded by a business that uses Crerio, we may refer your request to that business.

You may also complain to your local data protection authority. We would appreciate the chance to resolve your concern first.

11. Security

All traffic is encrypted with HTTPS. Database access is limited by row-level security, so each account can reach only its own records. Secret keys are kept only on our servers, and access to production systems is restricted.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.

12. Children

Crerio AI is a business service for people aged 18 or over. We do not knowingly collect data from children; if you believe a child has given us data, contact us and we will delete it.

13. Changes to this policy

We will update this policy when our practices change and show the new effective date at the top. For material changes we will notify you by email or in the app before they take effect.

14. Contact

Privacy questions and requests: support@crerio.com. Legal notices: legal@crerio.com.